Merge pull request #5741 from fluxcd/backport-5740-to-release/v2.8.x

[release/v2.8.x] Update toolkit components
Update toolkit components
2026-03-31 14:04:19 +00:00 · 2026-02-27 09:39:11 +00:00 · 2026-02-27 09:28:19 +00:00 · 2026-02-27 09:05:41 +00:00 · 2026-02-27 08:52:59 +00:00 · 2026-02-25 11:10:32 +00:00
46 changed files with 351 additions and 2913 deletions
--- a/.github/labels.yaml
+++ b/.github/labels.yaml
@@ -44,12 +44,12 @@
  description: Feature request proposals in the RFC format
  color: '#D621C3'
  aliases: ['area/RFC']
+- name: backport:release/v2.5.x
+  description: To be backported to release/v2.5.x
+  color: '#ffd700'
 - name: backport:release/v2.6.x
  description: To be backported to release/v2.6.x
  color: '#ffd700'
 - name: backport:release/v2.7.x
  description: To be backported to release/v2.7.x
  color: '#ffd700'
- name: backport:release/v2.8.x
-  description: To be backported to release/v2.8.x
-  color: '#ffd700'
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -23,7 +23,7 @@ amd when it finds a new controller version, the workflow performs the following
 - Updates the controller API package version in `go.mod`.
 - Patches the controller CRDs version in the `manifests/crds` overlay.
 - Patches the controller Deployment version in `manifests/bases` overlay.
- Opens a Pull Request against the checked out branch.
+- Opens a Pull Request against the `main` branch.
 - Triggers the e2e test suite to run for the opened PR.


--- a/.github/workflows/conformance.yaml
+++ b/.github/workflows/conformance.yaml
@@ -3,7 +3,7 @@ name: conformance
 on:
  workflow_dispatch:
  push:
-    branches: [ 'main', 'update-components-**', 'release/**', 'conform*' ]
+    branches: [ 'main', 'update-components', 'release/**', 'conform*' ]

 permissions:
  contents: read
@@ -25,7 +25,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: |
@@ -82,7 +82,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: |
@@ -107,7 +107,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
      - name: Create cluster
        id: create-cluster
-        uses: replicatedhq/replicated-actions/create-cluster@1abb33f5274580b14f49f2a12d819df7920e4d9b # v1.20.0
+        uses: replicatedhq/replicated-actions/create-cluster@49b440dabd7e0e868cbbabda5cfc0d8332a279fa # v1.19.0
        with:
          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
          kubernetes-distribution: "k3s"
@@ -150,7 +150,7 @@ jobs:
          kubectl delete ns flux-system --wait
      - name: Delete cluster
        if: ${{ always() }}
-        uses: replicatedhq/replicated-actions/remove-cluster@1abb33f5274580b14f49f2a12d819df7920e4d9b # v1.20.0
+        uses: replicatedhq/replicated-actions/remove-cluster@49b440dabd7e0e868cbbabda5cfc0d8332a279fa # v1.19.0
        continue-on-error: true
        with:
          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
@@ -174,7 +174,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: |
@@ -199,7 +199,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
      - name: Create cluster
        id: create-cluster
-        uses: replicatedhq/replicated-actions/create-cluster@1abb33f5274580b14f49f2a12d819df7920e4d9b # v1.20.0
+        uses: replicatedhq/replicated-actions/create-cluster@49b440dabd7e0e868cbbabda5cfc0d8332a279fa # v1.19.0
        with:
          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
          kubernetes-distribution: "openshift"
@@ -240,7 +240,7 @@ jobs:
          kubectl delete ns flux-system --wait
      - name: Delete cluster
        if: ${{ always() }}
-        uses: replicatedhq/replicated-actions/remove-cluster@1abb33f5274580b14f49f2a12d819df7920e4d9b # v1.20.0
+        uses: replicatedhq/replicated-actions/remove-cluster@49b440dabd7e0e868cbbabda5cfc0d8332a279fa # v1.19.0
        continue-on-error: true
        with:
          api-token: ${{ secrets.REPLICATED_API_TOKEN }}
--- a/.github/workflows/e2e-azure.yaml
+++ b/.github/workflows/e2e-azure.yaml
@@ -31,12 +31,12 @@ jobs:
      - name: CheckoutD
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: 1.26.x
          cache-dependency-path: tests/integration/go.sum
      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
      - name: Setup Flux CLI
        run: make build
        working-directory: ./
--- a/.github/workflows/e2e-bootstrap.yaml
+++ b/.github/workflows/e2e-bootstrap.yaml
@@ -19,7 +19,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: 1.26.x
          cache-dependency-path: |
--- a/.github/workflows/e2e-gcp.yaml
+++ b/.github/workflows/e2e-gcp.yaml
@@ -31,12 +31,12 @@ jobs:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: 1.26.x
          cache-dependency-path: tests/integration/go.sum
      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
      - name: Setup Flux CLI
        run: make build
        working-directory: ./
@@ -56,11 +56,11 @@ jobs:
      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
      - name: Setup QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - name: Log into us-central1-docker.pkg.dev
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: us-central1-docker.pkg.dev
          username: oauth2accesstoken
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -25,7 +25,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: 1.26.x
          cache-dependency-path: |
--- a/.github/workflows/ossf.yaml
+++ b/.github/workflows/ossf.yaml
@@ -28,12 +28,12 @@ jobs:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          publish_results: true
      - name: Upload artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5
      - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          sarif_file: results.sarif
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -26,31 +26,31 @@ jobs:
      - name: Unshallow
        run: git fetch --prune --unshallow
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: 1.26.x
          cache: false
      - name: Setup QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
      - name: Setup Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - name: Setup Syft
-        uses: anchore/sbom-action/download-syft@57aae528053a48a3f6235f2d9461b05fbcb7366d # v0.23.1
+        uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
      - name: Setup Cosign
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: v2.6.1 # TODO: remove after Flux 2.8 with support for cosign v3
      - name: Setup Kustomize
        uses: fluxcd/pkg/actions/kustomize@9a8c0edd5da84dc51a585738c67e3a3950d7fbf0 # main
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: fluxcdbot
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: fluxcdbot
          password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
@@ -72,7 +72,7 @@ jobs:
          tar -czvf ./output/crd-schemas.tar.gz -C schemas .
      - name: Run GoReleaser
        id: run-goreleaser
-        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
        with:
          version: latest
          args: release --skip=validate
@@ -116,13 +116,13 @@ jobs:
          VERSION=$(flux version --client | awk '{ print $NF }')
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
      - name: Login to GHCR
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: fluxcdbot
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to DockerHub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: fluxcdbot
          password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
@@ -150,7 +150,7 @@ jobs:
          --path="./flux-system" \
          --source=${{ github.repositoryUrl }} \
          --revision="${{ github.ref_name }}@sha1:${{ github.sha }}"
-      - uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: v2.6.1 # TODO: remove after Flux 2.8 with support for cosign v3
      - name: Sign manifests
--- a/.github/workflows/update.yaml
+++ b/.github/workflows/update.yaml
@@ -18,7 +18,7 @@ jobs:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version: 1.26.x
          cache-dependency-path: |
@@ -106,7 +106,7 @@ jobs:
          committer: GitHub <noreply@github.com>
          author: fluxcdbot <fluxcdbot@users.noreply.github.com>
          signoff: true
-          branch: update-components-${{ github.ref_name }}
+          branch: update-components
          title: Update toolkit components
          body: |
            ${{ steps.update.outputs.pr_body }}
--- a/.github/workflows/upgrade-fluxcd-pkg.yaml
+++ b/.github/workflows/upgrade-fluxcd-pkg.yaml
@@ -3,9 +3,6 @@ name: upgrade-fluxcd-pkg
 on:
  workflow_dispatch:

-permissions:
-  contents: read
-
 jobs:
  upgrade-fluxcd-pkg:
    uses: fluxcd/gha-workflows/.github/workflows/upgrade-fluxcd-pkg.yaml@v0.9.0
--- a/cmd/flux/main.go
+++ b/cmd/flux/main.go
@@ -186,8 +186,6 @@ func main() {
 	// logger, we configure it's logger to do nothing.
 	ctrllog.SetLogger(logr.New(ctrllog.NullLogSink{}))

