flux

Update dependency fluxcd/flux2 to v2.8.7

Updated minor release successfully via Homebrew and CLI bootstrapping Proxmox VE K3s Kubernetes cluster.

This MR contains the following updates:

Package	Update	Change
fluxcd/flux2	patch	`v2.8.6` → `v2.8.7`

Release Notes

fluxcd/flux2 (fluxcd/flux2)

`v2.8.7`

Compare Source

Highlights

Flux v2.8.7 is a patch release that includes a bug fix in kustomize-controller, a CVE fix in source-controller and image-automation-controller via go-git v5.19.0, and dependency updates. Users are encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

Fix management of objects annotated with kustomize.toolkit.fluxcd.io/ssa: IfNotPresent where non-namespaced resources were being deleted and recreated on each reconciliation (kustomize-controller)

Improvements:

Update go-git to v5.19.0 which fixes CVE-2026-45022 (source-controller, image-automation-controller)
Update fluxcd/pkg dependencies (source-controller, kustomize-controller, image-automation-controller)

Components changelog

helm-controller v1.5.4
image-automation-controller v1.1.3
kustomize-controller v1.8.5
notification-controller v1.8.4
source-controller v1.8.4

CLI changelog

Update toolkit components by @fluxcdbot in #5891

Full Changelog: https://github.com/fluxcd/flux2/compare/v2.8.6...v2.8.7

Update docker.io/metabase/metabase Docker tag to v0.61.1

No problems upgrading the Docker container with a Docker compose yaml file and by means of Watchtower infrastructure with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/metabase/metabase minor v0.60.6 → v0.61.1 Release Notes

Update docker.io/ghost Docker tag to v6.38.0

On both domains I upgraded Ghost successfully by means of Watchtower Docker container update with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/ghost minor 6.37.1 → 6.38.0 Release Notes TryGhost/Ghost (docker.io/ghost)

Update ghcr.io/goauthentik/server Docker tag to v2026.2.3

No problems upgrading the Docker container with a Docker compose yaml file by means of Watchtower DevOps resp. GitOps with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change ghcr.io/goauthentik/server (source) patch 2026.2.2 → 2026.2.3

Update docker.io/rocketchat/rocket.chat Docker tag to v8.4.1

No problems automatically updating the Docker image and run the container by Watchtower for Bierochs and Tanzcrew teams with dependency update facilitated by Mend's Renovate Bot. This MR contains the following updates: Package Update Change docker.io/rocketchat/rocket.chat patch 8.4.0 → 8.4.1 Release