Update module github.com/rancher/fleet to v0.15.2

[renovate-rancher]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/rancher/fleet	v0.15.0-rc.1.0.20260309094116-5553b4101a80 → v0.15.2

---

Release Notes

rancher/fleet (github.com/rancher/fleet)

v0.15.2

Compare Source

What's Changed

• Propagate CATTLE_WRANGLER_CHECK_GVK_ERROR_MAPPING to fleet-agent (#​5091) by @​0xavi0 in #​5092
• Retain relevant kubernetes.io labels when syncing namespaces (CVE-2026-44938) by @​thardeck in #​5129
• Inherit node selectors for GitRepo sync jobs (#​5011) by @​weyfonk in #​5125
• Require helmRepoURLRegex for Helm credential forwarding (CVE-2026-44936) by @​thardeck in #​5137
• Introduce Policy custom resource (CVE-2026-44935) by @​p-se in #​5144
• Use regexp.QuoteMeta for hostname and path (CVE-2026-44937) by @​p-se in #​5145
• Update module github.com/go-git/go-git/v5 to v5.19.1 (CVE-2026-45022) by @​thardeck in #​5166
• Update dependency go to v1.25.10 by @​renovate-rancher[bot] in #​5122

Full Changelog: rancher/fleet@v0.15.1...v0.15.2

v0.15.1

Compare Source

What's Changed

• Fix --gitrepo and --bundle filters including HelmOps (#​4759) by @​thardeck in #​4830
• Verify cluster in API server before deleting namespace (#​3830) by @​thardeck in #​4838
• Refine conditions for reconciles from cluster updates across shards (#​4484) by @​weyfonk in #​4817
• Fix drift correction regression when correctDrift.force is false (#​4878) by @​0xavi0 in #​4879
• Honor insecureSkipTLS in OCI storage secret (#​4898) by @​khushalchandak17 in #​4926
• Restore status fields when gitjob creation fails (#​4987) by @​0xavi0 in #​4988
• Avoid race condition on first gitjob creation with polling enabled (#​4994) by @​0xavi0 in #​4996
• Align Helm deployer client construction (CVE-2026-41050) by @​thardeck in #​5044
• Update module helm.sh/helm/v4 to v4.1.4 by @​renovate-rancher[bot] in #​4960
• Update dependency go to v1.25.9 by @​renovate-rancher[bot] in #​4970
• Update module github.com/go-git/go-git/v5 to v5.18.0 by @​renovate-rancher[bot] in #​5014
• Update Kubernetes dependencies by @​renovate-rancher[bot] in #​5040

Full Changelog: rancher/fleet@v0.15.0...v0.15.1

v0.15.0

Compare Source

Breaking Changes

• Imagescan, which has had a long life as an experimental feature, is now disabled by default. It can still be explicitly enabled; more information here on what this change means and how to keep the feature enabled. (#​4671) by @​weyfonk in #​4692

• This release introduces Helm v4 and, since this version also incorporates Server-Side Apply, drift correction may be affected.
  To resolve possible issues where drift correction does not work, please use force=true.
  This will be fixed in the next release.

Future Deprecation notice

• Imagescan will be deprecated in a future release.

Notable Changes

Additions

CLI

• Add dump command to CLI (docs) (#​4030) by @​weyfonk in #​4374
• Add monitor (docs) and analyze (docs) commands for troubleshooting Fleet deployments (#​4030) by @​weyfonk in #​4474
• Add CLI command to display bundle diffs from status (docs) (#​4534) by @​thardeck in #​4566
• Improvement of fleet cli subcommand gitcloner (#​4027) by @​ncuralli in #​4488

