[SebastienSyd]

Bumped the following packages to fix several CVEs:

• golang.org/x/crypto: v0.44.0 -> v0.45.0
• go: 1.25.0 -> 1.25.5
• github.com/opencontainers/runc: v1.2.6 -> v1.2.8

non-exhaustive list of fixed CVEs:

Name	Type	Version Installed	Vulnerability ID	Fixed in	Severity	Path
stdlib	go-module	go1.25.4	CVE-2025-61729	1.24.111.25.5	High	/usr/local/bin/kustomize-controller
golang.org/x/crypto	go-module	v0.44.0	GHSA-j5w8-q4qc-rx2x	0.45.0	Medium	/usr/local/bin/kustomize-controller
golang.org/x/crypto	go-module	v0.44.0	GHSA-f6x5-jh6r-wrfv	0.45.0	Medium	/usr/local/bin/kustomize-controller

[matheuscscp]

CVEs in dependencies are patched as part of the Flux development lifecycle, those CVEs will be patched in Flux 2.8, to be released in Feb 2026.

If you need faster cadence for CVE patching, please consider making Flux a sustainable project by purchasing licenses for ControlPlane's Enterprise for FluxCD, which has a 24h SLA for patching CVEs:

https://fluxcd.control-plane.io/pricing/