[dependabot]

Bumps github.com/fluxcd/helm-controller/api from 1.6.5 to 1.7.1.

Release notes

Sourced from github.com/fluxcd/helm-controller/api's releases.

v1.7.1

Changelog

v1.7.1 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.7.1
• ghcr.io/fluxcd/helm-controller:v1.7.1

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

v1.7.0

Changelog

v1.7.0 changelog

Container images

• docker.io/fluxcd/helm-controller:v1.7.0
• ghcr.io/fluxcd/helm-controller:v1.7.0

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/helm-controller/api's changelog.

1.7.1

Release date: 2026-10-26

This patch release fixes a case where a failed upgrade was reported as Ready. When an upgrade fails before Helm stores a release and the only change is .spec.postRenderers, the controller now compares the post-renderers digests on every reconcile and retries, instead of reporting the HelmRelease as ready while the release in the cluster still runs the previous post-renderers. The digest comparison uses the algorithm of the observed digest, so changing --snapshot-digest-algo no longer triggers upgrades. It also changes how the controller reacts when a downloaded artifact does not match the digest advertised in the source status: instead of failing until the next retry interval, the HelmRelease is marked as not ready with ArtifactFailed and requeued after --requeue-dependency (default 30s), matching the behavior it already had for a missing artifact, and the Could not load chart warning event is no longer emitted for this error.

Fixes:

• Fix invalid postRenderers change causing release to report Ready #1640
• Requeue on artifact digest mismatch #1639
• Update fluxcd/pkg dependencies #1636

1.7.0

Release date: 2026-10-24

This minor release adds OCIRepository as a chart template for HelmRelease, graduates object-level workload identity, now renamed to object identity, and introduces SPIFFE mTLS between the controllers.

Object Identity

Object-level workload identity is now generally available and renamed to object identity. Workload identity refers exclusively to identities assigned to Flux controllers, while object identity refers to identities assigned to Flux objects. The ObjectLevelWorkloadIdentity feature gate is retired and the feature is always enabled.

Two credential providers can now supply the credential: kubernetes, which uses the Kubernetes TokenRequest API and was already available, and spiffe, which fetches a JWT-SVID from the SPIFFE Broker API. The provider is configured on the ServiceAccount with credential.auth.fluxcd.io/provider, independently of the service provider in .spec.provider.

See the object identity documentation for the annotation reference.

... (truncated)

Commits

• da037f2 Merge pull request #1642 from fluxcd/release-v1.7.1
• 5763cba Release v1.7.1
• 87b563a Add changelog entry for v1.7.1
• f60a14d Merge pull request #1640 from fluxcd/backport-1609-to-release/v1.7.x
• bdc8c7b Always compare post-renderers digests
• d23160f Fix invalid postRenderers change causing release to report Ready
• 7ca9bab Merge pull request #1639 from fluxcd/backport-1638-to-release/v1.7.x
• 85e3cd2 Requeue on artifact digest mismatch
• b95e73a Merge pull request #1636 from fluxcd/update-pkg-deps/release/v1.7.x
• cd2081b Update fluxcd/pkg dependencies
• Additional commits viewable in compare view

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: #7259 | upstream | last-verified 2026-11-04: this bump pulls Kubernetes client libraries v0.37 (k8s.io/api v0.37.1), but go.mod maps k8s.io/apimachinery v0.37.1 back to v0.36.5 until #7259 lands, so the desktop build fails at 4ff40ee with MarkShortCircuit undefined in k8s.io/api scheduling/v1alpha3. Same blocker as #8045, #8026, #7932 and #7540.

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Rebasing onto main now that ksail#8243 cleared the vulnerability scan; this head was cut from an older base whose k8s.io/api/apimachinery mix fails to compile.

@dependabot rebase