[labv2-bot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
home-operations/flate	action	minor	v0.6.5 → v0.7.1	v0.7.3 (+1)

---

Release Notes

home-operations/flate

v0.7.1

Compare Source

Performance Improvements

• output: marshal YAML documents in parallel (#​1487) (bcf5c2b)

v0.7.0

Compare Source

� BREAKING CHANGES

• secrets: treat SOPS-encrypted values as unreadable (#​1435)
• supply: accept any kind as a supplied object (#​1426)
• discovery: render the root layer the entry path applies (#​1379)
• cli: trim flags to inputs flate cannot read from Git (#​1376)
• cli: supply Secrets and ConfigMaps flate cannot read (#​1367)
• get: print get in kubectl form (#​1370)
• helm: take chart digest tracking only from the explicit flag (#​1319)
• cli: simplify flags and kind filtering (#​1125)
• cli: move completed selection and comparison into pkg
• controllers: simplify lifecycle and pin render behavior (#​1113)
• kustomization: preserve Flux substitution without redundant round trips (#​1110)
• data: one lazy data reader and one ciphertext wipe rule (#​1094)

Features

• add pre-commit hook (#​1218) (4978b8b)
• artifactgenerator: converge on consumed-input changes (#​1344) (d1f68d5)
• artifactgenerator: evaluate ArtifactGenerators and publish their ExternalArtifacts (#​1298) (3f61e92)
• baseline: fetch an explicit --base from origin when it is not local (#​1016) (e4d7513)
• cache: record terminal remote failures on explicit roots (#​1165) (c539caa)
• cache: share content-addressed blob frames (#​1141) (e36f879)
• cache: warn when render persistence is disabled for this binary (#​1214) (eebf543)
• cli: run all when a command group is given no subcommand (#​1084) (d0d7c60)
• cli: supply Secrets and ConfigMaps flate cannot read (#​1367) (7914f58)
• cli: trim flags to inputs flate cannot read from Git (#​1376) (0b430f0)
• diff: add json output for rendered resource changes (#​1083) (425a191)
• discovery: render the root layer the entry path applies (#​1379) (c43dab3)
• get: print get in kubectl form (#​1370) (82d4e5a)
• go: update module charm.land/bubbletea/v2 (v2.0.10 � v2.1.0) (#​1133) (022d87d)
• go: update module github.com/controlplaneio-fluxcd/flux-operator (v0.59.0 � v0.60.0) (#​984) (7afccce)
• go: update module github.com/controlplaneio-fluxcd/flux-operator (v0.60.0 � v0.61.0) (#​1045) (cecbe1b)
• go: update module github.com/fluxcd/kustomize-controller/api (v1.9.6 � v1.10.0) (#​1363) (e0bab9a)
• go: update module github.com/fluxcd/pkg/apis/kustomize (v1.20.0 � v1.21.0) (#​990) (63df829)
• go: update module github.com/fluxcd/pkg/apis/kustomize (v1.21.0 � v1.23.0) (#​1246) (fda419d)
• go: update module github.com/fluxcd/pkg/apis/meta (v1.31.0 � v1.32.0) (#​991) (ffe0bdf)
• go: update module github.com/fluxcd/pkg/apis/meta (v1.32.0 � v1.36.0) (#​1248) (0ea5bf0)
• go: update module github.com/fluxcd/pkg/apis/meta (v1.36.0 � v1.37.0) (#​1310) (b887025)
• go: update module github.com/fluxcd/pkg/apis/meta (v1.37.0 � v1.38.0) (#​1332) (580cfd9)
• go: update module github.com/fluxcd/pkg/kustomize (v1.40.0 � v1.41.0) (#​992) (b853de3)
• go: update module github.com/fluxcd/pkg/kustomize (v1.41.0 � v1.43.0) (#​1250) (ec2bdd2)
• go: update module github.com/fluxcd/pkg/kustomize (v1.43.0 � v1.44.0) (#​1334) (ff5baba)
• go: update module github.com/fluxcd/pkg/sourceignore (v0.19.0 � v0.21.0) (#​1254) (ac0e513)
• go: update module github.com/minio/minio-go/v7 (v7.3.0 � v7.4.1) (#​1163) (a5f4ab6)
• go: update module go.yaml.in/yaml/v2 (v2.4.4 � v3.0.5) (#​1144) (1cdfd71)
• go: update module golang.org/x/crypto (v0.55.0 � v0.56.0) (#​968) (26b09b4)
• go: update module golang.org/x/crypto (v0.56.0 � v0.57.0) (#​979) (07d4e3d)
• go: update module golang.org/x/crypto (v0.57.0 � v0.58.0) (#​1143) (99377da)
• go: update module golang.org/x/net (v0.60.0 � v0.61.0) (#​1164) (f3b2399)
• go: update module golang.org/x/sync (v0.22.0 � v0.23.0) (#​977) (ab9b215)
• go: update module golang.org/x/sync (v0.23.0 � v0.24.0) (#​1049) (edc0641)
• go: update module helm.sh/helm/v4 (v4.2.4 � v4.3.0) (#​982) (c97e789)
• go: update module oras.land/oras-go/v2 (v2.6.4 � v2.7.0) (#​1340) (4326605)
• helm: honor DisableChartDigestTracking from the flux-instance release (#​1035) (ff32c0b)
• helmrelease: render chart templates of kind OCIRepository (#​1377) (35ec6fe)
• kustomize: render immutable artifacts through one overlay over any fs.FS (#​1067) (1a75d31)
• manifest: predict ArtifactGenerator ExternalArtifact producers (#​1264) (c2c3a7e)
• orchestrator: render every cluster of a multi-cluster repository (#​1337) (67a2928)
• orchestrator: render only declared objects and their inputs (#​1402) (ab6fc98)
• release: publish a signed packslip with each release (#​1241) (e31da63)
• resourceset: list OCI artifact tags as inputs (#​1413) (66ea404)
• source: latch per-run network timeouts and inject the run transport (#​1156) (8f4e65a)
• source: lazy Git sources through the one cache seam (#​1111) (085beb4)
• source: one cache seam for fetched artifacts (#​1081) (925bf1d)
• source: read helm registry logins for OCI sources (#​1381) (e4ba255)
• source: resolve machine credentials through Docker helpers and AWS shared profiles (#​1400) (bf79c99)
• source: use machine credentials for buckets and helm repositories (#​1382) (e2b0587)
• substitution: external substituteFrom inputs, overlay values and strict expansion (#​1048) (0abb18e)
• supply: accept any kind as a supplied object (#​1426) (2799729)
• tree: immutable trees and private render overlays (#​1058) (f015d21)