-	registerPlugins()
-
 	if err := rootCmd.Execute(); err != nil {

 		if err, ok := err.(*RequestError); ok {
--- a/cmd/flux/plugin.go
+++ b/cmd/flux/plugin.go
@@ -1,340 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/briandowns/spinner"
-	"github.com/spf13/cobra"
-
-	"github.com/fluxcd/flux2/v2/internal/plugin"
-	"github.com/fluxcd/flux2/v2/pkg/printers"
-)
-
-var pluginHandler = plugin.NewHandler()
-
-var pluginCmd = &cobra.Command{
-	Use:   "plugin",
-	Short: "Manage Flux CLI plugins",
-	Long:  `The plugin sub-commands manage Flux CLI plugins.`,
-	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-		// No-op: skip root's namespace DNS validation for plugin commands.
-		return nil
-	},
-}
-
-var pluginListCmd = &cobra.Command{
-	Use:     "list",
-	Aliases: []string{"ls"},
-	Short:   "List installed plugins",
-	Long:    `The plugin list command shows all installed plugins with their versions and paths.`,
-	RunE:    pluginListCmdRun,
-}
-
-var pluginInstallCmd = &cobra.Command{
-	Use:   "install <name>[@<version>]",
-	Short: "Install a plugin from the catalog",
-	Long: `The plugin install command downloads and installs a plugin from the Flux plugin catalog.
-
-Examples:
-  # Install the latest version
-  flux plugin install operator
-
-  # Install a specific version
-  flux plugin install operator@0.45.0`,
-	Args: cobra.ExactArgs(1),
-	RunE: pluginInstallCmdRun,
-}
-
-var pluginUninstallCmd = &cobra.Command{
-	Use:   "uninstall <name>",
-	Short: "Uninstall a plugin",
-	Long:  `The plugin uninstall command removes a plugin binary and its receipt from the plugin directory.`,
-	Args:  cobra.ExactArgs(1),
-	RunE:  pluginUninstallCmdRun,
-}
-
-var pluginUpdateCmd = &cobra.Command{
-	Use:   "update [name]",
-	Short: "Update installed plugins",
-	Long: `The plugin update command updates installed plugins to their latest versions.
-
-Examples:
-  # Update a single plugin
-  flux plugin update operator
-
-  # Update all installed plugins
-  flux plugin update`,
-	Args: cobra.MaximumNArgs(1),
-	RunE: pluginUpdateCmdRun,
-}
-
-var pluginSearchCmd = &cobra.Command{
-	Use:   "search [query]",
-	Short: "Search the plugin catalog",
-	Long:  `The plugin search command lists available plugins from the Flux plugin catalog.`,
-	Args:  cobra.MaximumNArgs(1),
-	RunE:  pluginSearchCmdRun,
-}
-
-func init() {
-	pluginCmd.AddCommand(pluginListCmd)
-	pluginCmd.AddCommand(pluginInstallCmd)
-	pluginCmd.AddCommand(pluginUninstallCmd)
-	pluginCmd.AddCommand(pluginUpdateCmd)
-	pluginCmd.AddCommand(pluginSearchCmd)
-	rootCmd.AddCommand(pluginCmd)
-}
-
-// builtinCommandNames returns the names of all non-plugin commands on rootCmd.
-func builtinCommandNames() []string {
-	var names []string
-	for _, c := range rootCmd.Commands() {
-		if c.GroupID != "plugin" {
-			names = append(names, c.Name())
-		}
-	}
-	return names
-}
-
-// registerPlugins scans the plugin directory and registers discovered
-// plugins as Cobra subcommands on rootCmd.
-func registerPlugins() {
-	plugins := pluginHandler.Discover(builtinCommandNames())
-	if len(plugins) == 0 {
-		return
-	}
-
-	if !rootCmd.ContainsGroup("plugin") {
-		rootCmd.AddGroup(&cobra.Group{
-			ID:    "plugin",
-			Title: "Plugin Commands:",
-		})
-	}
-
-	for _, p := range plugins {
-		cmd := &cobra.Command{
-			Use:                p.Name,
-			Short:              fmt.Sprintf("Runs the %s plugin", p.Name),
-			Long:               fmt.Sprintf("This command runs the %s plugin.\nUse 'flux %s --help' for full plugin help.", p.Name, p.Name),
-			DisableFlagParsing: true,
-			GroupID:            "plugin",
-			ValidArgsFunction:  plugin.CompleteFunc(p.Path),
-			PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-				return nil
-			},
-			RunE: func(cmd *cobra.Command, args []string) error {
-				return plugin.Exec(p.Path, args)
-			},
-		}
-		rootCmd.AddCommand(cmd)
-	}
-}
-
-func pluginListCmdRun(cmd *cobra.Command, args []string) error {
-	pluginDir := pluginHandler.PluginDir()
-	plugins := pluginHandler.Discover(builtinCommandNames())
-	if len(plugins) == 0 {
-		cmd.Println("No plugins found")
-		return nil
-	}
-
-	header := []string{"NAME", "VERSION", "PATH"}
-	var rows [][]string
-	for _, p := range plugins {
-		version := "manual"
-		if receipt := plugin.ReadReceipt(pluginDir, p.Name); receipt != nil {
-			version = receipt.Version
-		}
-		rows = append(rows, []string{p.Name, version, p.Path})
-	}
-
-	return printers.TablePrinter(header).Print(cmd.OutOrStdout(), rows)
-}
-
-func pluginInstallCmdRun(cmd *cobra.Command, args []string) error {
-	nameVersion := args[0]
-	name, version := parseNameVersion(nameVersion)
-
-	catalogClient := newCatalogClient()
-	manifest, err := catalogClient.FetchManifest(name)
-	if err != nil {
-		return err
-	}
-
-	pv, err := plugin.ResolveVersion(manifest, version)
-	if err != nil {
-		return err
-	}
-
-	plat, err := plugin.ResolvePlatform(pv, runtime.GOOS, runtime.GOARCH)
-	if err != nil {
-		return fmt.Errorf("plugin %q v%s has no binary for %s/%s", name, pv.Version, runtime.GOOS, runtime.GOARCH)
-	}
-
-	pluginDir := pluginHandler.EnsurePluginDir()
-
-	installer := plugin.NewInstaller()
-	sp := newPluginSpinner(fmt.Sprintf("installing %s v%s", name, pv.Version))
-	sp.Start()
-	if err := installer.Install(pluginDir, manifest, pv, plat); err != nil {
-		sp.Stop()
-		return err
-	}
-	sp.Stop()
-
-	logger.Successf("installed %s v%s", name, pv.Version)
-	return nil
-}
-
-func pluginUninstallCmdRun(cmd *cobra.Command, args []string) error {
-	name := args[0]
-	pluginDir := pluginHandler.PluginDir()
-
-	if err := plugin.Uninstall(pluginDir, name); err != nil {
-		return err
-	}
-
-	logger.Successf("uninstalled %s", name)
-	return nil
-}
-
-func pluginUpdateCmdRun(cmd *cobra.Command, args []string) error {
-	catalogClient := newCatalogClient()
-
-	plugins := pluginHandler.Discover(builtinCommandNames())
-	if len(plugins) == 0 {
-		cmd.Println("No plugins found")
-		return nil
-	}
-
-	// If a specific plugin is requested, filter to just that one.
-	if len(args) == 1 {
-		name := args[0]
-		var found bool
-		for _, p := range plugins {
-			if p.Name == name {
-				plugins = []plugin.Plugin{p}
-				found = true
-				break
-			}
-		}
-		if !found {
-			return fmt.Errorf("plugin %q is not installed", name)
-		}
-	}
-
-	pluginDir := pluginHandler.EnsurePluginDir()
-	installer := plugin.NewInstaller()
-	for _, p := range plugins {
-		result := plugin.CheckUpdate(pluginDir, p.Name, catalogClient, runtime.GOOS, runtime.GOARCH)
-		if result.Err != nil {
-			logger.Failuref("error checking %s: %v", p.Name, result.Err)
-			continue
-		}
-		if result.Skipped {
-			if result.SkipReason == plugin.SkipReasonManual {
-				logger.Warningf("skipping %s (%s)", p.Name, result.SkipReason)
-			} else {
-				logger.Successf("%s already up to date (v%s)", p.Name, result.FromVersion)
-			}
-			continue
-		}
-
-		sp := newPluginSpinner(fmt.Sprintf("updating %s v%s → v%s", p.Name, result.FromVersion, result.ToVersion))
-		sp.Start()
-		if err := installer.Install(pluginDir, result.Manifest, result.Version, result.Platform); err != nil {
-			sp.Stop()
-			logger.Failuref("error updating %s: %v", p.Name, err)
-			continue
-		}
-		sp.Stop()
-		logger.Successf("updated %s v%s → v%s", p.Name, result.FromVersion, result.ToVersion)
-	}
-
-	return nil
-}
-
-func pluginSearchCmdRun(cmd *cobra.Command, args []string) error {
-	catalogClient := newCatalogClient()
-	catalog, err := catalogClient.FetchCatalog()
-	if err != nil {
-		return err
-	}
-
-	var query string
-	if len(args) == 1 {
-		query = strings.ToLower(args[0])
-	}
-
-	pluginDir := pluginHandler.PluginDir()
-	header := []string{"NAME", "DESCRIPTION", "INSTALLED"}
-	var rows [][]string
-	for _, entry := range catalog.Plugins {
-		if query != "" {
-			if !strings.Contains(strings.ToLower(entry.Name), query) &&
-				!strings.Contains(strings.ToLower(entry.Description), query) {
-				continue
-			}
-		}
-
-		installed := ""
-		if receipt := plugin.ReadReceipt(pluginDir, entry.Name); receipt != nil {
-			installed = receipt.Version
-		}
-
-		rows = append(rows, []string{entry.Name, entry.Description, installed})
-	}
-
-	if len(rows) == 0 {
-		if query != "" {
-			cmd.Printf("No plugins matching %q found in catalog\n", query)
-		} else {
-			cmd.Println("No plugins found in catalog")
-		}
-		return nil
-	}
-
-	return printers.TablePrinter(header).Print(cmd.OutOrStdout(), rows)
-}
-
-// parseNameVersion splits "operator@0.45.0" into ("operator", "0.45.0").
-// If no @ is present, version is empty (latest).
-func parseNameVersion(s string) (string, string) {
-	name, version, found := strings.Cut(s, "@")
-	if found {
-		return name, version
-	}
-	return s, ""
-}
-
-// newCatalogClient creates a CatalogClient that respects FLUXCD_PLUGIN_CATALOG.
-func newCatalogClient() *plugin.CatalogClient {
-	client := plugin.NewCatalogClient()
-	client.GetEnv = pluginHandler.GetEnv
-	return client
-}
-
-func newPluginSpinner(message string) *spinner.Spinner {
-	s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
-	s.Suffix = " " + message
-	return s
-}
--- a/cmd/flux/plugin_test.go
+++ b/cmd/flux/plugin_test.go
@@ -1,265 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/fluxcd/flux2/v2/internal/plugin"
-)
-
-func TestPluginAppearsInHelp(t *testing.T) {
-	origHandler := pluginHandler
-	defer func() { pluginHandler = origHandler }()
-
-	pluginDir := t.TempDir()
-
-	fakeBin := pluginDir + "/flux-testplugin"
-	os.WriteFile(fakeBin, []byte("#!/bin/sh\necho test"), 0o755)
-
-	pluginHandler = &plugin.Handler{
-		ReadDir: os.ReadDir,
-		Stat:    os.Stat,
-		GetEnv: func(key string) string {
-			if key == "FLUXCD_PLUGINS" {
-				return pluginDir
-			}
-			return ""
-		},
-		HomeDir: func() (string, error) { return t.TempDir(), nil },
-	}
-
-	registerPlugins()
-	defer func() {
-		cmds := rootCmd.Commands()
-		for _, cmd := range cmds {
-			if cmd.Name() == "testplugin" {
-				rootCmd.RemoveCommand(cmd)
-				break
-			}
-		}
-		rootCmd.SetHelpTemplate("")
-	}()
-
-	output, err := executeCommand("--help")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if !strings.Contains(output, "Plugin Commands:") {
-		t.Error("expected 'Plugin Commands:' in help output")
-	}
-	if !strings.Contains(output, "testplugin") {
-		t.Error("expected 'testplugin' in help output")
-	}
-}
-
-func TestPluginListOutput(t *testing.T) {
-	origHandler := pluginHandler
-	defer func() { pluginHandler = origHandler }()
-
-	pluginDir := t.TempDir()
-
-	fakeBin := pluginDir + "/flux-myplugin"
-	os.WriteFile(fakeBin, []byte("#!/bin/sh\necho test"), 0o755)
-
-	pluginHandler = &plugin.Handler{
-		ReadDir: os.ReadDir,
-		Stat:    os.Stat,
-		GetEnv: func(key string) string {
-			if key == "FLUXCD_PLUGINS" {
-				return pluginDir
-			}
-			return ""
-		},
-		HomeDir: func() (string, error) { return t.TempDir(), nil },
-	}
-
-	output, err := executeCommand("plugin list")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if !strings.Contains(output, "myplugin") {
-		t.Errorf("expected 'myplugin' in output, got: %s", output)
-	}
-	if !strings.Contains(output, "manual") {
-		t.Errorf("expected 'manual' in output (no receipt), got: %s", output)
-	}
-}
-
-func TestPluginListWithReceipt(t *testing.T) {
-	origHandler := pluginHandler
-	defer func() { pluginHandler = origHandler }()
-
-	pluginDir := t.TempDir()
-
-	fakeBin := pluginDir + "/flux-myplugin"
-	os.WriteFile(fakeBin, []byte("#!/bin/sh\necho test"), 0o755)
-	receipt := pluginDir + "/flux-myplugin.yaml"
-	os.WriteFile(receipt, []byte("name: myplugin\nversion: \"1.2.3\"\n"), 0o644)
-
-	pluginHandler = &plugin.Handler{
-		ReadDir: os.ReadDir,
-		Stat:    os.Stat,
-		GetEnv: func(key string) string {
-			if key == "FLUXCD_PLUGINS" {
-				return pluginDir
-			}
-			return ""
-		},
-		HomeDir: func() (string, error) { return t.TempDir(), nil },
-	}
-
-	output, err := executeCommand("plugin list")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if !strings.Contains(output, "1.2.3") {
-		t.Errorf("expected version '1.2.3' in output, got: %s", output)
-	}
-}
-
-func TestPluginListEmpty(t *testing.T) {
-	origHandler := pluginHandler
-	defer func() { pluginHandler = origHandler }()
-
-	pluginDir := t.TempDir()
-
-	pluginHandler = &plugin.Handler{
-		ReadDir: os.ReadDir,
-		Stat:    os.Stat,
-		GetEnv: func(key string) string {
-			if key == "FLUXCD_PLUGINS" {
-				return pluginDir
-			}
-			return ""
-		},
-		HomeDir: func() (string, error) { return t.TempDir(), nil },
-	}
-
-	output, err := executeCommand("plugin list")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if !strings.Contains(output, "No plugins found") {
-		t.Errorf("expected 'No plugins found', got: %s", output)
-	}
-}
-
-func TestNoPluginsNoRegistration(t *testing.T) {
-	origHandler := pluginHandler
-	defer func() { pluginHandler = origHandler }()
-
-	pluginHandler = &plugin.Handler{
-		ReadDir: func(name string) ([]os.DirEntry, error) {
-			return nil, fmt.Errorf("no dir")
-		},
-		Stat: os.Stat,
-		GetEnv: func(key string) string {
-			if key == "FLUXCD_PLUGINS" {
-				return "/nonexistent"
-			}
-			return ""
-		},
-		HomeDir: func() (string, error) { return t.TempDir(), nil },
-	}
-
-	// Verify that registerPlugins with no plugins doesn't add any commands.
-	before := len(rootCmd.Commands())
-	registerPlugins()
-	after := len(rootCmd.Commands())
-	if after != before {
-		t.Errorf("expected no new commands, got %d new", after-before)
-	}
-}
-
-func TestPluginSkipsPersistentPreRun(t *testing.T) {
-	// Plugin commands override root's PersistentPreRunE with a no-op,
-	// so an invalid namespace should not trigger a validation error.
-	_, err := executeCommand("plugin list")
-	if err != nil {
-		t.Fatalf("plugin list should not trigger root's namespace validation: %v", err)
-	}
-}
-
-func TestParseNameVersion(t *testing.T) {
-	tests := []struct {
-		input       string
-		wantName    string
-		wantVersion string
-	}{
-		{"operator", "operator", ""},
-		{"operator@0.45.0", "operator", "0.45.0"},
-		{"my-tool@1.0.0", "my-tool", "1.0.0"},
-		{"plugin@", "plugin", ""},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			name, version := parseNameVersion(tt.input)
-			if name != tt.wantName {
-				t.Errorf("name: got %q, want %q", name, tt.wantName)
-			}
-			if version != tt.wantVersion {
-				t.Errorf("version: got %q, want %q", version, tt.wantVersion)
-			}
-		})
-	}
-}
-
-func TestPluginDiscoverSkipsBuiltins(t *testing.T) {
-	origHandler := pluginHandler
-	defer func() { pluginHandler = origHandler }()
-
-	pluginDir := t.TempDir()
-
-	for _, name := range []string{"flux-get", "flux-create", "flux-version"} {
-		os.WriteFile(pluginDir+"/"+name, []byte("#!/bin/sh"), 0o755)
-	}
-	os.WriteFile(pluginDir+"/flux-myplugin", []byte("#!/bin/sh"), 0o755)
-
-	pluginHandler = &plugin.Handler{
-		ReadDir: os.ReadDir,
-		Stat:    os.Stat,
-		GetEnv: func(key string) string {
-			if key == "FLUXCD_PLUGINS" {
-				return pluginDir
-			}
-			return ""
-		},
-		HomeDir: func() (string, error) { return t.TempDir(), nil },
-	}
-
-	plugins := pluginHandler.Discover(builtinCommandNames())
-
-	if len(plugins) != 1 {
-		names := make([]string, len(plugins))
-		for i, p := range plugins {
-			names[i] = p.Name
-		}
-		t.Fatalf("expected 1 plugin, got %d: %v", len(plugins), names)
-	}
-	if plugins[0].Name != "myplugin" {
-		t.Errorf("expected 'myplugin', got %q", plugins[0].Name)
-	}
-}
--- a/cmd/flux/reconcile.go
+++ b/cmd/flux/reconcile.go
@@ -152,14 +152,7 @@ func reconciliationHandled(kubeClient client.Client, namespacedName types.Namesp
 			return false, err
 		}

-		switch result.Status {
-		case kstatus.CurrentStatus:
-			return true, nil
-		case kstatus.InProgressStatus:
-			return false, nil
-		default:
-			return false, fmt.Errorf("%s", result.Message)
-		}
+		return result.Status == kstatus.CurrentStatus, nil
 	}
 }

--- a/cmd/flux/resume.go
+++ b/cmd/flux/resume.go
@@ -126,17 +126,6 @@ func (resume resumeCommand) run(cmd *cobra.Command, args []string) error {

 	resume.printMessage(reconcileResps)

-	// Return an error if any reconciliation failed
-	var failedCount int
-	for _, r := range reconcileResps {
-		if r.resumable != nil && r.err != nil {
-			failedCount++
-		}
-	}
-	if failedCount > 0 {
-		return fmt.Errorf("reconciliation failed for %d %s(s)", failedCount, resume.kind)
-	}
-
 	return nil
 }

--- a/docs/release/release-notes-template.md
+++ b/docs/release/release-notes-template.md
@@ -26,8 +26,6 @@ The following template can be used for the GitHub release page:

 <!-- Text describing the most important changes in this release -->

-ℹ️ Please follow the [Upgrade Procedure for Flux v2.7+](https://github.com/fluxcd/flux2/discussions/5572) for a smooth upgrade from Flux v2.6 to the latest version.
-
 ### Fixes and improvements

 <!-- List of fixes and improvements to the controllers and CLI -->
@@ -38,7 +36,7 @@ The following template can be used for the GitHub release page:

 ## Components changelog

- <name>-controller [v<version>](https://github.com/fluxcd/<name>-controller/blob/<version>/CHANGELOG.md)
+- <name>-controller [v<version>](https://github.com/fluxcd/<name>-controller/blob/<version>/CHANGELOG.md

