build(deps): bump the actions group across 1 directory with 5 updates by dependabot[bot] · Pull Request #805 · controlplaneio-fluxcd/flux-operator

dependabot · 2026-04-07T16:21:33Z

Bumps the actions group with 5 updates in the / directory:

Package	From	To
sigstore/cosign-installer	`4.1.0`	`4.1.1`
actions/setup-go	`6.3.0`	`6.4.0`
docker/login-action	`4.0.0`	`4.1.0`
fluxcd/flux2	`2.8.3`	`2.8.4`
anchore/sbom-action	`0.23.1`	`0.24.0`

Updates sigstore/cosign-installer from 4.1.0 to 4.1.1

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.1

What's Changed

chore: update default cosign-release to v3.0.5 in sigstore/cosign-installer#223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

Commits

cad07c2 chore: update default cosign-release to v3.0.5 (#223)
See full diff in compare view

Updates actions/setup-go from 6.3.0 to 6.4.0

Release notes

Sourced from actions/setup-go's releases.

v6.4.0

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in actions/setup-go#721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-go#727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in actions/setup-go#724

Fix Microsoft build of Go link by @gdams in actions/setup-go#734

New Contributors

@gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

Commits

4a36011 docs: fix Microsoft build of Go link (#734)
8f19afc feat: add go-download-base-url input for custom Go distributions (#721)
27fdb26 Bump minimatch from 3.1.2 to 3.1.5 (#727)
def8c39 Rearrange README.md, add advanced-usage.md (#724)
See full diff in compare view

Updates docker/login-action from 4.0.0 to 4.1.0

Release notes

Sourced from docker/login-action's releases.

v4.1.0

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in docker/login-action#945

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in docker/login-action#930

Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in docker/login-action#932 docker/login-action#936

Bump brace-expansion from 1.1.12 to 1.1.13 in docker/login-action#952

Bump fast-xml-parser from 5.3.4 to 5.3.6 in docker/login-action#942

Bump flatted from 3.3.3 to 3.4.2 in docker/login-action#944

Bump glob from 10.3.12 to 10.5.0 in docker/login-action#940

Bump handlebars from 4.7.8 to 4.7.9 in docker/login-action#949

Bump http-proxy-agent and https-proxy-agent to 8.0.0 in docker/login-action#937

Bump lodash from 4.17.23 to 4.18.1 in docker/login-action#958

Bump minimatch from 3.1.2 to 3.1.5 in docker/login-action#941

Bump picomatch from 4.0.3 to 4.0.4 in docker/login-action#948

Bump undici from 6.23.0 to 6.24.1 in docker/login-action#938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

Commits

4907a6d Merge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
1e233e6 chore: update generated content
6c24ead build(deps): bump the aws-sdk-dependencies group with 2 updates
ee034d7 Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.1
1527209 Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
d39362a build(deps): bump lodash from 4.17.23 to 4.18.1
a6f092b chore: update generated content
60953f0 build(deps): bump the proxy-agent-dependencies group with 2 updates
62c6885 Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...
102c0e6 chore: update generated content
Additional commits viewable in compare view

Updates fluxcd/flux2 from 2.8.3 to 2.8.4

Release notes

Sourced from fluxcd/flux2's releases.

v2.8.4

Highlights

Flux v2.8.4 is a patch release that includes bug fixes and improvements across kustomize-controller, source-controller, and notification-controller. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix a race condition where a cancelled reconciliation could leave stale data in the cache, causing Kustomizations to get stuck (kustomize-controller)

Fix Azure Blob prefix option not being passed to the storage client (source-controller)

Improvements:

Improve error message for encrypted SSH keys without password (source-controller)

Add optional email and audience fields to the GCR Receiver for tighter verification (notification-controller)

Add provider manifest example for Azure Event Hub managed identity authentication (notification-controller)

Components changelog

kustomize-controller v1.8.3

source-controller v1.8.2

notification-controller v1.8.3

CLI changelog

Update fluxcd/pkg dependencies by @fluxcdbot in fluxcd/flux2#5796

[release/v2.8.x] fix: validate --source flag in create kustomization command by @fluxcdbot in fluxcd/flux2#5799

Full Changelog: fluxcd/flux2@v2.8.3...v2.8.4

Commits

3cf3cb5 Merge pull request #5799 from fluxcd/backport-5798-to-release/v2.8.x
1569932 fix: validate --source flag in create kustomization command
836f87e Merge pull request #5796 from fluxcd/update-pkg-deps/release/v2.8.x
19545a8 Update fluxcd/pkg dependencies
See full diff in compare view

Updates anchore/sbom-action from 0.23.1 to 0.24.0

Release notes

Sourced from anchore/sbom-action's releases.

v0.24.0

chore: update to node 24 + deps (#614) [@kzantow]

chore: update to ES modules (#595) [@kzantow]

⬆️ Dependencies

chore(deps): update Syft to v1.42.3 (#615) [@anchore-actions-token-generator[bot]]