Bug Fixes

• baseline: classify a missing shared-root working path as an input error (#​1229) (807c571)
• baseline: classify input errors and carry one resolution state (#​1227) (32ae8e6)
• baseline: complete lazy source admission (#​1134) (e4a0bb9)
• baseline: resolve a base name to its existing remote-tracking branch (#​1209) (3ab329e)
• baseline: select consumers of one-sided data inputs on a committed baseline (#​1299) (2e62d5e)
• cache: bind persisted renders to build identity (#​1132) (8d80142)
• cache: log each acquisition retry wait (#​1155) (9859ec9)
• cache: persist outcomes of machine-authenticated fetch failures (#​1386) (fe20831)
• cache: remove the repair link when blob repair fails (#​1244) (b483c84)
• change: admit the consumer when an optional substituteFrom file appears (#​1274) (dc88a47)
• change: attribute git diff paths to the correct comparison root (#​1033) (f9bf3c8)
• change: decide changed files by the rules Flux ships (#​1057) (32953b3)
• change: keep substituteFrom producers in changed-only renders (#​1153) (764db90)
• change: resolve dependencies outside the changed set (#​1373) (b84474e)
• change: select a HelmRelease when its local chart's files change (#​1308) (4efd2ea)
• change: select consumers when only a generator source changes (#​1341) (aa68ff0)
• change: select only a replaced child's current sources (#​1221) (d17fd09)
• change: stop detection work after cancellation (#​1223) (9ad43a1)
• change: stripe hashing jobs per worker (#​1179) (24c07df)
• cli,keylock: deterministic deferred notes and cancelled-context acquisition (#​1093) (fecc477)
• cli: make persistence explicit (#​1146) (9562708)
• cli: scope the exit status of a named build to the selected objects and their dependencies (#​1052) (16783e7)
• cli: show the progress bar from the start of the run (#​1346) (b5ccb48)
• cli: split FLATE_SUBSTITUTE_FROM on the OS path-list separator (#​1114) (68c970c)
• controllers: honor suspend after refresh (#​1126) (c17fb37)
• controllers: honour Flux's substitute strategy for an empty postBuild (#​1072) (c3bae3d)
• controllers: record child ownership before publication (#​1076) (c91eb3e)
• controllers: return a rejected render attempt instead of rendering it (#​1297) (2bd6da6)
• depwait: give readyExpr the objects' desired spec (#​1318) (754fdde)
• depwait: resolve dependsOn dependencies consistently (#​1027) (c78f96c)
• diff: alias explicit baselines and disclose external skips (#​1020) (184d096)
• diff: name the snapshot side on failure rows (#​1364) (e9def56)
• diff: normalize before pairing in every output (#​1206) (987d4d8)
• diff: pair native diffs by parent like unified and JSON (#​1231) (96e015f)
• diff: preserve explicit baseline identity and disclose external skips (#​1028) (e641f73)
• diff: suppress changes from skipped renders (#​1106) (4fedc18)
• discovery: build a Kustomize root under --path instead of seeding its files (#​1282) (56311ef)
• discovery: follow an empty spec.path as the source root, like Flux (#​1062) (913f885)
• discovery: honor GitRepository spec.ref when aliasing an in-tree source (#​1038) (25a1ff7)
• discovery: keep clusters reached from the repository root (#​1350) (fb96db7)
• discovery: never promote a namespace-less seed as an orphan root (#​1391) (934e035)
• discovery: never render a Kustomization its directory's kustomization.yaml does not list (#​1309) (afb3523)
• discovery: qualify the entry only from effective application evidence (#​1390) (bce2de4)
• discovery: read a Kustomize package's patch files as patches, not objects (#​1302) (fbe2dcb)
• discovery: reject missing non-Git bootstrap sources (#​1425) (a99ff8b)
• discovery: render the literal root only for an entry path Flux applies (#​1388) (18f907c)
• discovery: resolve entry appliers through the bootstrap application walk (#​1465) (40e8125)