 ## CLI changelog

--- a/go.mod
+++ b/go.mod
@@ -8,32 +8,31 @@ replace gopkg.in/yaml.v3 => gopkg.in/yaml.v3 v3.0.1
 require (
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/ProtonMail/go-crypto v1.3.0
-	github.com/briandowns/spinner v1.23.2
 	github.com/cyphar/filepath-securejoin v0.6.1
 	github.com/distribution/distribution/v3 v3.0.0
 	github.com/fluxcd/cli-utils v0.37.2-flux.1
 	github.com/fluxcd/go-git-providers v0.26.0
-	github.com/fluxcd/helm-controller/api v1.5.3
-	github.com/fluxcd/image-automation-controller/api v1.1.1
-	github.com/fluxcd/image-reflector-controller/api v1.1.1
-	github.com/fluxcd/kustomize-controller/api v1.8.2
-	github.com/fluxcd/notification-controller/api v1.8.2
-	github.com/fluxcd/pkg/apis/event v0.25.0
-	github.com/fluxcd/pkg/apis/meta v1.26.0
-	github.com/fluxcd/pkg/auth v0.40.0
-	github.com/fluxcd/pkg/chartutil v1.23.0
+	github.com/fluxcd/helm-controller/api v1.5.1
+	github.com/fluxcd/image-automation-controller/api v1.1.0
+	github.com/fluxcd/image-reflector-controller/api v1.1.0
+	github.com/fluxcd/kustomize-controller/api v1.8.1
+	github.com/fluxcd/notification-controller/api v1.8.1
+	github.com/fluxcd/pkg/apis/event v0.24.0
+	github.com/fluxcd/pkg/apis/meta v1.25.0
+	github.com/fluxcd/pkg/auth v0.38.3
+	github.com/fluxcd/pkg/chartutil v1.22.0
 	github.com/fluxcd/pkg/envsubst v1.5.0
-	github.com/fluxcd/pkg/git v0.46.0
-	github.com/fluxcd/pkg/kustomize v1.28.0
-	github.com/fluxcd/pkg/oci v0.63.0
-	github.com/fluxcd/pkg/runtime v0.103.0
+	github.com/fluxcd/pkg/git v0.43.0
+	github.com/fluxcd/pkg/kustomize v1.27.0
+	github.com/fluxcd/pkg/oci v0.60.0
+	github.com/fluxcd/pkg/runtime v0.100.3
 	github.com/fluxcd/pkg/sourceignore v0.17.0
-	github.com/fluxcd/pkg/ssa v0.70.0
+	github.com/fluxcd/pkg/ssa v0.67.2
 	github.com/fluxcd/pkg/ssh v0.24.0
 	github.com/fluxcd/pkg/tar v0.17.0
-	github.com/fluxcd/pkg/version v0.14.0
-	github.com/fluxcd/source-controller/api v1.8.1
-	github.com/fluxcd/source-watcher/api/v2 v2.1.1
+	github.com/fluxcd/pkg/version v0.12.0
+	github.com/fluxcd/source-controller/api v1.8.0
+	github.com/fluxcd/source-watcher/api/v2 v2.1.0
 	github.com/go-git/go-git/v5 v5.16.5
 	github.com/go-logr/logr v1.4.3
 	github.com/gonvenience/bunt v1.4.2
@@ -41,7 +40,6 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-containerregistry v0.20.7
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/homeport/dyff v1.10.2
 	github.com/lucasb-eyer/go-colorful v1.2.0
 	github.com/manifoldco/promptui v0.9.0
@@ -51,16 +49,17 @@ require (
 	github.com/onsi/gomega v1.39.1
 	github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5
 	github.com/spf13/cobra v1.10.2
+	github.com/theckman/yacspin v0.13.12
 	golang.org/x/crypto v0.48.0
 	golang.org/x/term v0.40.0
 	golang.org/x/text v0.34.0
-	k8s.io/api v0.35.2
-	k8s.io/apiextensions-apiserver v0.35.2
-	k8s.io/apimachinery v0.35.2
-	k8s.io/cli-runtime v0.35.2
-	k8s.io/client-go v0.35.2
-	k8s.io/kubectl v0.35.2
-	sigs.k8s.io/controller-runtime v0.23.3
+	k8s.io/api v0.35.1
+	k8s.io/apiextensions-apiserver v0.35.1
+	k8s.io/apimachinery v0.35.1
+	k8s.io/cli-runtime v0.35.1
+	k8s.io/client-go v0.35.1
+	k8s.io/kubectl v0.35.1
+	sigs.k8s.io/controller-runtime v0.23.1
 	sigs.k8s.io/kustomize/api v0.21.1
 	sigs.k8s.io/kustomize/kyaml v0.21.1
 	sigs.k8s.io/yaml v1.6.0
@@ -108,7 +107,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
@@ -116,7 +115,7 @@ require (
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/cli v29.2.0+incompatible // indirect
+	github.com/docker/cli v29.1.5+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
@@ -129,7 +128,7 @@ require (
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
-	github.com/fluxcd/pkg/apis/kustomize v1.16.0 // indirect
+	github.com/fluxcd/pkg/apis/kustomize v1.15.0 // indirect
 	github.com/fluxcd/pkg/cache v0.13.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
@@ -159,10 +158,12 @@ require (
 	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/golang-lru/arc/v2 v2.0.5 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.5 // indirect
@@ -198,9 +199,9 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/otlptranslator v1.0.0 // indirect
-	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/otlptranslator v0.0.2 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
 	github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
 	github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 // indirect
 	github.com/redis/go-redis/v9 v9.7.3 // indirect
@@ -218,28 +219,28 @@ require (
 	github.com/xlab/treeprint v1.2.0 // indirect
 	gitlab.com/gitlab-org/api/client-go v1.29.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/bridges/prometheus v0.65.0 // indirect
-	go.opentelemetry.io/contrib/exporters/autoexport v0.65.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.62.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0 // indirect
-	go.opentelemetry.io/otel/log v0.16.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
-	go.opentelemetry.io/otel/sdk/log v0.16.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/trace v1.40.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
+	go.opentelemetry.io/contrib/bridges/prometheus v0.63.0 // indirect
+	go.opentelemetry.io/contrib/exporters/autoexport v0.63.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.14.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.14.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.60.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.14.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/log v0.14.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.14.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.8.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.50.0 // indirect
@@ -249,8 +250,8 @@ require (
 	golang.org/x/time v0.14.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/api v0.261.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260120174246-409b4a993575 // indirect
 	google.golang.org/grpc v1.78.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
@@ -258,8 +259,8 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	helm.sh/helm/v4 v4.1.3 // indirect
-	k8s.io/component-base v0.35.2 // indirect
+	helm.sh/helm/v4 v4.1.1 // indirect
+	k8s.io/component-base v0.35.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
--- a/go.sum
+++ b/go.sum
@@ -91,8 +91,6 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/briandowns/spinner v1.23.2 h1:Zc6ecUnI+YzLmJniCfDNaMbW0Wid1d5+qcTq4L2FW8w=
-github.com/briandowns/spinner v1.23.2/go.mod h1:LaZeM4wm2Ywy6vO571mvhQNRcWfRUnXOs0RcKV0wYKM=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
 github.com/bsm/ginkgo/v2 v2.7.0/go.mod h1:AiKlXPm7ItEHNc/2+OkrNG4E0ITzojb9/xWzvQ9XZ9w=
@@ -117,8 +115,8 @@ github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObk
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
 github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8=
 github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q=
 github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
@@ -144,8 +142,8 @@ github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN
 github.com/distribution/distribution/v3 v3.0.0/go.mod h1:tRNuFoZsUdyRVegq8xGNeds4KLjwLCRin/tTo6i1DhU=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM=
-github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.1.5+incompatible h1:GckbANUt3j+lsnQ6eCcQd70mNSOismSHWt8vk2AX8ao=
+github.com/docker/cli v29.1.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
@@ -176,56 +174,56 @@ github.com/fluxcd/gitkit v0.6.0 h1:iNg5LTx6ePo+Pl0ZwqHTAkhbUHxGVSY3YCxCdw7VIFg=
 github.com/fluxcd/gitkit v0.6.0/go.mod h1:svOHuKi0fO9HoawdK4HfHAJJseZDHHjk7I3ihnCIqNo=
 github.com/fluxcd/go-git-providers v0.26.0 h1:0DUsXc1nS9Fe4n8tXSEUCGemWzHShd66gmotayDPekw=
 github.com/fluxcd/go-git-providers v0.26.0/go.mod h1:VJDKUOhZwNAIqDF5iPtIpTr/annsDbKMkPpWiDMBdpo=
-github.com/fluxcd/helm-controller/api v1.5.3 h1:ruLzuyTHjjE9A5B/U+Id2q7yHXXqSFTswdZ14xCS5So=
-github.com/fluxcd/helm-controller/api v1.5.3/go.mod h1:lTgeUmtVYExMKp7mRDncsr4JwHTz3LFtLjRJZeR98lI=
-github.com/fluxcd/image-automation-controller/api v1.1.1 h1:uiu7kjdVoW8/461HOemX6I7RcPornEzQliWgTg6LnWI=
-github.com/fluxcd/image-automation-controller/api v1.1.1/go.mod h1:lkD/drkD6Wc+2SDjVj5KqfozEucTLFexWgby/5ft660=
-github.com/fluxcd/image-reflector-controller/api v1.1.1 h1:4Bj1abzVnjj8+b/293kNeFMRJc+y2wO8Z12ReZ/gA0w=
-github.com/fluxcd/image-reflector-controller/api v1.1.1/go.mod h1:j4JSIocL42HQ77Veg1t60sApOy+lng8/cbXHXGSnfi0=
-github.com/fluxcd/kustomize-controller/api v1.8.2 h1:LcFUjJccwNrhCo7pQBBneLAlHfZZcb58bWB2LnyFwag=
-github.com/fluxcd/kustomize-controller/api v1.8.2/go.mod h1:c/mUPIffDDLg1EicXCJtX4N/rc+z5Zh0e/CXjhd7Dyc=
-github.com/fluxcd/notification-controller/api v1.8.2 h1:TDrXohUC5Gh3BF+v2ux9/zEG1Ax8u49WDW+3Y6GiIEc=
-github.com/fluxcd/notification-controller/api v1.8.2/go.mod h1:ozgJGQPy0dG5eOsLZlwAr6n0q/y6+TWd1fGOtavlXJA=
+github.com/fluxcd/helm-controller/api v1.5.1 h1:yraWl0ImzO4yIy/N5d9i54N+OZxKuFZqjed8wrIjy8U=
+github.com/fluxcd/helm-controller/api v1.5.1/go.mod h1:Yr0y7GKizbvQQGK5wBX6sGCZrTY86AN9n1PNEsji2XE=
+github.com/fluxcd/image-automation-controller/api v1.1.0 h1:CLPNHQskX0falo4s1suG1ztUe9IGaY9q5ntcz5Fxt9A=
+github.com/fluxcd/image-automation-controller/api v1.1.0/go.mod h1:dIpTDlWgUfjvdGZCNfe8Ht9sCiHwRbJDoIbwfLQ56wc=
+github.com/fluxcd/image-reflector-controller/api v1.1.0 h1:7TtE9DrCnlH1Wn3R3UKXJHNhX/FgS0ejdjFKHzl+XHs=
+github.com/fluxcd/image-reflector-controller/api v1.1.0/go.mod h1:hLGsqTv3RydJXaApmN+ZtIOHNxlUdmuOJl323x6dsPE=
+github.com/fluxcd/kustomize-controller/api v1.8.1 h1:Pe5+sV1i1EwfK5TA4ogYX6YJ6ADJaETmG58WYieRkG4=
+github.com/fluxcd/kustomize-controller/api v1.8.1/go.mod h1:+ZJB/dIGbnSzZ5J/kiJ8n0USmLNAjfeZU6Xfra0oMZA=
+github.com/fluxcd/notification-controller/api v1.8.1 h1:tBg5QrXsVAdMEsV/oq3gqApdRDwcO9gyc6plDf/3QGI=
+github.com/fluxcd/notification-controller/api v1.8.1/go.mod h1:tGlTJS+hSLbgQm1L78hl6N3iWbTerifh1V5Qm8we4Zo=
 github.com/fluxcd/pkg/apis/acl v0.9.0 h1:wBpgsKT+jcyZEcM//OmZr9RiF8klL3ebrDp2u2ThsnA=
 github.com/fluxcd/pkg/apis/acl v0.9.0/go.mod h1:TttNS+gocsGLwnvmgVi3/Yscwqrjc17+vhgYfqkfrV4=
-github.com/fluxcd/pkg/apis/event v0.25.0 h1:zdwytvDhG+fk+Ywl5DOtv7TklkrVgM21WHm1f+YhleE=
-github.com/fluxcd/pkg/apis/event v0.25.0/go.mod h1:TlK8HWYrTwl0raqBRC+ROoNpYW5fdVnwcwOBOx5Kzw8=
-github.com/fluxcd/pkg/apis/kustomize v1.16.0 h1:PhWXEhqQqsisIpwp1/wHvTvo+MO+GGzsBPoN0ZnRE3Y=
-github.com/fluxcd/pkg/apis/kustomize v1.16.0/go.mod h1:IZOy4CCtR/hxMGb7erK1RfbGnczVv4/dRBoVD37AywI=
-github.com/fluxcd/pkg/apis/meta v1.26.0 h1:dxP1FfBpTCYso6odzRcltVnnRuBb2VyhhgV0VX9YbUE=
-github.com/fluxcd/pkg/apis/meta v1.26.0/go.mod h1:c7o6mJGLCMvNrfdinGZehkrdZuFT9vZdZNrn66DtVD0=
-github.com/fluxcd/pkg/auth v0.40.0 h1:p6Kw6KH+z8oRqngKhmTt8ILKD/rC+8tP87a//kLZhi8=
-github.com/fluxcd/pkg/auth v0.40.0/go.mod h1:Oq/hIEKUMTbL2bv5blf+EhC/jXXJLsOjIMtJj/AtG3Y=
+github.com/fluxcd/pkg/apis/event v0.24.0 h1:WVPf0FrJ5JExRDDGoo4W0jZgHZt0n4E48/e8b3TSmkA=
+github.com/fluxcd/pkg/apis/event v0.24.0/go.mod h1:Hoi4DejaNKVahGkRXqGBjT9h1aKmhc7RCYcsgoTieqc=
+github.com/fluxcd/pkg/apis/kustomize v1.15.0 h1:p8wPIxdmn0vy0a664rsE9JKCfnliZz4HUsDcTy4ZOxA=
+github.com/fluxcd/pkg/apis/kustomize v1.15.0/go.mod h1:XWdsx8P15OiMaQIvmUjYWdmD3zAwhl5q9osl5iCqcOk=
+github.com/fluxcd/pkg/apis/meta v1.25.0 h1:fmZgMoe7yITGfhFqdOs7w2GOu3Y/2Vvz4+4p/eay3eA=
+github.com/fluxcd/pkg/apis/meta v1.25.0/go.mod h1:1D92RqAet0/n/cH5S0khBXweirHWkw9rCO0V4NCY6xc=
+github.com/fluxcd/pkg/auth v0.38.3 h1:fTVuIFcVi/g3js1ZAh5Oum3UfhAdX5LiheJM9uv8hew=
+github.com/fluxcd/pkg/auth v0.38.3/go.mod h1:038UyC92mnW1mzZ/A2fHJQUpuhPkJzw39ppChuOdYfI=
 github.com/fluxcd/pkg/cache v0.13.0 h1:MqtlgOwIVcGKKgV422e39O+KFSVMWuExKeRaMDBjJlk=
 github.com/fluxcd/pkg/cache v0.13.0/go.mod h1:0xRZ1hitrIFQ6pl68ke2wZLbIqA2VLzY78HpDo9DVxs=
-github.com/fluxcd/pkg/chartutil v1.23.0 h1:ohstQEVnrBIbN85FGu83hnmAohLl0PdOoPlsM6+cjyI=
-github.com/fluxcd/pkg/chartutil v1.23.0/go.mod h1:kFhmD6DwBgRsvC1ilINsomargMi2WbqvSndWQLikkLc=
+github.com/fluxcd/pkg/chartutil v1.22.0 h1:yxhDsAKK0w5Ol4hr1SVnQZI1c83FR9PghVucNEGq4VM=
+github.com/fluxcd/pkg/chartutil v1.22.0/go.mod h1:aw7h410gKTJfk7KchFzv3tZoh6KlwzZFoameLrIEcNg=
 github.com/fluxcd/pkg/envsubst v1.5.0 h1:S07mo+MkGhptdHA4pRze5HPKlc8tHxKswNdcMZi1WDY=
 github.com/fluxcd/pkg/envsubst v1.5.0/go.mod h1:c3a8DYI855sZUubHFYQbjfjop6Wu4/zg1cLyf7SnCes=
-github.com/fluxcd/pkg/git v0.46.0 h1:QMh0+ZzQ2jO6rIGj4ffR5trZ8g/cxvt8cVajReJ8Iyw=
-github.com/fluxcd/pkg/git v0.46.0/go.mod h1:iHcIjx9c8zye3PQiajTJYxgOMRiy7WCs+hfLKDswpfI=
-github.com/fluxcd/pkg/gittestserver v0.26.0 h1:+RZrCzFRsE+d5WaqAoqaPCEgcgv/jZp6+f7DS0+Ynb8=
-github.com/fluxcd/pkg/gittestserver v0.26.0/go.mod h1:7fybYb0yej1fFNiF1ohs0Jr0XzyaZQ/cRh3AFEoCtuc=
-github.com/fluxcd/pkg/kustomize v1.28.0 h1:0RuFVczJRabbt8frHZ/ql8aqte6BOOKk274O09l6/hE=
-github.com/fluxcd/pkg/kustomize v1.28.0/go.mod h1:cW08mnngSP8MJYb6mDmMvxH8YjNATdiML0udb37dk+M=
-github.com/fluxcd/pkg/oci v0.63.0 h1:ZPKTT2C+gWYjhP63xC76iTPdYE9w3ABcsDq77uhAgwo=
-github.com/fluxcd/pkg/oci v0.63.0/go.mod h1:qMPz4njvm6hJzdyGSb8ydSqrapXxTQwJonxHIsdeXSQ=
-github.com/fluxcd/pkg/runtime v0.103.0 h1:J5y5GPhWdkyqIUBlaI1FP2N02TtZmsjbWhhZubuTSFk=
-github.com/fluxcd/pkg/runtime v0.103.0/go.mod h1:mbo2f3azo3yVQgm7XZGxQB6/2zvzQ5Wgtd8TjRRwwAw=
+github.com/fluxcd/pkg/git v0.43.0 h1:11LKsTHw+yx3rcGSrSbkURcdc4huUv3FxQZhHIAMofc=
+github.com/fluxcd/pkg/git v0.43.0/go.mod h1:cr9eoYLZHKP3NWgJhhJ8pBcllTpl2SbXVoifW37IyIQ=
+github.com/fluxcd/pkg/gittestserver v0.25.0 h1:thnS0OOuU2mEA0PjByxrSxrvlvSwVxJSZY1me782Vq4=
+github.com/fluxcd/pkg/gittestserver v0.25.0/go.mod h1:cQqa3cOdKdrIDUqV8SCYbIoNw4/a8frJRGofBLv7sWw=
+github.com/fluxcd/pkg/kustomize v1.27.0 h1:bWoWVaHV1ZRo3Ei1JXpY58hJK25WWna+az5jj6zseE0=
+github.com/fluxcd/pkg/kustomize v1.27.0/go.mod h1:KKb26vz5EApyOrgencDlvixJnuI6cnkWGks95sK9AFs=
+github.com/fluxcd/pkg/oci v0.60.0 h1:uyAoYoj0i9rxFYQchThwfe4i/X0eb5l9wJuDbSAbqGs=
+github.com/fluxcd/pkg/oci v0.60.0/go.mod h1:5NT4IaYZocOsXLV3IGgj4FRQtSae46DL8Lq3EcDUqME=
+github.com/fluxcd/pkg/runtime v0.100.3 h1:iwbmB8lgJ5zM+lfieiOOJn2JgzRbUvYW4EhnVyQXBRw=
+github.com/fluxcd/pkg/runtime v0.100.3/go.mod h1:eAM9vzJueVHhEWexMf29zQt9Xb7J4kWMPMu+0cfy5/c=
 github.com/fluxcd/pkg/sourceignore v0.17.0 h1:Z72nruRMhC15zIEpWoDrAcJcJ1El6QDnP/aRDfE4WOA=
 github.com/fluxcd/pkg/sourceignore v0.17.0/go.mod h1:3e/VmYLId0pI/H5sK7W9Ibif+j0Ahns9RxNjDMtTTfY=
-github.com/fluxcd/pkg/ssa v0.70.0 h1:IBylYPiTK1IEdCC2DvjKXIhwQcbd5VufXA9WS3zO+tE=