Core Features

• Fleet has been migrated to Helm v4 (#​4351) by @​thardeck in #​4326
• The automated partitioning limit is now configurable, through autoPartitionThreshold (docs) (#​3827) by @​p-se in #​4536
• When specifying dependencies between bundles, custom states of dependencies are now supported in the dependsOn field through acceptedStates (docs) (#​2552) by @​ncuralli in #​4558
• GitRepoRestrictions now support restricting allowed target namespaces, with AllowedTargetNamespaceSelector (docs) (#​4300) by @​thardeck in #​4562
• Ignoring drift on deployed resources is now more flexible, as resources can be ignored by namespace only or by regex (docs) (#​748) by @​weyfonk in #​4563
• Fleet is now smarter about updates to replica counts of Deployments and StatefulSets (docs) (#​4029) by @​weyfonk in #​4593
• Proxy config is now available in the fleet-agent deployment (#​4267) by @​ftechmax in #​4268
• Any label can now be added to a local cluster when using Fleet standalone, using Helm value bootstrap.clusterLabels by @​k0da in #​4096

Bugfixes

HelmOps

• Fleet now supports Helm templates with lookup (#​1851) by @​0xavi0 in #​4302
• Fetching a Helm chart referenced by the helm.chart field of fleet.yaml now supports custom CA bundles (#​3646) by @​p-se in #​4185
• Github Apps support is extended to Github Enterprise instances, and more generally to hosts other than github.com (#​4554) by @​weyfonk in #​4603
• The known-hosts config map can now receive additional known_hosts entries at Fleet installation time, through Helm value additionalKnownHosts (#​4680) by @​SebPlv in #​4569
• When fetching multiple charts for building bundles, when Helm auth cannot or should not be added for fetching one chart, it is no longer disabled for subsequent charts by @​aruiz14 in #​4336
• Helm URL resolution has received improvements (#​4343) by @​weyfonk in #​4400
• The Fleet agent properly reports installed resources with forced drift correction using Helm v4 (#​4452) by @​thardeck in #​4624
• Fix GitRepo URL matching in webhook server (#​4648) by @​weyfonk in #​4777

Resource Management

• Track UID of existing bundle deployment to prevent orphaning on failure (#​4144) by @​thardeck in #​4273
• Fleet creates options secrets before bundle deployments by @​weyfonk in #​4284
• At bundle creation time, Fleet now detects overlaps between deleted and created bundles, and is able to mitigate accidental resource deletion (#​3770) by @​weyfonk in #​4157
• When fetching Helm charts, concurrent fetches of the same index.yaml file are now optimised (#​4343) by @​aruiz14 in #​4285
• Change GitRepo deletion to handle pending Bundles and track Content resource references (#​4192) by @​0xavi0 in #​4361
• Use the defaultNs for valuesFrom contained in downstream resources (#​4274) by @​0xavi0 in #​4373
• Make valuesFrom kind check case-insensitive (#​4274) by @​0xavi0 in #​4408
• The controller deletes finalizers in content resources after upgrade (#​4472) by @​0xavi0 in #​4457
• Take respective timestamps into account when comparing snapshots by @​weyfonk in #​4546
• Prevent nil pointer dereference on cluster import (#​4491) by @​p-se in #​4494
• Prevent race when bundles are created concurrently (#​4487) by @​p-se in #​4489

Automated copy of resources to downstream clusters (docs)

• Resources referenced as downstreamResources can now be copied to the local cluster (#​4559) by @​0xavi0 in #​4560
• Fleet now monitors downstreamResources for changes, and is able to trigger new deployments when they change (docs) (#​2085) by @​0xavi0 in #​4530
• This monitoring includes GitRepo secrets (#​2085) by @​0xavi0 in #​4574
• Secrets referenced through downstreamResources have their types preserved when copied downstream (#​3617) by @​weyfonk in #​4490