• discovery: resolve every Flux entry bootstrap through one seam (#​1172) (8085a25)
• discovery: respect graph ownership when promoting orphans (#​1032) (89021c6)
• discovery: restore multi-cluster detection on the entry walk (#​1468) (d5661cd)
• discovery: wait for substitution data producers (#​1086) (474cf69)
• get: print ./ for a Kustomization that omits spec.path (#​1396) (5e5a6b7)
• gittree: normalize sparse checkout paths like source-controller (#​1339) (4017a9d)
• go: update kubernetes monorepo (v0.37.0 � v0.37.1) (#​1002) (d68bc06)
• go: update module charm.land/bubbletea/v2 (v2.0.9 � v2.0.10) (#​1003) (822523c)
• go: update module github.com/bmatcuk/doublestar/v4 (v4.10.0 � v4.10.3) (#​1304) (0d7bb99)
• go: update module github.com/bmatcuk/doublestar/v4 (v4.10.3 � v4.10.4) (#​1358) (281080f)
• go: update module github.com/charmbracelet/x/ansi (v0.11.8 � v0.11.9) (#​1091) (5c5d5ee)
• go: update module github.com/fluxcd/helm-controller/api (v1.6.4 � v1.6.5) (#​1030) (906543a)
• go: update module github.com/fluxcd/kustomize-controller/api (v1.10.0 � v1.10.1) (#​1389) (3ed7ee1)
• go: update module github.com/fluxcd/kustomize-controller/api (v1.9.5 � v1.9.6) (#​1034) (aeb3868)
• go: update module github.com/fluxcd/source-controller/api (v1.10.0 � v1.10.1) (#​1356) (f5491ee)
• go: update module github.com/fluxcd/source-controller/api (v1.9.5 � v1.9.6) (#​1036) (9cc1992)
• go: update module github.com/go-git/go-git/v5 (v5.19.2 � v5.19.3) (#​1040) (fda43b7)
• go: update module github.com/kimmachinegun/automemlimit (v1.0.0 � v1.0.1) (#​1301) (0d6236e)
• go: update module github.com/klauspost/compress (v1.20.0 � v1.20.1) (#​1006) (755ce86)
• go: update module helm.sh/helm/v4 (v4.3.0 � v4.3.1) (#​1193) (2aa9484)
• go: update module oras.land/oras-go/v2 (v2.6.2 � v2.6.3) (#​1159) (f3591b4)
• go: update module oras.land/oras-go/v2 (v2.6.3 � v2.6.4) (#​1230) (ea4814f)
• go: update module sigs.k8s.io/kustomize/api (v0.21.1 � v0.21.2) (#​1041) (189dc1c)
• go: update module sigs.k8s.io/kustomize/kyaml (v0.21.1 � v0.21.2) (#​1042) (1380f7c)
• helm: bound charts by Helm's decompressed budget (#​1324) (f78b5a8)
• helm: bound the local chart archive read (#​1167) (b194ae9)
• helm: capture directory charts once and parse the captured bytes (#​1152) (1df8574)
• helmchart: persist the terminal outcome of a truncated download (#​1170) (592d44b)
• helmchart: send HelmRepository basic auth to the repo host (#​1014) (f284b8e)
• helm: default the release name and CRD policy like helm-controller (#​1345) (8149167)
• helm: deterministic rendering and cache validity (#​1109) (82f8b08)
• helm: do not render CRDs that --skip-crds will drop (#​1056) (484a797)
• helm: keep show-only document framing and scope hook flags to their action (#​1211) (019cc9a)
• helm: load charts from the acquired layout, not by probing (#​1329) (d3c01ad)
• helm: make date parsing, durationRound and values deterministic (#​1213) (cc25196)
• helm: make template dictionary keys deterministic (#​1074) (5658775)
• helm: print values schema errors in a stable order (#​1348) (34fe5ad)
• helmrelease: preserve synthetic HelmChart source status (#​1075) (758a4a0)
• helmrelease: stop filling empty values to retry a failed render (#​1336) (99d11c9)
• helm: resolve Git and Bucket chart valuesFiles against the source root (#​1233) (df75dcb)
• helm: serve releases with subchart dependencies from the render cache (#​1204) (c2d6b8f)
• helm: take chart digest tracking only from the explicit flag (#​1319) (f57342a)
• helm: take the fallback Kubernetes version from Helm (#​1415) (fbd9406)
• helm: track resolved OCI chart digests for chartRef OCIRepository releases (#​1031) (4000e3a)
• helm: validate chart CRD files Flux would apply (#​1061) (64c99d3)
• image: list only declared image fields (#​1372) (ed0f8f3)