-github.com/fluxcd/pkg/ssa v0.70.0/go.mod h1:6igtlt7/zF+nNFQpa5ZAkkvtpL6o36NRU39/PqqC+Bg=
+github.com/fluxcd/pkg/ssa v0.67.2 h1:HK98iISxb7fESahdDHQ2W7G2F+J11Td/Yqs1+AZqBuc=
+github.com/fluxcd/pkg/ssa v0.67.2/go.mod h1:InP0vIQcEhqxvUktoNNvrRq0NmdGKOFZcs59PEFlRqM=
 github.com/fluxcd/pkg/ssh v0.24.0 h1:hrPlxs0hhXf32DRqs68VbsXs0XfQMphyRVIk0rYYJa4=
 github.com/fluxcd/pkg/ssh v0.24.0/go.mod h1:xWammEqalrpurpcMiixJRXtynRQtBEoqheyU5F/vWrg=
 github.com/fluxcd/pkg/tar v0.17.0 h1:uNxbFXy8ly8C7fJ8D7w3rjTNJFrb4Hp1aY/30XkfvxY=
 github.com/fluxcd/pkg/tar v0.17.0/go.mod h1:b1xyIRYDD0ket4SV5u0UXYv+ZdN/O/HmIO5jZQdHQls=
-github.com/fluxcd/pkg/version v0.14.0 h1:T3llSc8sUnsuFrW5ng2ePSfXwGXUKv0YG9QXf0ErhWw=
-github.com/fluxcd/pkg/version v0.14.0/go.mod h1:YHdg/78kzf+kCqS+SqSOiUxum5AjxlixiqwpX6AUZB8=
-github.com/fluxcd/source-controller/api v1.8.1 h1:49HiJF5mNEdZTwueQMRahTVts35B+xhN5CsuOAL9gQ0=
-github.com/fluxcd/source-controller/api v1.8.1/go.mod h1:HgZ6NSH1cyOE2jRoNwln1xEwr9ETvrLeiy1o4O04vQM=
-github.com/fluxcd/source-watcher/api/v2 v2.1.1 h1:1LfT50ty+78MKKbschAZl28QbVqIyjaNq17KmW5wPJI=
-github.com/fluxcd/source-watcher/api/v2 v2.1.1/go.mod h1:6M1BzBGQRoIuSenSQlfJHwMVVobFPiNPxXqfN0IILc4=
+github.com/fluxcd/pkg/version v0.12.0 h1:MGbdbNf2D5wazMqAkNPn+Lh5j+oY0gxQJFTGyet5Hfc=
+github.com/fluxcd/pkg/version v0.12.0/go.mod h1:YHdg/78kzf+kCqS+SqSOiUxum5AjxlixiqwpX6AUZB8=
+github.com/fluxcd/source-controller/api v1.8.0 h1:ndrYmcv6ZMcdQHFSUkOrFVDO7h16SfDBSw/DOqf/LPo=
+github.com/fluxcd/source-controller/api v1.8.0/go.mod h1:1O7+sMbqc1+3tPvjmtgFz+bASTl794Y9SxpebHDDSGA=
+github.com/fluxcd/source-watcher/api/v2 v2.1.0 h1:pXKC3VNacjGT6hDyBqP/2kaNlrzNANUn7si5BuW40QE=
+github.com/fluxcd/source-watcher/api/v2 v2.1.0/go.mod h1:s5ahWDfD0KmpFAbQf3DHCLnWMRkfqt3l5VoCk08LFts=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
@@ -327,10 +325,12 @@ github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc h1:GN2Lv3MGO7AS6PrRoT6yV5+wkrOpcszoIsO4+4ds248=
+github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc/go.mod h1:+JKpmjMGhpgPL+rXZ5nsZieVzvarn86asRlBg4uNGnk=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -484,15 +484,15 @@ github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNw
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
-github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
-github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
+github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
+github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/otlptranslator v0.0.2 h1:+1CdeLVrRQ6Psmhnobldo0kTp96Rj80DRXRd5OSnMEQ=
+github.com/prometheus/otlptranslator v0.0.2/go.mod h1:P8AwMgdD7XEr6QRUJ2QWLpiAZTgTE2UYgjlu3svompI=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
-github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho=
 github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U=
 github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=
@@ -537,6 +537,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U=
 github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8=
+github.com/theckman/yacspin v0.13.12 h1:CdZ57+n0U6JMuh2xqjnjRq5Haj6v1ner2djtLQRzJr4=
+github.com/theckman/yacspin v0.13.12/go.mod h1:Rd2+oG2LmQi5f3zC3yeZAOl245z8QOvrH4OPOJNZxLg=
 github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
 github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
 github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74 h1:JwtAtbp7r/7QSyGz8mKUbYJBg2+6Cd7OjM8o/GNOcVo=
@@ -552,52 +554,52 @@ gitlab.com/gitlab-org/api/client-go v1.29.0 h1:3KnF6vENry/9v9eVrnLi2OfBV0m/WSrwh
 gitlab.com/gitlab-org/api/client-go v1.29.0/go.mod h1:6i3EZtC6gKiTTmDwp+f6r/Yi9OY4AaYubl5B3yXEdHE=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/bridges/prometheus v0.65.0 h1:I/7S/yWobR3QHFLqHsJ8QOndoiFsj1VgHpQiq43KlUI=
-go.opentelemetry.io/contrib/bridges/prometheus v0.65.0/go.mod h1:jPF6gn3y1E+nozCAEQj3c6NZ8KY+tvAgSVfvoOJUFac=
-go.opentelemetry.io/contrib/exporters/autoexport v0.65.0 h1:2gApdml7SznX9szEKFjKjM4qGcGSvAybYLBY319XG3g=
-go.opentelemetry.io/contrib/exporters/autoexport v0.65.0/go.mod h1:0QqAGlbHXhmPYACG3n5hNzO5DnEqqtg4VcK5pr22RI0=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
-go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0 h1:ZVg+kCXxd9LtAaQNKBxAvJ5NpMf7LpvEr4MIZqb0TMQ=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.16.0/go.mod h1:hh0tMeZ75CCXrHd9OXRYxTlCAdxcXioWHFIpYw2rZu8=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0 h1:djrxvDxAe44mJUrKataUbOhCKhR3F8QCyWucO16hTQs=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.16.0/go.mod h1:dt3nxpQEiSoKvfTVxp3TUg5fHPLhKtbcnN3Z1I1ePD0=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0 h1:NOyNnS19BF2SUDApbOKbDtWZ0IK7b8FJ2uAGdIWOGb0=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.40.0/go.mod h1:VL6EgVikRLcJa9ftukrHu/ZkkhFBSo1lzvdBC9CF1ss=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0 h1:9y5sHvAxWzft1WQ4BwqcvA+IFVUJ1Ya75mSAUnFEVwE=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.40.0/go.mod h1:eQqT90eR3X5Dbs1g9YSM30RavwLF725Ris5/XSXWvqE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 h1:QKdN8ly8zEMrByybbQgv8cWBcdAarwmIPZ6FThrWXJs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0/go.mod h1:bTdK1nhqF76qiPoCCdyFIV+N/sRHYXYCTQc+3VCi3MI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 h1:DvJDOPmSWQHWywQS6lKL+pb8s3gBLOZUtw4N+mavW1I=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0/go.mod h1:EtekO9DEJb4/jRyN4v4Qjc2yA7AtfCBuz2FynRUWTXs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0 h1:wVZXIWjQSeSmMoxF74LzAnpVQOAFDo3pPji9Y4SOFKc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.40.0/go.mod h1:khvBS2IggMFNwZK/6lEeHg/W57h/IX6J4URh57fuI40=
-go.opentelemetry.io/otel/exporters/prometheus v0.62.0 h1:krvC4JMfIOVdEuNPTtQ0ZjCiXrybhv+uOHMfHRmnvVo=
-go.opentelemetry.io/otel/exporters/prometheus v0.62.0/go.mod h1:fgOE6FM/swEnsVQCqCnbOfRV4tOnWPg7bVeo4izBuhQ=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0 h1:ivlbaajBWJqhcCPniDqDJmRwj4lc6sRT+dCAVKNmxlQ=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.16.0/go.mod h1:u/G56dEKDDwXNCVLsbSrllB2o8pbtFLUC4HpR66r2dc=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 h1:ZrPRak/kS4xI3AVXy8F7pipuDXmDsrO8Lg+yQjBLjw0=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0/go.mod h1:3y6kQCWztq6hyW8Z9YxQDDm0Je9AJoFar2G0yDcmhRk=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0 h1:MzfofMZN8ulNqobCmCAVbqVL5syHw+eB2qPRkCMA/fQ=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.40.0/go.mod h1:E73G9UFtKRXrxhBsHtG00TB5WxX57lpsQzogDkqBTz8=
-go.opentelemetry.io/otel/log v0.16.0 h1:DeuBPqCi6pQwtCK0pO4fvMB5eBq6sNxEnuTs88pjsN4=
-go.opentelemetry.io/otel/log v0.16.0/go.mod h1:rWsmqNVTLIA8UnwYVOItjyEZDbKIkMxdQunsIhpUMes=
-go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
-go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
-go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
-go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
-go.opentelemetry.io/otel/sdk/log v0.16.0 h1:e/b4bdlQwC5fnGtG3dlXUrNOnP7c8YLVSpSfEBIkTnI=
-go.opentelemetry.io/otel/sdk/log v0.16.0/go.mod h1:JKfP3T6ycy7QEuv3Hj8oKDy7KItrEkus8XJE6EoSzw4=
-go.opentelemetry.io/otel/sdk/log/logtest v0.16.0 h1:/XVkpZ41rVRTP4DfMgYv1nEtNmf65XPPyAdqV90TMy4=
-go.opentelemetry.io/otel/sdk/log/logtest v0.16.0/go.mod h1:iOOPgQr5MY9oac/F5W86mXdeyWZGleIx3uXO98X2R6Y=
-go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
-go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
-go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
-go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
-go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
-go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+go.opentelemetry.io/contrib/bridges/prometheus v0.63.0 h1:/Rij/t18Y7rUayNg7Id6rPrEnHgorxYabm2E6wUdPP4=
+go.opentelemetry.io/contrib/bridges/prometheus v0.63.0/go.mod h1:AdyDPn6pkbkt2w01n3BubRVk7xAsCRq1Yg1mpfyA/0E=
+go.opentelemetry.io/contrib/exporters/autoexport v0.63.0 h1:NLnZybb9KkfMXPwZhd5diBYJoVxiO9Qa06dacEA7ySY=
+go.opentelemetry.io/contrib/exporters/autoexport v0.63.0/go.mod h1:OvRg7gm5WRSCtxzGSsrFHbDLToYlStHNZQ+iPNIyD6g=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.14.0 h1:OMqPldHt79PqWKOMYIAQs3CxAi7RLgPxwfFSwr4ZxtM=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.14.0/go.mod h1:1biG4qiqTxKiUCtoWDPpL3fB3KxVwCiGw81j3nKMuHE=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.14.0 h1:QQqYw3lkrzwVsoEX0w//EhH/TCnpRdEenKBOOEIMjWc=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.14.0/go.mod h1:gSVQcr17jk2ig4jqJ2DX30IdWH251JcNAecvrqTxH1s=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 h1:vl9obrcoWVKp/lwl8tRE33853I8Xru9HFbw/skNeLs8=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0/go.mod h1:GAXRxmLJcVM3u22IjTg74zWBrRCKq8BnOqUVLodpcpw=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0 h1:Oe2z/BCg5q7k4iXC3cqJxKYg0ieRiOqF0cecFYdPTwk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.38.0/go.mod h1:ZQM5lAJpOsKnYagGg/zV2krVqTtaVdYdDkhMoX6Oalg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 h1:aTL7F04bJHUlztTsNGJ2l+6he8c+y/b//eR0jjjemT4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0/go.mod h1:kldtb7jDTeol0l3ewcmd8SDvx3EmIE7lyvqbasU3QC4=
+go.opentelemetry.io/otel/exporters/prometheus v0.60.0 h1:cGtQxGvZbnrWdC2GyjZi0PDKVSLWP/Jocix3QWfXtbo=
+go.opentelemetry.io/otel/exporters/prometheus v0.60.0/go.mod h1:hkd1EekxNo69PTV4OWFGZcKQiIqg0RfuWExcPKFvepk=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.14.0 h1:B/g+qde6Mkzxbry5ZZag0l7QrQBCtVm7lVjaLgmpje8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.14.0/go.mod h1:mOJK8eMmgW6ocDJn6Bn11CcZ05gi3P8GylBXEkZtbgA=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 h1:wm/Q0GAAykXv83wzcKzGGqAnnfLFyFe7RslekZuv+VI=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0/go.mod h1:ra3Pa40+oKjvYh+ZD3EdxFZZB0xdMfuileHAm4nNN7w=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0 h1:kJxSDN4SgWWTjG/hPp3O7LCGLcHXFlvS2/FFOrwL+SE=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0/go.mod h1:mgIOzS7iZeKJdeB8/NYHrJ48fdGc71Llo5bJ1J4DWUE=
+go.opentelemetry.io/otel/log v0.14.0 h1:2rzJ+pOAZ8qmZ3DDHg73NEKzSZkhkGIua9gXtxNGgrM=
+go.opentelemetry.io/otel/log v0.14.0/go.mod h1:5jRG92fEAgx0SU/vFPxmJvhIuDU9E1SUnEQrMlJpOno=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/log v0.14.0 h1:JU/U3O7N6fsAXj0+CXz21Czg532dW2V4gG1HE/e8Zrg=
+go.opentelemetry.io/otel/sdk/log v0.14.0/go.mod h1:imQvII+0ZylXfKU7/wtOND8Hn4OpT3YUoIgqJVksUkM=
+go.opentelemetry.io/otel/sdk/log/logtest v0.14.0 h1:Ijbtz+JKXl8T2MngiwqBlPaHqc4YCaP/i13Qrow6gAM=
+go.opentelemetry.io/otel/sdk/log/logtest v0.14.0/go.mod h1:dCU8aEL6q+L9cYTqcVOk8rM9Tp8WdnHOPLiBgp0SGOA=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/proto/otlp v1.8.0 h1:fRAZQDcAFHySxpJ1TwlA1cJ4tvcrw7nXl9xWWC8N5CE=
+go.opentelemetry.io/proto/otlp v1.8.0/go.mod h1:tIeYOeNBU4cvmPqpaji1P+KbB4Oloai8wN4rWzRrFF0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -727,10 +729,10 @@ google.golang.org/api v0.261.0 h1:3DoJ2GGibaCxNi1lhdScNMx9fTW87ujKHDgyHMMYdoA=
 google.golang.org/api v0.261.0/go.mod h1:nVH0ZK5C4tO0RdsMscleeTLY7I8m/Nt9IXxcXD2tfts=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260120174246-409b4a993575 h1:vzOYHDZEHIsPYYnaSYo60AqHkJronSu0rzTz/s4quL0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260120174246-409b4a993575/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
 google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
 google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
@@ -756,30 +758,30 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-helm.sh/helm/v4 v4.1.3 h1:Abfmb+oJUtxoaXDyB2Jhw1zRk3hT6aFfHta+AXb8Lno=
-helm.sh/helm/v4 v4.1.3/go.mod h1:5dSo8rRgn3OTkDAc/k0Ipw5/Q+BlqKIKZwa0XwSiINI=
-k8s.io/api v0.35.2 h1:tW7mWc2RpxW7HS4CoRXhtYHSzme1PN1UjGHJ1bdrtdw=
-k8s.io/api v0.35.2/go.mod h1:7AJfqGoAZcwSFhOjcGM7WV05QxMMgUaChNfLTXDRE60=
-k8s.io/apiextensions-apiserver v0.35.2 h1:iyStXHoJZsUXPh/nFAsjC29rjJWdSgUmG1XpApE29c0=
-k8s.io/apiextensions-apiserver v0.35.2/go.mod h1:OdyGvcO1FtMDWQ+rRh/Ei3b6X3g2+ZDHd0MSRGeS8rU=
-k8s.io/apimachinery v0.35.2 h1:NqsM/mmZA7sHW02JZ9RTtk3wInRgbVxL8MPfzSANAK8=
-k8s.io/apimachinery v0.35.2/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
-k8s.io/cli-runtime v0.35.2 h1:3DNctzpPNXavqyrm/FFiT60TLk4UjUxuUMYbKOE970E=
-k8s.io/cli-runtime v0.35.2/go.mod h1:G2Ieu0JidLm5m1z9b0OkFhnykvJ1w+vjbz1tR5OFKL0=
-k8s.io/client-go v0.35.2 h1:YUfPefdGJA4aljDdayAXkc98DnPkIetMl4PrKX97W9o=
-k8s.io/client-go v0.35.2/go.mod h1:4QqEwh4oQpeK8AaefZ0jwTFJw/9kIjdQi0jpKeYvz7g=
-k8s.io/component-base v0.35.2 h1:btgR+qNrpWuRSuvWSnQYsZy88yf5gVwemvz0yw79pGc=
-k8s.io/component-base v0.35.2/go.mod h1:B1iBJjooe6xIJYUucAxb26RwhAjzx0gHnqO9htWIX+0=
+helm.sh/helm/v4 v4.1.1 h1:juO/Vack3pNUBCX0emMvHL1RL27CEWwGyCd3HyP3mPA=
+helm.sh/helm/v4 v4.1.1/go.mod h1:yH4qpYvTNBTHnkRSenhi1m7oEFKoN6iK3/rYyFJ00IQ=
+k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q=
+k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM=
+k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w=
+k8s.io/apiextensions-apiserver v0.35.1/go.mod h1:2CN4fe1GZ3HMe4wBr25qXyJnJyZaquy4nNlNmb3R7AQ=
+k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU=
+k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/cli-runtime v0.35.1 h1:uKcXFe8J7AMAM4Gm2JDK4mp198dBEq2nyeYtO+JfGJE=
+k8s.io/cli-runtime v0.35.1/go.mod h1:55/hiXIq1C8qIJ3WBrWxEwDLdHQYhBNRdZOz9f7yvTw=
+k8s.io/client-go v0.35.1 h1:+eSfZHwuo/I19PaSxqumjqZ9l5XiTEKbIaJ+j1wLcLM=
+k8s.io/client-go v0.35.1/go.mod h1:1p1KxDt3a0ruRfc/pG4qT/3oHmUj1AhSHEcxNSGg+OA=
+k8s.io/component-base v0.35.1 h1:XgvpRf4srp037QWfGBLFsYMUQJkE5yMa94UsJU7pmcE=
+k8s.io/component-base v0.35.1/go.mod h1:HI/6jXlwkiOL5zL9bqA3en1Ygv60F03oEpnuU1G56Bs=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/kubectl v0.35.2 h1:aSmqhSOfsoG9NR5oR8OD5eMKpLN9x8oncxfqLHbJJII=
-k8s.io/kubectl v0.35.2/go.mod h1:+OJC779UsDJGxNPbHxCwvb4e4w9Eh62v/DNYU2TlsyM=
+k8s.io/kubectl v0.35.1 h1:zP3Er8C5i1dcAFUMh9Eva0kVvZHptXIn/+8NtRWMxwg=
+k8s.io/kubectl v0.35.1/go.mod h1:cQ2uAPs5IO/kx8R5s5J3Ihv3VCYwrx0obCXum0CvnXo=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
-sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
+sigs.k8s.io/controller-runtime v0.23.1 h1:TjJSM80Nf43Mg21+RCy3J70aj/W6KyvDtOlpKf+PupE=
+sigs.k8s.io/controller-runtime v0.23.1/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
--- a/internal/build/build.go
+++ b/internal/build/build.go
@@ -30,7 +30,7 @@ import (
 	"sync"
 	"time"