Stability & Operations

• Add configurable concurrent bundle creation routines to fleet apply (#​4233) by @​thardeck in #​4292
• Support cluster display name in clusterName selector (rancher/rancher#51239) by @​thardeck in #​4495
• Adds a sharding filter when calculating Bundles from Cluster (#​4275) by @​0xavi0 in #​4282
• GitRepos and HelmOps don't Requeue when adding finalizers by @​0xavi0 in #​4264
• Clear Reason when Ready condition transitions from non-ready to ready (#​4561) by @​0xavi0 in #​4578
• Use controlled Requeue for non-ready dependencies during deploy (#​4469) by @​aruiz14 in #​4453
• Prevent false drift from Helm v4 null field rendering (#​4655) by @​thardeck in #​4664
• Set Recreate deployment strategy when hostNetwork is enabled (#​4432) by @​webD97 in #​4467
• Fix race when creating secrets and Kubernetes jobs by @​p-se in #​4319
• Sort AgentTolerations when creating agent Bundle by @​0xavi0 in #​4367
• Individual resources requests/limits for fleet-controllers (#​4516) by @​p-se in #​4568
• Fixes race condition when BD secrets are transiently unavailable (#​4599) by @​0xavi0 in #​4707
• Mark agentSchedulingCustomization nullable in CRD (rancher/rancher#53781) by @​thardeck in #​4731
• Normalize empty agentSchedulingCustomization to nil (rancher/rancher#53781) by @​thardeck in #​4751
• Fix BundleDeployment creation race condition (#​4756) by @​0xavi0 in #​4757
• Avoid uninstalling releases in PendingInstall status (#​4572) by @​0xavi0 in #​4600
• Adds a temporary fix to avoid race conditions when processing webhooks (#​4853) by @​0xavi0 in #​4854

Notable Dependency Updates

• Replace gorilla/mux with net/http ServeMux (#​4682) by @​thardeck in #​4717
• Update dependency go to v1.25.8 by @​renovate-rancher[bot] in #​4778
• Update module github.com/go-git/go-git/v5 to v5.16.5 [security] by @​renovate-rancher[bot] in #​4614
• Update Kubernetes dependencies to v0.35.2 by @​renovate-rancher[bot] in #​4721
• Update module helm.sh/helm/v4 to v4.1.1 by @​renovate-rancher[bot] in #​4622
• Update module github.com/rancher/wrangler/v3 to v3.4.0 by @​renovate-rancher[bot] in #​4650
• Update module golang.org/x/crypto to v0.48.0 [security] by @​renovate-rancher[bot] in #​4653
• Update module golang.org/x/net to v0.51.0 [security] by @​renovate-rancher[bot] in #​4772
• Update github.com/cloudflare/circl to v1.6.3 [security] by @​dependabot[bot] in #​4723

New Contributors

• @​webD97 made their first contribution in #​4467
• @​ncuralli made their first contribution in #​4488
• @​ftechmax made their first contribution in #​4268
• @​SebPlv made their first contribution in #​4569

Full Changelog: rancher/fleet@v0.14.0...v0.15.0

If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[renovate-rancher]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 20 additional dependencies were updated

Details:

Package	Change
k8s.io/api	v0.35.2 -> v0.35.4
k8s.io/apimachinery	v0.35.2 -> v0.35.4
k8s.io/metrics	v0.35.2 -> v0.35.4
github.com/fluxcd/cli-utils	v0.37.0-flux.1 -> v0.37.2-flux.1
github.com/go-git/go-billy/v5	v5.8.0 -> v5.9.0
github.com/go-git/go-git/v5	v5.17.0 -> v5.19.1
github.com/pjbgf/sha1cd	v0.3.2 -> v0.6.0
github.com/prometheus/procfs	v0.17.0 -> v0.19.2
go.opentelemetry.io/proto/otlp	v1.5.0 -> v1.9.0
golang.org/x/crypto	v0.48.0 -> v0.50.0
golang.org/x/net	v0.50.0 -> v0.53.0
golang.org/x/sys	v0.41.0 -> v0.43.0
golang.org/x/term	v0.40.0 -> v0.42.0
golang.org/x/text	v0.34.0 -> v0.36.0
helm.sh/helm/v4	v4.1.1 -> v4.1.4
k8s.io/apiextensions-apiserver	v0.35.2 -> v0.35.4
k8s.io/apiserver	v0.35.2 -> v0.35.4
k8s.io/cli-runtime	v0.35.2 -> v0.35.4
k8s.io/component-base	v0.35.2 -> v0.35.4
k8s.io/kubectl	v0.35.2 -> v0.35.4

[raulcabello]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts in go.mod and go.sum. The conflict was between this PR updating github.com/rancher/fleet to v0.15.2 and main having already merged github.com/rancher/fleet/pkg/apis to v0.15.2 (#78). Both are now set to v0.15.2 (commit 716bf67).

[renovate-rancher]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.