Commits

e22c389 chore(deps): update Syft to v1.42.3 (#615)
36a5fde chore: update to node 24 + deps (#614)
a0a6512 chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 (#608)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.0` | `4.1.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.3.0` | `6.4.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.0.0` | `4.1.0` | | [fluxcd/flux2](https://github.com/fluxcd/flux2) | `2.8.3` | `2.8.4` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.23.1` | `0.24.0` | Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@ba7bc0a...cad07c2) Updates `actions/setup-go` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4b73464...4a36011) Updates `docker/login-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@b45d80f...4907a6d) Updates `fluxcd/flux2` from 2.8.3 to 2.8.4 - [Release notes](https://github.com/fluxcd/flux2/releases) - [Commits](fluxcd/flux2@871be9b...3cf3cb5) Updates `anchore/sbom-action` from 0.23.1 to 0.24.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@57aae52...e22c389) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: fluxcd/flux2 dependency-version: 2.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: anchore/sbom-action dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/controlplaneio-fluxcd/charts/flux-instance](https://fluxoperator.dev) ([source](https://github.com/controlplaneio-fluxcd/flux-operator)) | minor | `0.45.1` → `0.46.0` | | [ghcr.io/controlplaneio-fluxcd/charts/flux-operator](https://fluxoperator.dev) ([source](https://github.com/controlplaneio-fluxcd/flux-operator)) | minor | `0.45.1` → `0.46.0` | | [ghcr.io/controlplaneio-fluxcd/flux-operator-manifests](https://github.com/controlplaneio-fluxcd/flux-operator) | minor | `v0.45.1` → `v0.46.0` | --- ### Release Notes <details> <summary>controlplaneio-fluxcd/flux-operator (ghcr.io/controlplaneio-fluxcd/charts/flux-instance)</summary> ### [`v0.46.0`](https://github.com/controlplaneio-fluxcd/flux-operator/releases/tag/v0.46.0) [Compare Source](controlplaneio-fluxcd/flux-operator@v0.45.1...v0.46.0) ##### What's Changed - Fix typos in documentation by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#780](controlplaneio-fluxcd/flux-operator#780) - Update Go version requirements in docs by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#781](controlplaneio-fluxcd/flux-operator#781) - Add unit tests for FluxGroupFor by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#782](controlplaneio-fluxcd/flux-operator#782) - build(deps): bump picomatch in /web by [@dependabot](https://github.com/dependabot)\[bot] in [#778](controlplaneio-fluxcd/flux-operator#778) - ci: exclude node\_modules from golangci scanners by [@stefanprodan](https://github.com/stefanprodan) in [#785](controlplaneio-fluxcd/flux-operator#785) - build(deps-dev): bump flatted from 3.3.3 to 3.4.2 in /web by [@dependabot](https://github.com/dependabot)\[bot] in [#770](controlplaneio-fluxcd/flux-operator#770) - operator: support `kubeconfig` key and custom keys in `convertKubeConfigFrom` by [@matheuscscp](https://github.com/matheuscscp) in [#786](controlplaneio-fluxcd/flux-operator#786) - Add unit tests for ValidateAndApplyWorkloadIdentityConfig by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#787](controlplaneio-fluxcd/flux-operator#787) - mcp: Use safe type assertions for Helm history entries by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#783](controlplaneio-fluxcd/flux-operator#783) - mcp: update FluxOCIRepositoryKind version to v1 by [@matheuscscp](https://github.com/matheuscscp) in [#791](controlplaneio-fluxcd/flux-operator#791) - Fix .PHONY declaration for cli-ci-build target by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#789](controlplaneio-fluxcd/flux-operator#789) - Add unit tests for FluxInstance methods by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#793](controlplaneio-fluxcd/flux-operator#793) - Add unit tests for ResourceSet methods by [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) in [#794](controlplaneio-fluxcd/flux-operator#794) - build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#798](controlplaneio-fluxcd/flux-operator#798) - operator: fix ResourceSets and FluxInstance getting stuck due to health check cancellation by [@matheuscscp](https://github.com/matheuscscp) in [#801](controlplaneio-fluxcd/flux-operator#801) - build(deps-dev): bump vite from 7.3.1 to 7.3.2 in /web by [@dependabot](https://github.com/dependabot)\[bot] in [#802](controlplaneio-fluxcd/flux-operator#802) - build(deps): bump the actions group across 1 directory with 5 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#805](controlplaneio-fluxcd/flux-operator#805) - Release v0.46.0 by [@matheuscscp](https://github.com/matheuscscp) in [#807](controlplaneio-fluxcd/flux-operator#807) ##### New Contributors - [@archy-rock3t-cloud](https://github.com/archy-rock3t-cloud) made their first contribution in [#780](controlplaneio-fluxcd/flux-operator#780) **Full Changelog**: <controlplaneio-fluxcd/flux-operator@v0.45.1...v0.46.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/99 Co-authored-by: bot-owl <bot@erwanleboucher.dev> Co-committed-by: bot-owl <bot@erwanleboucher.dev>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 7, 2026

matheuscscp approved these changes Apr 7, 2026

View reviewed changes

matheuscscp merged commit 86363e6 into main Apr 7, 2026
3 checks passed

matheuscscp deleted the dependabot/github_actions/actions-d41d2a095d branch April 7, 2026 16:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the actions group across 1 directory with 5 updates#805

build(deps): bump the actions group across 1 directory with 5 updates#805
matheuscscp merged 1 commit intomainfrom
dependabot/github_actions/actions-d41d2a095d

dependabot Bot commented on behalf of github Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Apr 7, 2026

v4.1.1

What's Changed

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

v4.1.0

v2.8.4

Highlights

Components changelog

CLI changelog

v0.24.0

⬆️ Dependencies

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant