From de867a455520e6b15054720db99646f0c39a4c58 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Fri, 7 Aug 2026 15:42:36 +0300 Subject: [PATCH 1/2] Add changelog entry for v2.2.3 Signed-off-by: Stefan Prodan --- CHANGELOG.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a65bc29..b51c3d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,25 @@ All notable changes to this project are documented in this file. +## 2.2.3 + +**Release date:** 2026-08-07 + +This patch release aligns the tarball extraction performed by `Extract` copy +operations with the other copy operations, so that it writes through `os.Root` +and stays confined to the artifact root. It also bounds the expansion of the +`from` and `exclude` glob patterns, which may now contain at most 20 commas +inside `{}` alternation groups. On the `ArtifactGenerator` API, the `to` field +validation pattern no longer accepts `.` and `..` path segments, and each +`exclude` pattern is limited to 1024 characters. + +Note that this release contains a CRD schema change, the `ArtifactGenerator` +CRD must be updated along with the controller. + +Fixes: +- Confine tarball extraction and bound glob expansion + [#374](https://github.com/fluxcd/source-watcher/pull/374) + ## 2.2.2 **Release date:** 2026-07-07 From 26a1d8d992bbb955192fe8ff5e29bf984d0f83e7 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Fri, 7 Aug 2026 15:42:45 +0300 Subject: [PATCH 2/2] Release v2.2.3 Signed-off-by: Stefan Prodan --- config/manager/kustomization.yaml | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml index 0a90708..0ad5b81 100644 --- a/config/manager/kustomization.yaml +++ b/config/manager/kustomization.yaml @@ -6,4 +6,4 @@ resources: images: - name: fluxcd/source-watcher newName: fluxcd/source-watcher - newTag: v2.2.2 + newTag: v2.2.3 diff --git a/go.mod b/go.mod index 5fc3234..5dca3bc 100644 --- a/go.mod +++ b/go.mod @@ -18,7 +18,7 @@ require ( github.com/fluxcd/pkg/tar v1.2.0 github.com/fluxcd/pkg/testserver v0.14.0 github.com/fluxcd/source-controller/api v1.9.0 - github.com/fluxcd/source-watcher/api/v2 v2.2.2 + github.com/fluxcd/source-watcher/api/v2 v2.2.3 github.com/onsi/gomega v1.42.1 github.com/opencontainers/go-digest v1.0.0 github.com/spf13/pflag v1.0.10