-	"github.com/briandowns/spinner"
+	"github.com/theckman/yacspin"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -81,7 +81,7 @@ type Builder struct {
 	action        kustomize.Action
 	kustomization *kustomizev1.Kustomization
 	timeout       time.Duration
-	spinner       *spinner.Spinner
+	spinner       *yacspin.Spinner
 	dryRun        bool
 	strictSubst   bool
 	recursive     bool
@@ -111,9 +111,22 @@ func WithTimeout(timeout time.Duration) BuilderOptionFunc {

 func WithProgressBar() BuilderOptionFunc {
 	return func(b *Builder) error {
-		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
-		s.Suffix = " Kustomization diffing... " + spinnerDryRunMessage
-		b.spinner = s
+		// Add a spinner
+		cfg := yacspin.Config{
+			Frequency:       100 * time.Millisecond,
+			CharSet:         yacspin.CharSets[59],
+			Suffix:          "Kustomization diffing...",
+			SuffixAutoColon: true,
+			Message:         spinnerDryRunMessage,
+			StopCharacter:   "✓",
+			StopColors:      []string{"fgGreen"},
+		}
+		spinner, err := yacspin.New(cfg)
+		if err != nil {
+			return fmt.Errorf("failed to create spinner: %w", err)
+		}
+		b.spinner = spinner
+
 		return nil
 	}
 }
@@ -202,7 +215,7 @@ func withClientConfigFrom(in *Builder) BuilderOptionFunc {
 	}
 }

-// withSpinnerFrom copies the spinner field from another Builder.
+// withClientConfigFrom copies spinner field
 func withSpinnerFrom(in *Builder) BuilderOptionFunc {
 	return func(b *Builder) error {
 		b.spinner = in.spinner
@@ -733,7 +746,12 @@ func (b *Builder) StartSpinner() error {
 	if b.spinner == nil {
 		return nil
 	}
-	b.spinner.Start()
+
+	err := b.spinner.Start()
+	if err != nil {
+		return fmt.Errorf("failed to start spinner: %w", err)
+	}
+
 	return nil
 }

@@ -741,6 +759,14 @@ func (b *Builder) StopSpinner() error {
 	if b.spinner == nil {
 		return nil
 	}
-	b.spinner.Stop()
+
+	status := b.spinner.Status()
+	if status == yacspin.SpinnerRunning || status == yacspin.SpinnerPaused {
+		err := b.spinner.Stop()
+		if err != nil {
+			return fmt.Errorf("failed to stop spinner: %w", err)
+		}
+	}
+
 	return nil
 }
--- a/internal/build/diff.go
+++ b/internal/build/diff.go
@@ -173,14 +173,14 @@ func (b *Builder) diff() (string, bool, error) {

 				// finished with Kustomization diff
 				if b.spinner != nil {
-					b.spinner.Suffix = " " + spinnerDryRunMessage
+					b.spinner.Message(spinnerDryRunMessage)
 				}
 			}
 		}
 	}

 	if b.spinner != nil {
-		b.spinner.Suffix = " processing inventory"
+		b.spinner.Message("processing inventory")
 	}

 	if b.kustomization.Spec.Prune && len(diffErrs) == 0 {
@@ -204,7 +204,7 @@ func (b *Builder) diff() (string, bool, error) {

 func (b *Builder) kustomizationDiff(kustomization *kustomizev1.Kustomization) (string, bool, error) {
 	if b.spinner != nil {
-		b.spinner.Suffix = " " + fmt.Sprintf("%s in %s", spinnerDryRunMessage, kustomization.Name)
+		b.spinner.Message(fmt.Sprintf("%s in %s", spinnerDryRunMessage, kustomization.Name))
 	}