• image: preserve tags in digest-pinned references (#​1019) (fe96ac1)
• image: report every tagged or digested reference, including bare names (#​1317) (39cc026)
• kustomization: preserve Flux substitution without redundant round trips (#​1110) (5d7fc6a)
• kustomization: substitute defaults with empty postBuild variables (#​1018) (ae53a54)
• kustomize: evict failed remote fetches before waking waiters (#​1142) (1ac5193)
• kustomize: Flux image merge, case-insensitive URL schemes, duplicate-id attribution (#​1102) (544fe59)
• kustomize: keep the render cache for remote bases reached after an HTTP 404 (#​1331) (fd3ce31)
• kustomize: own and join shared remote fetch workers (#​1161) (7125649)
• kustomize: parse remote bases like kustomize and honour the source timeout (#​1323) (b2ae9e9)
• kustomize: preflight Git bases under transformers and generators (#​1117) (0f0403d)
• loader: allow directory names beginning with dotdot (#​1095) (99f3c97)
• loader: attribute every file a Kustomization reads in changed-only mode (#​1267) (6126d44)
• loader: fail only the Kustomization that builds a malformed manifest (#​1085) (82c2730)
• loader: fail the producer of a malformed manifest like Flux (#​1371) (3f62796)
• loader: fail the run on a malformed manifest instead of skipping it (#​974) (ca451d3)
• loader: keep encrypted-value warnings when hydrating cached facts (#​1478) (8c88acb)
• loader: promote orphans in indexed order and default admitted scan roots (#​1219) (7e74f9b)
• loader: resolve parent segments in Kustomization claim paths (#​1119) (6c49afa)
• manifest: enforce API groups and normalize claim paths (#​1112) (4cc6ab8)
• manifest: flatten emitted lists the way kubectl and kustomize do (#​1322) (584c1b2)
• manifest: load the builtin schema once for namespace scope (#​1178) (d228c2c)
• manifest: preserve implicit timestamp strings (#​1128) (d11553d)
• manifest: resolve empty envsubst defaults like Flux (#​1222) (0f625bc)
• manifest: substitute envsubst defaults where Flux does, not early (#​1338) (995ab78)
• manifest: treat authored null Kustomization fields as Flux does (#​1263) (eb25a4d)
• manifest: wipe exactly the SOPS ciphertext Flux decrypts (#​1327) (dbadd39)
• oci: select the artifact layer the way source-controller does (#​1321) (8ef701b)
• orchestrator: admit consumers whose inputs an ignore change hides (#​1422) (e8ae841)
• orchestrator: classify every member of a dependency cycle the same way (#​1480) (ec7f312)
• orchestrator: decide ResourceSet document ownership on effective identity (#​1270) (653160a)
• orchestrator: deduplicate namespace warnings (#​1137) (734d4ba)
• orchestrator: emit data objects a ResourceSet generates (#​1237) (9e33c3b)
• orchestrator: make graph cycle membership and messages deterministic (#​1116) ([30a59fc](https://redirect.github

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • Between 01:00 AM and 01:59 AM, only on Monday and Thursday (* 1 * * 1,4)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Rendered Kubernetes changes

Base: 328c560740caa0b950c70a69bd9a40679972d7f3

Head: c49f58b06c31c845020b88fc72951cba07eac3e1

Rendering evidence unavailable. Rendering failed, timed out, was skipped, or did not match this revision. No change categories can be verified. Renderer diagnostics are withheld to protect secrets.

[github-actions]

⚠️ Automated recommendation: REQUEST CHANGES

Analysis engine: qwen3.5-9b-fallback (openai)

Update version parameter in rendered-summary.yaml

File: .github/workflows/rendered-summary.yaml
Line: 34
Problem: The version: 0.6.5 parameter is not updated to match the new action version v0.7.1. This means the workflow will use an older version of flate internally, defeating the purpose of the update.
Fix: Update version: 0.6.5 to version: 0.7.1 in .github/workflows/rendered-summary.yaml.