Signed-off-by: Evan Anderson <[email protected]>
Signed-off-by: Matheus Pimenta <[email protected]>
(cherry picked from commit b7e54e5)

[release/v1.8.x] Support Helm semver encoding in OCI repositories

Signed-off-by: Matheus Pimenta <[email protected]>

[v1.8.x] Update Helm to v4.2.0

Signed-off-by: Matheus Pimenta <[email protected]>

[v1.8.x] Upgrade k8s to 1.36.1, c-r to 0.24.1, cli-utils to 1.2.1

Bucket object keys are external input and may contain arbitrary
characters. Joining them with the reconciler's working directory
through `filepath.Join` applies `filepath.Clean`, which collapses
parent-directory segments and can yield a destination outside the
working directory. `securejoin.SecureJoin` resolves the key while
keeping the result within the working directory, matching the
pattern already used elsewhere in the controllers for similar
joins (e.g. GitRepository include paths).

Assisted-by: claude-code/opus-4.7
Signed-off-by: Hidde Beydals <[email protected]>
(cherry picked from commit 6d2d86d)

When validating that the paths listed in `spec.sparseCheckout`
exist in the cloned working tree, resolve each entry with
`securejoin.SecureJoin` instead of `filepath.Join`. `filepath.Join`
collapses parent-directory segments via `filepath.Clean`, so a
configured path like `../foo` would have been checked against a
location outside the working tree, masking a missing entry behind
an unrelated filesystem stat. SecureJoin keeps the resolved path
inside the working tree, matching the pattern already used for
include paths elsewhere in the controller.

Assisted-by: claude-code/opus-4.7
Signed-off-by: Hidde Beydals <[email protected]>
(cherry picked from commit f5fe034)

[release/v1.8.x] Improve path handling in source reconcilers

Signed-off-by: GitHub <[email protected]>

Update fluxcd/pkg dependencies

Signed-off-by: Matheus Pimenta <[email protected]>

Signed-off-by: Matheus Pimenta <[email protected]>

Release v1.8.5