 	sourceRef := kustomization.Spec.SourceRef.DeepCopy()
--- a/internal/plugin/catalog.go
+++ b/internal/plugin/catalog.go
@@ -1,213 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"time"
-
-	"github.com/hashicorp/go-retryablehttp"
-	"sigs.k8s.io/yaml"
-)
-
-const (
-	defaultCatalogBase = "https://raw.githubusercontent.com/fluxcd/plugins/main/"
-	envCatalogBase     = "FLUXCD_PLUGIN_CATALOG"
-
-	pluginAPIVersion = "cli.fluxcd.io/v1beta1"
-	pluginKind       = "Plugin"
-	catalogKind      = "PluginCatalog"
-)
-
-// PluginManifest represents a single plugin's manifest from the catalog.
-type PluginManifest struct {
-	APIVersion  string          `json:"apiVersion"`
-	Kind        string          `json:"kind"`
-	Name        string          `json:"name"`
-	Description string          `json:"description"`
-	Homepage    string          `json:"homepage,omitempty"`
-	Source      string          `json:"source,omitempty"`
-	Bin         string          `json:"bin"`
-	Versions    []PluginVersion `json:"versions"`
-}
-
-// PluginVersion represents a version entry in a plugin manifest.
-type PluginVersion struct {
-	Version   string           `json:"version"`
-	Platforms []PluginPlatform `json:"platforms"`
-}
-
-// PluginPlatform represents a platform-specific binary entry.
-type PluginPlatform struct {
-	OS       string `json:"os"`
-	Arch     string `json:"arch"`
-	URL      string `json:"url"`
-	Checksum string `json:"checksum"`
-}
-
-// PluginCatalog represents the generated catalog.yaml file.
-type PluginCatalog struct {
-	APIVersion string         `json:"apiVersion"`
-	Kind       string         `json:"kind"`
-	Plugins    []CatalogEntry `json:"plugins"`
-}
-
-// CatalogEntry is a single entry in the plugin catalog.
-type CatalogEntry struct {
-	Name        string `json:"name"`
-	Description string `json:"description"`
-	Homepage    string `json:"homepage,omitempty"`
-	Source      string `json:"source,omitempty"`
-	License     string `json:"license,omitempty"`
-}
-
-// Receipt records what was installed for a plugin.
-type Receipt struct {
-	Name        string         `json:"name"`
-	Version     string         `json:"version"`
-	InstalledAt string         `json:"installedAt"`
-	Platform    PluginPlatform `json:"platform"`
-}
-
-// CatalogClient fetches plugin manifests and catalogs from a remote URL.
-type CatalogClient struct {
-	BaseURL    string
-	HTTPClient *http.Client
-	GetEnv     func(key string) string
-}
-
-// NewCatalogClient returns a CatalogClient with production defaults.
-func NewCatalogClient() *CatalogClient {
-	return &CatalogClient{
-		BaseURL:    defaultCatalogBase,
-		HTTPClient: newHTTPClient(30 * time.Second),
-		GetEnv:     func(key string) string { return "" },
-	}
-}
-
-// baseURL returns the effective catalog base URL.
-func (c *CatalogClient) baseURL() string {
-	if env := c.GetEnv(envCatalogBase); env != "" {
-		return env
-	}
-	return c.BaseURL
-}
-
-// FetchManifest fetches a single plugin manifest from the catalog.
-func (c *CatalogClient) FetchManifest(name string) (*PluginManifest, error) {
-	url := c.baseURL() + "plugins/" + name + ".yaml"
-	body, err := c.fetch(url)
-	if err != nil {
-		return nil, fmt.Errorf("plugin %q not found in catalog", name)
-	}
-
-	var manifest PluginManifest
-	if err := yaml.Unmarshal(body, &manifest); err != nil {
-		return nil, fmt.Errorf("failed to parse plugin manifest for %q: %w", name, err)
-	}
-
-	if manifest.APIVersion != pluginAPIVersion {
-		return nil, fmt.Errorf("plugin %q has unsupported apiVersion %q (expected %q)", name, manifest.APIVersion, pluginAPIVersion)
-	}
-	if manifest.Kind != pluginKind {
-		return nil, fmt.Errorf("plugin %q has unexpected kind %q (expected %q)", name, manifest.Kind, pluginKind)
-	}
-
-	return &manifest, nil
-}
-
-// FetchCatalog fetches the generated catalog.yaml.
-func (c *CatalogClient) FetchCatalog() (*PluginCatalog, error) {
-	url := c.baseURL() + "catalog.yaml"
-	body, err := c.fetch(url)
-	if err != nil {
-		return nil, fmt.Errorf("failed to fetch plugin catalog: %w", err)
-	}
-
-	var catalog PluginCatalog
-	if err := yaml.Unmarshal(body, &catalog); err != nil {
-		return nil, fmt.Errorf("failed to parse plugin catalog: %w", err)
-	}
-
-	if catalog.APIVersion != pluginAPIVersion {
-		return nil, fmt.Errorf("plugin catalog has unsupported apiVersion %q (expected %q)", catalog.APIVersion, pluginAPIVersion)
-	}
-	if catalog.Kind != catalogKind {
-		return nil, fmt.Errorf("plugin catalog has unexpected kind %q (expected %q)", catalog.Kind, catalogKind)
-	}
-
-	return &catalog, nil
-}
-
-const maxResponseBytes = 10 << 20 // 10 MiB
-
-func (c *CatalogClient) fetch(url string) ([]byte, error) {
-	resp, err := c.HTTPClient.Get(url)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("HTTP %d from %s", resp.StatusCode, url)
-	}
-
-	return io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes))
-}
-
-// newHTTPClient returns a retrying HTTP client with the given timeout.
-func newHTTPClient(timeout time.Duration) *http.Client {
-	rc := retryablehttp.NewClient()
-	rc.RetryMax = 3
-	rc.Logger = nil
-	c := rc.StandardClient()
-	c.Timeout = timeout
-	return c
-}
-
-// ResolveVersion finds the requested version in the manifest.
-// If version is empty, returns the first (latest) version.
-func ResolveVersion(manifest *PluginManifest, version string) (*PluginVersion, error) {
-	if len(manifest.Versions) == 0 {
-		return nil, fmt.Errorf("plugin %q has no versions", manifest.Name)
-	}
-
-	if version == "" {
-		return &manifest.Versions[0], nil
-	}
-
-	for i := range manifest.Versions {
-		if manifest.Versions[i].Version == version {
-			return &manifest.Versions[i], nil
-		}
-	}
-
-	return nil, fmt.Errorf("version %q not found for plugin %q", version, manifest.Name)
-}
-
-// ResolvePlatform finds the platform entry matching the given OS and arch.
-func ResolvePlatform(pv *PluginVersion, goos, goarch string) (*PluginPlatform, error) {
-	for i := range pv.Platforms {
-		if pv.Platforms[i].OS == goos && pv.Platforms[i].Arch == goarch {
-			return &pv.Platforms[i], nil
-		}
-	}
-
-	return nil, fmt.Errorf("no binary for %s/%s", goos, goarch)
-}
--- a/internal/plugin/catalog_test.go
+++ b/internal/plugin/catalog_test.go
@@ -1,239 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestFetchManifest(t *testing.T) {
-	manifest := `
-apiVersion: cli.fluxcd.io/v1beta1
-kind: Plugin
-name: operator
-description: Flux Operator CLI
-bin: flux-operator
-versions:
-  - version: 0.45.0
-    platforms:
-      - os: linux
-        arch: amd64
-        url: https://example.com/flux-operator_0.45.0_linux_amd64.tar.gz
-        checksum: sha256:abc123
-`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/plugins/operator.yaml" {
-			w.Write([]byte(manifest))
-			return
-		}
-		http.NotFound(w, r)
-	}))
-	defer server.Close()
-
-	client := &CatalogClient{
-		BaseURL:    server.URL + "/",
-		HTTPClient: server.Client(),
-		GetEnv:     func(key string) string { return "" },
-	}
-
-	m, err := client.FetchManifest("operator")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if m.Name != "operator" {
-		t.Errorf("expected name 'operator', got %q", m.Name)
-	}
-	if m.Bin != "flux-operator" {
-		t.Errorf("expected bin 'flux-operator', got %q", m.Bin)
-	}
-	if len(m.Versions) != 1 {
-		t.Fatalf("expected 1 version, got %d", len(m.Versions))
-	}
-	if m.Versions[0].Version != "0.45.0" {
-		t.Errorf("expected version '0.45.0', got %q", m.Versions[0].Version)
-	}
-}
-
-func TestFetchManifestNotFound(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.NotFound(w, r)
-	}))
-	defer server.Close()
-
-	client := &CatalogClient{
-		BaseURL:    server.URL + "/",
-		HTTPClient: server.Client(),
-		GetEnv:     func(key string) string { return "" },
-	}
-
-	_, err := client.FetchManifest("nonexistent")
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-}
-
-func TestFetchCatalog(t *testing.T) {
-	catalog := `
-apiVersion: cli.fluxcd.io/v1beta1
-kind: PluginCatalog
-plugins:
-  - name: operator
-    description: Flux Operator CLI
-    homepage: https://fluxoperator.dev/
-    source: https://github.com/controlplaneio-fluxcd/flux-operator
-    license: AGPL-3.0
-  - name: schema
-    description: CRD schemas
-    homepage: https://example.com/
-    source: https://github.com/example/flux-schema
-    license: Apache-2.0
-`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/catalog.yaml" {
-			w.Write([]byte(catalog))
-			return
-		}
-		http.NotFound(w, r)
-	}))
-	defer server.Close()
-
-	client := &CatalogClient{
-		BaseURL:    server.URL + "/",
-		HTTPClient: server.Client(),
-		GetEnv:     func(key string) string { return "" },
-	}
-
-	c, err := client.FetchCatalog()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(c.Plugins) != 2 {
-		t.Fatalf("expected 2 plugins, got %d", len(c.Plugins))
-	}
-	if c.Plugins[0].Name != "operator" {
-		t.Errorf("expected name 'operator', got %q", c.Plugins[0].Name)
-	}
-	if c.Plugins[1].Name != "schema" {
-		t.Errorf("expected name 'schema', got %q", c.Plugins[1].Name)
-	}
-}
-
-func TestCatalogEnvOverride(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/custom/catalog.yaml" {
-			w.Write([]byte(`apiVersion: cli.fluxcd.io/v1beta1
-kind: PluginCatalog
-plugins: []
-`))
-			return
-		}
-		http.NotFound(w, r)
-	}))
-	defer server.Close()
-
-	client := &CatalogClient{
-		BaseURL:    "https://should-not-be-used/",
-		HTTPClient: server.Client(),
-		GetEnv: func(key string) string {
-			if key == envCatalogBase {
-				return server.URL + "/custom/"
-			}
-			return ""
-		},
-	}
-
-	c, err := client.FetchCatalog()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(c.Plugins) != 0 {
-		t.Fatalf("expected 0 plugins, got %d", len(c.Plugins))
-	}
-}
-
-func TestResolveVersion(t *testing.T) {
-	manifest := &PluginManifest{
-		Name: "operator",
-		Versions: []PluginVersion{
-			{Version: "0.45.0"},
-			{Version: "0.44.0"},
-		},
-	}
-
-	t.Run("latest", func(t *testing.T) {
-		v, err := ResolveVersion(manifest, "")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if v.Version != "0.45.0" {
-			t.Errorf("expected '0.45.0', got %q", v.Version)
-		}
-	})
-
-	t.Run("specific", func(t *testing.T) {
-		v, err := ResolveVersion(manifest, "0.44.0")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if v.Version != "0.44.0" {
-			t.Errorf("expected '0.44.0', got %q", v.Version)
-		}
-	})
-
-	t.Run("not found", func(t *testing.T) {
-		_, err := ResolveVersion(manifest, "0.99.0")
-		if err == nil {
-			t.Fatal("expected error, got nil")
-		}
-	})
-
-	t.Run("no versions", func(t *testing.T) {
-		_, err := ResolveVersion(&PluginManifest{Name: "empty"}, "")
-		if err == nil {
-			t.Fatal("expected error, got nil")
-		}
-	})
-}
-
-func TestResolvePlatform(t *testing.T) {
-	pv := &PluginVersion{
-		Version: "0.45.0",
-		Platforms: []PluginPlatform{
-			{OS: "darwin", Arch: "arm64", URL: "https://example.com/darwin_arm64.tar.gz"},
-			{OS: "linux", Arch: "amd64", URL: "https://example.com/linux_amd64.tar.gz"},
-		},
-	}
-
-	t.Run("found", func(t *testing.T) {
-		p, err := ResolvePlatform(pv, "darwin", "arm64")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if p.OS != "darwin" || p.Arch != "arm64" {
-			t.Errorf("unexpected platform: %s/%s", p.OS, p.Arch)
-		}
-	})
-
-	t.Run("not found", func(t *testing.T) {
-		_, err := ResolvePlatform(pv, "windows", "amd64")
-		if err == nil {
-			t.Fatal("expected error, got nil")
-		}
-	})
-}
--- a/internal/plugin/completion.go
+++ b/internal/plugin/completion.go
@@ -1,75 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"os/exec"
-	"strconv"
-	"strings"
-
-	"github.com/spf13/cobra"
-)
-
-// commandFunc is an alias to allow DI in tests.
-var commandFunc = exec.Command
-
-// CompleteFunc returns a ValidArgsFunction that delegates completion
-// to the plugin binary via Cobra's __complete protocol.
-func CompleteFunc(pluginPath string) func(*cobra.Command, []string, string) ([]string, cobra.ShellCompDirective) {
-	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		completeArgs := append([]string{"__complete"}, args...)
-		completeArgs = append(completeArgs, toComplete)
-
-		out, err := commandFunc(pluginPath, completeArgs...).Output()
-		if err != nil {
-			return nil, cobra.ShellCompDirectiveError
-		}
-
-		return parseCompletionOutput(string(out))
-	}
-}
-
-// parseCompletionOutput parses Cobra's __complete output format.
-// Each line is a completion, last line is :<directive_int>.
-func parseCompletionOutput(out string) ([]string, cobra.ShellCompDirective) {
-	out = strings.TrimRight(out, "\n")
-	if out == "" {
-		return nil, cobra.ShellCompDirectiveError
-	}
-	lines := strings.Split(out, "\n")
-
-	// Last line is the directive in format ":N"
-	lastLine := lines[len(lines)-1]
-	completions := lines[:len(lines)-1]
-
-	directive := cobra.ShellCompDirectiveDefault
-	if strings.HasPrefix(lastLine, ":") {
-		if val, err := strconv.Atoi(lastLine[1:]); err == nil {
-			directive = cobra.ShellCompDirective(val)
-		}
-	}
-
-	var results []string
-	for _, c := range completions {
-		if c == "" {
-			continue
-		}
-		results = append(results, c)
-	}
-
-	return results, directive
-}
--- a/internal/plugin/completion_test.go
+++ b/internal/plugin/completion_test.go
@@ -1,80 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"testing"
-
-	"github.com/spf13/cobra"
-)
-
-func TestParseCompletionOutput(t *testing.T) {
-	tests := []struct {
-		name                string
-		input               string
-		expectedCompletions []string
-		expectedDirective   cobra.ShellCompDirective
-	}{
-		{
-			name:                "standard output",
-			input:               "instance\nrset\nrsip\nall\n:4\n",
-			expectedCompletions: []string{"instance", "rset", "rsip", "all"},
-			expectedDirective:   cobra.ShellCompDirective(4),
-		},
-		{
-			name:                "default directive",
-			input:               "foo\nbar\n:0\n",
-			expectedCompletions: []string{"foo", "bar"},
-			expectedDirective:   cobra.ShellCompDirectiveDefault,
-		},
-		{
-			name:                "with descriptions",
-			input:               "get\tGet resources\nbuild\tBuild resources\n:4\n",
-			expectedCompletions: []string{"get\tGet resources", "build\tBuild resources"},
-			expectedDirective:   cobra.ShellCompDirective(4),
-		},
-		{
-			name:                "empty completions",
-			input:               ":4\n",
-			expectedCompletions: nil,
-			expectedDirective:   cobra.ShellCompDirective(4),
-		},
-		{
-			name:                "empty input",
-			input:               "",
-			expectedCompletions: nil,
-			expectedDirective:   cobra.ShellCompDirectiveError,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			completions, directive := parseCompletionOutput(tt.input)
-			if directive != tt.expectedDirective {
-				t.Errorf("directive: got %d, want %d", directive, tt.expectedDirective)
-			}
-			if len(completions) != len(tt.expectedCompletions) {
-				t.Fatalf("completions count: got %d, want %d", len(completions), len(tt.expectedCompletions))
-			}
-			for i, c := range completions {
-				if c != tt.expectedCompletions[i] {
-					t.Errorf("completion[%d]: got %q, want %q", i, c, tt.expectedCompletions[i])
-				}
-			}
-		})
-	}
-}
--- a/internal/plugin/discovery.go
+++ b/internal/plugin/discovery.go
@@ -1,195 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-)
-
-const (
-	pluginPrefix   = "flux-"
-	defaultDirName = "plugins"
-	defaultBaseDir = ".fluxcd"
-	envPluginDir   = "FLUXCD_PLUGINS"
-)
-
-// reservedNames are command names that cannot be used as plugin names.
-var reservedNames = map[string]bool{
-	"plugin": true,
-	"help":   true,
-}
-
-// Plugin represents a discovered plugin binary.
-type Plugin struct {
-	Name string // e.g., "operator" (derived from "flux-operator")
-	Path string // absolute path to binary
-}
-
-// Handler discovers and executes plugins. Uses dependency injection
-// for testability.
-type Handler struct {
-	ReadDir func(name string) ([]os.DirEntry, error)
-	Stat    func(name string) (os.FileInfo, error)
-	GetEnv  func(key string) string
-	HomeDir func() (string, error)
-}
-
-// NewHandler returns a Handler with production defaults.
-func NewHandler() *Handler {
-	return &Handler{
-		ReadDir: os.ReadDir,
-		Stat:    os.Stat,
-		GetEnv:  os.Getenv,
-		HomeDir: os.UserHomeDir,
-	}
-}
-
-// Discover scans the plugin directory for executables matching flux-*.
-// It skips builtins, reserved names, directories, non-executable files,
-// and broken symlinks.
-func (h *Handler) Discover(builtinNames []string) []Plugin {
-	dir := h.PluginDir()
-	if dir == "" {
-		return nil
-	}
-
-	entries, err := h.ReadDir(dir)
-	if err != nil {
-		return nil
-	}
-
-	builtins := make(map[string]bool, len(builtinNames))
-	for _, name := range builtinNames {
-		builtins[name] = true
-	}
-
-	var plugins []Plugin
-	for _, entry := range entries {
-		name := entry.Name()
-		if !strings.HasPrefix(name, pluginPrefix) {
-			continue
-		}
-		if entry.IsDir() {
-			continue
-		}
-
-		pluginName := pluginNameFromBinary(name)
-		if pluginName == "" {
-			continue
-		}
-		if reservedNames[pluginName] || builtins[pluginName] {
-			continue
-		}
-
-		fullPath := filepath.Join(dir, name)
-
-		// Use Stat to follow symlinks and check the target.
-		info, err := h.Stat(fullPath)
-		if err != nil {
-			// Broken symlink, permission denied, etc.
-			continue
-		}
-		if !info.Mode().IsRegular() {
-			continue
-		}
-		if !isExecutable(info) {
-			continue
-		}
-
-		plugins = append(plugins, Plugin{
-			Name: pluginName,
-			Path: fullPath,
-		})
-	}
-
-	return plugins
-}
-
-// PluginDir returns the plugin directory path. If FLUXCD_PLUGINS is set,
-// returns that path. Otherwise returns ~/.fluxcd/plugins/.
-// Does not create the directory — callers that write (install, update)
-// should call EnsurePluginDir first.
-func (h *Handler) PluginDir() string {
-	if dir := h.GetEnv(envPluginDir); dir != "" {
-		return dir
-	}
-
-	home, err := h.HomeDir()
-	if err != nil {
-		return ""
-	}
-
-	return filepath.Join(home, defaultBaseDir, defaultDirName)
-}
-
-// EnsurePluginDir creates the plugin directory if it doesn't exist
-// and returns the path. Best-effort — ignores mkdir errors for
-// read-only filesystems. User-managed directories (via $FLUXCD_PLUGINS)
-// are not auto-created.
-func (h *Handler) EnsurePluginDir() string {
-	if envDir := h.GetEnv(envPluginDir); envDir != "" {
-		return envDir
-	}
-
-	home, err := h.HomeDir()
-	if err != nil {
-		return ""
-	}
-
-	dir := filepath.Join(home, defaultBaseDir, defaultDirName)
-	_ = os.MkdirAll(dir, 0o755)
-	return dir
-}
-
-// pluginNameFromBinary extracts the plugin name from a binary filename.
-// "flux-operator" → "operator", "flux-my-tool" → "my-tool".
-// Returns empty string for invalid names.
-func pluginNameFromBinary(filename string) string {
-	if !strings.HasPrefix(filename, pluginPrefix) {
-		return ""
-	}
-
-	name := strings.TrimPrefix(filename, pluginPrefix)
-
-	// On Windows, strip known extensions.
-	if runtime.GOOS == "windows" {
-		for _, ext := range []string{".exe", ".cmd", ".bat"} {
-			if strings.HasSuffix(strings.ToLower(name), ext) {
-				name = name[:len(name)-len(ext)]
-				break
-			}
-		}
-	}
-
-	if name == "" {
-		return ""
-	}
-
-	return name
-}
-
-// isExecutable checks if a file has the executable bit set.
-// On Windows, this always returns true (executability is determined by extension).
-func isExecutable(info os.FileInfo) bool {
-	if runtime.GOOS == "windows" {
-		return true
-	}
-	return info.Mode().Perm()&0o111 != 0
-}
--- a/internal/plugin/discovery_test.go
+++ b/internal/plugin/discovery_test.go
@@ -1,302 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"fmt"
-	"io/fs"
-	"os"
-	"testing"
-	"time"
-)
-
-// mockDirEntry implements os.DirEntry for testing.
-type mockDirEntry struct {
-	name  string
-	isDir bool
-	mode  fs.FileMode
-}
-
-func (m *mockDirEntry) Name() string               { return m.name }
-func (m *mockDirEntry) IsDir() bool                { return m.isDir }
-func (m *mockDirEntry) Type() fs.FileMode          { return m.mode }
-func (m *mockDirEntry) Info() (fs.FileInfo, error) { return nil, nil }
-
-// mockFileInfo implements os.FileInfo for testing.
-type mockFileInfo struct {
-	name    string
-	mode    fs.FileMode
-	isDir   bool
-	regular bool
-}
-
-func (m *mockFileInfo) Name() string       { return m.name }
-func (m *mockFileInfo) Size() int64        { return 0 }
-func (m *mockFileInfo) Mode() fs.FileMode  { return m.mode }
-func (m *mockFileInfo) ModTime() time.Time { return time.Time{} }
-func (m *mockFileInfo) IsDir() bool        { return m.isDir }
-func (m *mockFileInfo) Sys() any           { return nil }
-
-func newTestHandler(entries []os.DirEntry, statResults map[string]*mockFileInfo, envVars map[string]string) *Handler {
-	return &Handler{
-		ReadDir: func(name string) ([]os.DirEntry, error) {
-			if entries == nil {
-				return nil, fmt.Errorf("directory not found")
-			}
-			return entries, nil
-		},
-		Stat: func(name string) (os.FileInfo, error) {
-			if info, ok := statResults[name]; ok {
-				return info, nil
-			}
-			return nil, fmt.Errorf("file not found: %s", name)
-		},
-		GetEnv: func(key string) string {
-			return envVars[key]
-		},
-		HomeDir: func() (string, error) {
-			return "/home/testuser", nil
-		},
-	}
-}
-
-func TestDiscover(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "flux-operator", mode: 0},
-		&mockDirEntry{name: "flux-local", mode: 0},
-	}
-	stats := map[string]*mockFileInfo{
-		"/test/plugins/flux-operator": {name: "flux-operator", mode: 0o755},
-		"/test/plugins/flux-local":    {name: "flux-local", mode: 0o755},
-	}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 2 {
-		t.Fatalf("expected 2 plugins, got %d", len(plugins))
-	}
-	if plugins[0].Name != "operator" {
-		t.Errorf("expected name 'operator', got %q", plugins[0].Name)
-	}
-	if plugins[1].Name != "local" {
-		t.Errorf("expected name 'local', got %q", plugins[1].Name)
-	}
-}
-
-func TestDiscoverSkipsBuiltins(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "flux-version", mode: 0},
-		&mockDirEntry{name: "flux-get", mode: 0},
-		&mockDirEntry{name: "flux-operator", mode: 0},
-	}
-	stats := map[string]*mockFileInfo{
-		"/test/plugins/flux-version":  {name: "flux-version", mode: 0o755},
-		"/test/plugins/flux-get":      {name: "flux-get", mode: 0o755},
-		"/test/plugins/flux-operator": {name: "flux-operator", mode: 0o755},
-	}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover([]string{"version", "get"})
-	if len(plugins) != 1 {
-		t.Fatalf("expected 1 plugin, got %d", len(plugins))
-	}
-	if plugins[0].Name != "operator" {
-		t.Errorf("expected name 'operator', got %q", plugins[0].Name)
-	}
-}
-
-func TestDiscoverSkipsReserved(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "flux-plugin", mode: 0},
-		&mockDirEntry{name: "flux-help", mode: 0},
-		&mockDirEntry{name: "flux-operator", mode: 0},
-	}
-	stats := map[string]*mockFileInfo{
-		"/test/plugins/flux-plugin":   {name: "flux-plugin", mode: 0o755},
-		"/test/plugins/flux-help":     {name: "flux-help", mode: 0o755},
-		"/test/plugins/flux-operator": {name: "flux-operator", mode: 0o755},
-	}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 1 {
-		t.Fatalf("expected 1 plugin, got %d", len(plugins))
-	}
-	if plugins[0].Name != "operator" {
-		t.Errorf("expected name 'operator', got %q", plugins[0].Name)
-	}
-}
-
-func TestDiscoverSkipsNonExecutable(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "flux-noperm", mode: 0},
-	}
-	stats := map[string]*mockFileInfo{
-		"/test/plugins/flux-noperm": {name: "flux-noperm", mode: 0o644},
-	}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 0 {
-		t.Fatalf("expected 0 plugins, got %d", len(plugins))
-	}
-}
-
-func TestDiscoverSkipsDirectories(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "flux-somedir", isDir: true, mode: fs.ModeDir},
-	}
-	stats := map[string]*mockFileInfo{}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 0 {
-		t.Fatalf("expected 0 plugins, got %d", len(plugins))
-	}
-}
-
-func TestDiscoverFollowsSymlinks(t *testing.T) {
-	entries := []os.DirEntry{
-		// Symlink entry — Type() returns symlink, but Stat resolves to regular executable.
-		&mockDirEntry{name: "flux-linked", mode: fs.ModeSymlink},
-	}
-	stats := map[string]*mockFileInfo{
-		"/test/plugins/flux-linked": {name: "flux-linked", mode: 0o755},
-	}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 1 {
-		t.Fatalf("expected 1 plugin, got %d", len(plugins))
-	}
-	if plugins[0].Name != "linked" {
-		t.Errorf("expected name 'linked', got %q", plugins[0].Name)
-	}
-}
-
-func TestDiscoverDirNotExist(t *testing.T) {
-	h := newTestHandler(nil, nil, map[string]string{envPluginDir: "/nonexistent"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 0 {
-		t.Fatalf("expected 0 plugins, got %d", len(plugins))
-	}
-}
-
-func TestDiscoverCustomDir(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "flux-custom", mode: 0},
-	}
-	stats := map[string]*mockFileInfo{
-		"/custom/path/flux-custom": {name: "flux-custom", mode: 0o755},
-	}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/custom/path"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 1 {
-		t.Fatalf("expected 1 plugin, got %d", len(plugins))
-	}
-	if plugins[0].Path != "/custom/path/flux-custom" {
-		t.Errorf("expected path '/custom/path/flux-custom', got %q", plugins[0].Path)
-	}
-}
-
-func TestDiscoverSkipsNonFluxPrefix(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "kubectl-foo", mode: 0},
-		&mockDirEntry{name: "random-binary", mode: 0},
-		&mockDirEntry{name: "flux-operator", mode: 0},
-	}
-	stats := map[string]*mockFileInfo{
-		"/test/plugins/flux-operator": {name: "flux-operator", mode: 0o755},
-	}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 1 {
-		t.Fatalf("expected 1 plugin, got %d", len(plugins))
-	}
-}
-
-func TestDiscoverBrokenSymlink(t *testing.T) {
-	entries := []os.DirEntry{
-		&mockDirEntry{name: "flux-broken", mode: fs.ModeSymlink},
-	}
-	// No stat entry for flux-broken — simulates a broken symlink.
-	stats := map[string]*mockFileInfo{}
-	h := newTestHandler(entries, stats, map[string]string{envPluginDir: "/test/plugins"})
-
-	plugins := h.Discover(nil)
-	if len(plugins) != 0 {
-		t.Fatalf("expected 0 plugins, got %d", len(plugins))
-	}
-}
-
-func TestPluginNameFromBinary(t *testing.T) {
-	tests := []struct {
-		input    string
-		expected string
-	}{
-		{"flux-operator", "operator"},
-		{"flux-my-tool", "my-tool"},
-		{"flux-", ""},
-		{"notflux-thing", ""},
-		{"flux-a", "a"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			got := pluginNameFromBinary(tt.input)
-			if got != tt.expected {
-				t.Errorf("pluginNameFromBinary(%q) = %q, want %q", tt.input, got, tt.expected)
-			}
-		})
-	}
-}
-
-func TestPluginDir(t *testing.T) {
-	t.Run("uses env var", func(t *testing.T) {
-		h := &Handler{
-			GetEnv: func(key string) string {
-				if key == envPluginDir {
-					return "/custom/plugins"
-				}
-				return ""
-			},
-			HomeDir: func() (string, error) {
-				return "/home/user", nil
-			},
-		}
-		dir := h.PluginDir()
-		if dir != "/custom/plugins" {
-			t.Errorf("expected '/custom/plugins', got %q", dir)
-		}
-	})
-
-	t.Run("uses default", func(t *testing.T) {
-		h := &Handler{
-			GetEnv: func(key string) string { return "" },
-			HomeDir: func() (string, error) {
-				return "/home/user", nil
-			},
-		}
-		dir := h.PluginDir()
-		if dir != "/home/user/.fluxcd/plugins" {
-			t.Errorf("expected '/home/user/.fluxcd/plugins', got %q", dir)
-		}
-	})
-}
--- a/internal/plugin/exec_unix.go
+++ b/internal/plugin/exec_unix.go
@@ -1,30 +0,0 @@
-//go:build !windows
-
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"os"
-	"syscall"
-)
-
-// Exec replaces the current process with the plugin binary.
-// This is what kubectl does — no signal forwarding or exit code propagation needed.
-func Exec(path string, args []string) error {
-	return syscall.Exec(path, append([]string{path}, args...), os.Environ())
-}
--- a/internal/plugin/exec_windows.go
+++ b/internal/plugin/exec_windows.go
@@ -1,42 +0,0 @@
-//go:build windows
-
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"os"
-	"os/exec"
-)
-
-// Exec runs the plugin as a child process with full I/O passthrough.
-// Matches kubectl's Windows fallback pattern.
-func Exec(path string, args []string) error {
-	cmd := exec.Command(path, args...)
-	cmd.Stdin = os.Stdin
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	cmd.Env = os.Environ()
-	err := cmd.Run()
-	if err == nil {
-		os.Exit(0)
-	}
-	if exitErr, ok := err.(*exec.ExitError); ok {
-		os.Exit(exitErr.ExitCode())
-	}
-	return err
-}
--- a/internal/plugin/install.go
+++ b/internal/plugin/install.go
@@ -1,235 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"archive/tar"
-	"archive/zip"
-	"compress/gzip"
-	"crypto/sha256"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"time"
-
-	"sigs.k8s.io/yaml"
-)
-
-// Installer handles downloading, verifying, and installing plugins.
-type Installer struct {
-	HTTPClient *http.Client
-}
-
-// NewInstaller returns an Installer with production defaults.
-func NewInstaller() *Installer {
-	return &Installer{
-		HTTPClient: newHTTPClient(5 * time.Minute),
-	}
-}
-
-// Install downloads, verifies, extracts, and installs a plugin binary
-// to the given plugin directory.
-func (inst *Installer) Install(pluginDir string, manifest *PluginManifest, pv *PluginVersion, plat *PluginPlatform) error {
-	tmpFile, err := os.CreateTemp("", "flux-plugin-*")
-	if err != nil {
-		return fmt.Errorf("failed to create temp file: %w", err)
-	}
-	defer os.Remove(tmpFile.Name())
-	defer tmpFile.Close()
-
-	resp, err := inst.HTTPClient.Get(plat.URL)
-	if err != nil {
-		return fmt.Errorf("failed to download plugin: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("failed to download plugin: HTTP %d", resp.StatusCode)
-	}
-
-	hasher := sha256.New()
-	writer := io.MultiWriter(tmpFile, hasher)
-	if _, err := io.Copy(writer, resp.Body); err != nil {
-		return fmt.Errorf("failed to download plugin: %w", err)
-	}
-	tmpFile.Close()
-
-	actualChecksum := fmt.Sprintf("sha256:%x", hasher.Sum(nil))
-	if actualChecksum != plat.Checksum {
-		return fmt.Errorf("checksum verification failed (expected: %s, got: %s)", plat.Checksum, actualChecksum)
-	}
-
-	binName := manifest.Bin
-	if runtime.GOOS == "windows" {
-		binName += ".exe"
-	}
-
-	destName := pluginPrefix + manifest.Name
-	if runtime.GOOS == "windows" {
-		destName += ".exe"
-	}
-	destPath := filepath.Join(pluginDir, destName)
-
-	if strings.HasSuffix(plat.URL, ".zip") {
-		err = extractFromZip(tmpFile.Name(), binName, destPath)
-	} else {
-		err = extractFromTarGz(tmpFile.Name(), binName, destPath)
-	}
-	if err != nil {
-		return err
-	}
-
-	receipt := Receipt{
-		Name:        manifest.Name,
-		Version:     pv.Version,
-		InstalledAt: time.Now().UTC().Format(time.RFC3339),
-		Platform:    *plat,
-	}
-	return writeReceipt(pluginDir, manifest.Name, &receipt)
-}
-
-// Uninstall removes a plugin binary (or symlink) and its receipt from the
-// plugin directory. Returns an error if the plugin is not installed.
-func Uninstall(pluginDir, name string) error {
-	binName := pluginPrefix + name
-	if runtime.GOOS == "windows" {
-		binName += ".exe"
-	}
-
-	binPath := filepath.Join(pluginDir, binName)
-
-	// Use Lstat so we detect symlinks without following them.
-	if _, err := os.Lstat(binPath); os.IsNotExist(err) {
-		return fmt.Errorf("plugin %q is not installed", name)
-	}
-
-	if err := os.Remove(binPath); err != nil {
-		return fmt.Errorf("failed to remove plugin binary: %w", err)
-	}
-
-	// Receipt is optional (manually installed plugins don't have one).
-	if err := os.Remove(receiptPath(pluginDir, name)); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to remove plugin receipt: %w", err)
-	}
-
-	return nil
-}
-
-// ReadReceipt reads the install receipt for a plugin.
-// Returns nil if no receipt exists.
-func ReadReceipt(pluginDir, name string) *Receipt {
-	data, err := os.ReadFile(receiptPath(pluginDir, name))
-	if err != nil {
-		return nil
-	}
-
-	var receipt Receipt
-	if err := yaml.Unmarshal(data, &receipt); err != nil {
-		return nil
-	}
-
-	return &receipt
-}
-
-func receiptPath(pluginDir, name string) string {
-	return filepath.Join(pluginDir, pluginPrefix+name+".yaml")
-}
-
-func writeReceipt(pluginDir, name string, receipt *Receipt) error {
-	data, err := yaml.Marshal(receipt)
-	if err != nil {
-		return fmt.Errorf("failed to marshal receipt: %w", err)
-	}
-
-	return os.WriteFile(receiptPath(pluginDir, name), data, 0o644)
-}
-
-// extractFromTarGz extracts a named file from a tar.gz archive
-// and streams it directly to destPath.
-func extractFromTarGz(archivePath, targetName, destPath string) error {
-	f, err := os.Open(archivePath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	gr, err := gzip.NewReader(f)
-	if err != nil {
-		return fmt.Errorf("failed to read gzip: %w", err)
-	}
-	defer gr.Close()
-
-	tr := tar.NewReader(gr)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return fmt.Errorf("failed to read tar: %w", err)
-		}
-
-		if filepath.IsAbs(header.Name) || strings.Contains(header.Name, "..") {
-			continue
-		}
-		if filepath.Base(header.Name) == targetName && header.Typeflag == tar.TypeReg {
-			return writeStreamToFile(tr, destPath)
-		}
-	}
-
-	return fmt.Errorf("binary %q not found in archive", targetName)
-}
-
-// extractFromZip extracts a named file from a zip archive
-// and streams it directly to destPath.
-func extractFromZip(archivePath, targetName, destPath string) error {
-	r, err := zip.OpenReader(archivePath)
-	if err != nil {
-		return fmt.Errorf("failed to open zip: %w", err)
-	}
-	defer r.Close()
-
-	for _, f := range r.File {
-		if filepath.Base(f.Name) == targetName && !f.FileInfo().IsDir() {
-			rc, err := f.Open()
-			if err != nil {
-				return fmt.Errorf("failed to open %q in zip: %w", targetName, err)
-			}
-			defer rc.Close()
-			return writeStreamToFile(rc, destPath)
-		}
-	}
-
-	return fmt.Errorf("binary %q not found in archive", targetName)
-}
-
-func writeStreamToFile(r io.Reader, destPath string) error {
-	out, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o755)
-	if err != nil {
-		return fmt.Errorf("failed to create %s: %w", destPath, err)
-	}
-
-	if _, err := io.Copy(out, r); err != nil {
-		out.Close()
-		return fmt.Errorf("failed to write plugin binary: %w", err)
-	}
-	return out.Close()
-}
--- a/internal/plugin/install_test.go
+++ b/internal/plugin/install_test.go
@@ -1,331 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"archive/tar"
-	"bytes"
-	"compress/gzip"
-	"crypto/sha256"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-)
-
-// createTestTarGz creates a tar.gz archive containing a single file.
-func createTestTarGz(name string, content []byte) ([]byte, error) {
-	var buf bytes.Buffer
-
-	gw := gzip.NewWriter(&buf)
-	tw := tar.NewWriter(gw)
-
-	hdr := &tar.Header{
-		Name: name,
-		Mode: 0o755,
-		Size: int64(len(content)),
-	}
-	if err := tw.WriteHeader(hdr); err != nil {
-		return nil, err
-	}
-	if _, err := tw.Write(content); err != nil {
-		return nil, err
-	}
-
-	tw.Close()
-	gw.Close()
-	return buf.Bytes(), nil
-}
-
-func TestInstall(t *testing.T) {
-	binaryContent := []byte("#!/bin/sh\necho hello")
-	archive, err := createTestTarGz("flux-operator", binaryContent)
-	if err != nil {
-		t.Fatalf("failed to create test archive: %v", err)
-	}
-
-	checksum := fmt.Sprintf("sha256:%x", sha256.Sum256(archive))
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write(archive)
-	}))
-	defer server.Close()
-
-	pluginDir := t.TempDir()
-
-	manifest := &PluginManifest{
-		Name: "operator",
-		Bin:  "flux-operator",
-	}
-	pv := &PluginVersion{Version: "0.45.0"}
-	plat := &PluginPlatform{
-		OS:       "linux",
-		Arch:     "amd64",
-		URL:      server.URL + "/flux-operator_0.45.0_linux_amd64.tar.gz",
-		Checksum: checksum,
-	}
-
-	installer := &Installer{HTTPClient: server.Client()}
-	if err := installer.Install(pluginDir, manifest, pv, plat); err != nil {
-		t.Fatalf("install failed: %v", err)
-	}
-
-	// Verify binary was written.
-	binPath := filepath.Join(pluginDir, "flux-operator")
-	data, err := os.ReadFile(binPath)
-	if err != nil {
-		t.Fatalf("binary not found: %v", err)
-	}
-	if string(data) != string(binaryContent) {
-		t.Errorf("binary content mismatch")
-	}
-
-	// Verify receipt was written.
-	receipt := ReadReceipt(pluginDir, "operator")
-	if receipt == nil {
-		t.Fatal("receipt not found")
-	}
-	if receipt.Version != "0.45.0" {
-		t.Errorf("expected version '0.45.0', got %q", receipt.Version)
-	}
-	if receipt.Name != "operator" {
-		t.Errorf("expected name 'operator', got %q", receipt.Name)
-	}
-}
-
-func TestInstallChecksumMismatch(t *testing.T) {
-	binaryContent := []byte("#!/bin/sh\necho hello")
-	archive, err := createTestTarGz("flux-operator", binaryContent)
-	if err != nil {
-		t.Fatalf("failed to create test archive: %v", err)
-	}
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write(archive)
-	}))
-	defer server.Close()
-
-	pluginDir := t.TempDir()
-
-	manifest := &PluginManifest{Name: "operator", Bin: "flux-operator"}
-	pv := &PluginVersion{Version: "0.45.0"}
-	plat := &PluginPlatform{
-		OS:       "linux",
-		Arch:     "amd64",
-		URL:      server.URL + "/archive.tar.gz",
-		Checksum: "sha256:0000000000000000000000000000000000000000000000000000000000000000",
-	}
-
-	installer := &Installer{HTTPClient: server.Client()}
-	err = installer.Install(pluginDir, manifest, pv, plat)
-	if err == nil {
-		t.Fatal("expected checksum error, got nil")
-	}
-	if !bytes.Contains([]byte(err.Error()), []byte("checksum verification failed")) {
-		t.Errorf("expected checksum error, got: %v", err)
-	}
-}
-
-func TestInstallBinaryNotInArchive(t *testing.T) {
-	// Archive contains "wrong-name" instead of "flux-operator".
-	archive, err := createTestTarGz("wrong-name", []byte("content"))
-	if err != nil {
-		t.Fatalf("failed to create test archive: %v", err)
-	}
-
-	checksum := fmt.Sprintf("sha256:%x", sha256.Sum256(archive))
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write(archive)
-	}))
-	defer server.Close()
-
-	pluginDir := t.TempDir()
-
-	manifest := &PluginManifest{Name: "operator", Bin: "flux-operator"}
-	pv := &PluginVersion{Version: "0.45.0"}
-	plat := &PluginPlatform{
-		OS:       "linux",
-		Arch:     "amd64",
-		URL:      server.URL + "/archive.tar.gz",
-		Checksum: checksum,
-	}
-
-	installer := &Installer{HTTPClient: server.Client()}
-	err = installer.Install(pluginDir, manifest, pv, plat)
-	if err == nil {
-		t.Fatal("expected error for missing binary, got nil")
-	}
-	if !bytes.Contains([]byte(err.Error()), []byte("not found in archive")) {
-		t.Errorf("expected 'not found in archive' error, got: %v", err)
-	}
-}
-
-func TestUninstall(t *testing.T) {
-	pluginDir := t.TempDir()
-
-	// Create fake binary and receipt.
-	binPath := filepath.Join(pluginDir, "flux-testplugin")
-	os.WriteFile(binPath, []byte("binary"), 0o755)
-	receiptPath := filepath.Join(pluginDir, "flux-testplugin.yaml")
-	os.WriteFile(receiptPath, []byte("name: testplugin"), 0o644)
-
-	if err := Uninstall(pluginDir, "testplugin"); err != nil {
-		t.Fatalf("uninstall failed: %v", err)
-	}
-
-	if _, err := os.Stat(binPath); !os.IsNotExist(err) {
-		t.Error("binary was not removed")
-	}
-	if _, err := os.Stat(receiptPath); !os.IsNotExist(err) {
-		t.Error("receipt was not removed")
-	}
-}
-
-func TestUninstallNonExistent(t *testing.T) {
-	pluginDir := t.TempDir()
-
-	err := Uninstall(pluginDir, "nonexistent")
-	if err == nil {
-		t.Fatal("expected error for non-existent plugin, got nil")
-	}
-	if !strings.Contains(err.Error(), "is not installed") {
-		t.Errorf("expected 'is not installed' error, got: %v", err)
-	}
-}
-
-func TestUninstallSymlink(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("symlinks require elevated privileges on Windows")
-	}
-
-	pluginDir := t.TempDir()
-
-	// Create a real binary and symlink it into the plugin dir.
-	realBin := filepath.Join(t.TempDir(), "flux-operator")
-	os.WriteFile(realBin, []byte("real binary"), 0o755)
-
-	linkPath := filepath.Join(pluginDir, "flux-linked")
-	os.Symlink(realBin, linkPath)
-
-	if err := Uninstall(pluginDir, "linked"); err != nil {
-		t.Fatalf("uninstall symlink failed: %v", err)
-	}
-
-	// Symlink should be removed.
-	if _, err := os.Lstat(linkPath); !os.IsNotExist(err) {
-		t.Error("symlink was not removed")
-	}
-	// Original binary should still exist.
-	if _, err := os.Stat(realBin); err != nil {
-		t.Error("original binary was removed — symlink removal should not affect target")
-	}
-}
-
-func TestUninstallManualBinary(t *testing.T) {
-	pluginDir := t.TempDir()
-
-	// Manually copied binary with no receipt.
-	binPath := filepath.Join(pluginDir, "flux-manual")
-	os.WriteFile(binPath, []byte("binary"), 0o755)
-
-	if err := Uninstall(pluginDir, "manual"); err != nil {
-		t.Fatalf("uninstall manual binary failed: %v", err)
-	}
-
-	if _, err := os.Stat(binPath); !os.IsNotExist(err) {
-		t.Error("binary was not removed")
-	}
-}
-
-func TestReadReceipt(t *testing.T) {
-	pluginDir := t.TempDir()
-
-	t.Run("exists", func(t *testing.T) {
-		receiptData := `name: operator
-version: "0.45.0"
-installedAt: "2026-03-28T20:05:00Z"
-platform:
-  os: darwin
-  arch: arm64
-  url: https://example.com/archive.tar.gz
-  checksum: sha256:abc123
-`
-		os.WriteFile(filepath.Join(pluginDir, "flux-operator.yaml"), []byte(receiptData), 0o644)
-
-		receipt := ReadReceipt(pluginDir, "operator")
-		if receipt == nil {
-			t.Fatal("expected receipt, got nil")
-		}
-		if receipt.Version != "0.45.0" {
-			t.Errorf("expected version '0.45.0', got %q", receipt.Version)
-		}
-		if receipt.Platform.OS != "darwin" {
-			t.Errorf("expected OS 'darwin', got %q", receipt.Platform.OS)
-		}
-	})
-
-	t.Run("not exists", func(t *testing.T) {
-		receipt := ReadReceipt(pluginDir, "nonexistent")
-		if receipt != nil {
-			t.Error("expected nil receipt")
-		}
-	})
-}
-
-func TestExtractFromTarGz(t *testing.T) {
-	content := []byte("test binary content")
-	archive, err := createTestTarGz("flux-operator", content)
-	if err != nil {
-		t.Fatalf("failed to create archive: %v", err)
-	}
-
-	tmpFile := filepath.Join(t.TempDir(), "test.tar.gz")
-	os.WriteFile(tmpFile, archive, 0o644)
-
-	destPath := filepath.Join(t.TempDir(), "flux-operator")
-	if err := extractFromTarGz(tmpFile, "flux-operator", destPath); err != nil {
-		t.Fatalf("extract failed: %v", err)
-	}
-	data, err := os.ReadFile(destPath)
-	if err != nil {
-		t.Fatalf("failed to read extracted file: %v", err)
-	}
-	if string(data) != string(content) {
-		t.Errorf("content mismatch: got %q, want %q", string(data), string(content))
-	}
-}
-
-func TestExtractFromTarGzNotFound(t *testing.T) {
-	archive, err := createTestTarGz("other-binary", []byte("content"))
-	if err != nil {
-		t.Fatalf("failed to create archive: %v", err)
-	}
-
-	tmpFile := filepath.Join(t.TempDir(), "test.tar.gz")
-	os.WriteFile(tmpFile, archive, 0o644)
-
-	destPath := filepath.Join(t.TempDir(), "flux-operator")
-	err = extractFromTarGz(tmpFile, "flux-operator", destPath)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-}
--- a/internal/plugin/update.go
+++ b/internal/plugin/update.go
@@ -1,85 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-const (
-	SkipReasonManual   = "manually installed"
-	SkipReasonUpToDate = "already up to date"
-)
-
-// UpdateResult represents the outcome of updating a single plugin.
-// When an update is available, Manifest, Version and Platform are
-// populated so the caller can install without re-fetching or re-resolving.
-type UpdateResult struct {
-	Name        string
-	FromVersion string
-	ToVersion   string
-	Skipped     bool
-	SkipReason  string
-	Manifest    *PluginManifest
-	Version     *PluginVersion
-	Platform    *PluginPlatform
-	Err         error
-}
-
-// CheckUpdate compares the installed version against the latest in the catalog.
-// Returns an UpdateResult describing what should happen. When an update is
-// available, Manifest is populated so the caller can install without re-fetching.
-func CheckUpdate(pluginDir string, name string, catalog *CatalogClient, goos, goarch string) UpdateResult {
-	receipt := ReadReceipt(pluginDir, name)
-	if receipt == nil {
-		return UpdateResult{
-			Name:       name,
-			Skipped:    true,
-			SkipReason: SkipReasonManual,
-		}
-	}
-
-	manifest, err := catalog.FetchManifest(name)
-	if err != nil {
-		return UpdateResult{Name: name, Err: err}
-	}
-
-	latest, err := ResolveVersion(manifest, "")
-	if err != nil {
-		return UpdateResult{Name: name, Err: err}
-	}
-
-	if receipt.Version == latest.Version {
-		return UpdateResult{
-			Name:        name,
-			FromVersion: receipt.Version,
-			ToVersion:   latest.Version,
-			Skipped:     true,
-			SkipReason:  SkipReasonUpToDate,
-		}
-	}
-
-	plat, err := ResolvePlatform(latest, goos, goarch)
-	if err != nil {
-		return UpdateResult{Name: name, Err: err}
-	}
-
-	return UpdateResult{
-		Name:        name,
-		FromVersion: receipt.Version,
-		ToVersion:   latest.Version,
-		Manifest:    manifest,
-		Version:     latest,
-		Platform:    plat,
-	}
-}
--- a/internal/plugin/update_test.go
+++ b/internal/plugin/update_test.go
@@ -1,153 +0,0 @@
-/*
-Copyright 2026 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package plugin
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestCheckUpdateUpToDate(t *testing.T) {
-	manifest := `
-apiVersion: cli.fluxcd.io/v1beta1
-kind: Plugin
-name: operator
-bin: flux-operator
-versions:
-  - version: 0.45.0
-    platforms:
-      - os: linux
-        arch: amd64
-        url: https://example.com/archive.tar.gz
-        checksum: sha256:abc123
-`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(manifest))
-	}))
-	defer server.Close()
-
-	pluginDir := t.TempDir()
-
-	// Write receipt with same version.
-	receiptData := `name: operator
-version: "0.45.0"
-installedAt: "2026-03-28T20:05:00Z"
-platform:
-  os: linux
-  arch: amd64
-`
-	os.WriteFile(filepath.Join(pluginDir, "flux-operator.yaml"), []byte(receiptData), 0o644)
-
-	catalog := &CatalogClient{
-		BaseURL:    server.URL + "/",
-		HTTPClient: server.Client(),
-		GetEnv:     func(key string) string { return "" },
-	}
-
-	result := CheckUpdate(pluginDir, "operator", catalog, "linux", "amd64")
-	if result.Err != nil {
-		t.Fatalf("unexpected error: %v", result.Err)
-	}
-	if !result.Skipped {
-		t.Error("expected skipped=true")
-	}
-	if result.SkipReason != SkipReasonUpToDate {
-		t.Errorf("expected %q, got %q", SkipReasonUpToDate, result.SkipReason)
-	}
-}
-
-func TestCheckUpdateAvailable(t *testing.T) {
-	manifest := `
-apiVersion: cli.fluxcd.io/v1beta1
-kind: Plugin
-name: operator
-bin: flux-operator
-versions:
-  - version: 0.46.0
-    platforms:
-      - os: linux
-        arch: amd64
-        url: https://example.com/archive.tar.gz
-        checksum: sha256:abc123
-  - version: 0.45.0
-    platforms:
-      - os: linux
-        arch: amd64
-        url: https://example.com/archive.tar.gz
-        checksum: sha256:def456
-`
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(manifest))
-	}))
-	defer server.Close()
-
-	pluginDir := t.TempDir()
-
-	receiptData := `name: operator
-version: "0.45.0"
-installedAt: "2026-03-28T20:05:00Z"
-platform:
-  os: linux
-  arch: amd64
-`
-	os.WriteFile(filepath.Join(pluginDir, "flux-operator.yaml"), []byte(receiptData), 0o644)
-
-	catalog := &CatalogClient{
-		BaseURL:    server.URL + "/",
-		HTTPClient: server.Client(),
-		GetEnv:     func(key string) string { return "" },
-	}
-
-	result := CheckUpdate(pluginDir, "operator", catalog, "linux", "amd64")
-	if result.Err != nil {
-		t.Fatalf("unexpected error: %v", result.Err)
-	}
-	if result.Skipped {
-		t.Error("expected skipped=false")
-	}
-	if result.FromVersion != "0.45.0" {
-		t.Errorf("expected from '0.45.0', got %q", result.FromVersion)
-	}
-	if result.ToVersion != "0.46.0" {
-		t.Errorf("expected to '0.46.0', got %q", result.ToVersion)
-	}
-}
-
-func TestCheckUpdateManualInstall(t *testing.T) {
-	pluginDir := t.TempDir()
-
-	// No receipt — manually installed.
-	catalog := &CatalogClient{
-		BaseURL:    "https://example.com/",
-		HTTPClient: http.DefaultClient,
-		GetEnv:     func(key string) string { return "" },
-	}
-
-	result := CheckUpdate(pluginDir, "operator", catalog, "linux", "amd64")
-	if result.Err != nil {
-		t.Fatalf("unexpected error: %v", result.Err)
-	}
-	if !result.Skipped {
-		t.Error("expected skipped=true")
-	}
-	if result.SkipReason != SkipReasonManual {
-		t.Errorf("expected 'manually installed', got %q", result.SkipReason)
-	}
-}
--- a/manifests/bases/helm-controller/kustomization.yaml
+++ b/manifests/bases/helm-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/helm-controller/releases/download/v1.5.3/helm-controller.crds.yaml
- https://github.com/fluxcd/helm-controller/releases/download/v1.5.3/helm-controller.deployment.yaml
+- https://github.com/fluxcd/helm-controller/releases/download/v1.5.1/helm-controller.crds.yaml
+- https://github.com/fluxcd/helm-controller/releases/download/v1.5.1/helm-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
--- a/manifests/bases/image-automation-controller/kustomization.yaml
+++ b/manifests/bases/image-automation-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/image-automation-controller/releases/download/v1.1.1/image-automation-controller.crds.yaml
- https://github.com/fluxcd/image-automation-controller/releases/download/v1.1.1/image-automation-controller.deployment.yaml
+- https://github.com/fluxcd/image-automation-controller/releases/download/v1.1.0/image-automation-controller.crds.yaml
+- https://github.com/fluxcd/image-automation-controller/releases/download/v1.1.0/image-automation-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
--- a/manifests/bases/image-reflector-controller/kustomization.yaml
+++ b/manifests/bases/image-reflector-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/image-reflector-controller/releases/download/v1.1.1/image-reflector-controller.crds.yaml
- https://github.com/fluxcd/image-reflector-controller/releases/download/v1.1.1/image-reflector-controller.deployment.yaml
+- https://github.com/fluxcd/image-reflector-controller/releases/download/v1.1.0/image-reflector-controller.crds.yaml
+- https://github.com/fluxcd/image-reflector-controller/releases/download/v1.1.0/image-reflector-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
--- a/manifests/bases/kustomize-controller/kustomization.yaml
+++ b/manifests/bases/kustomize-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/kustomize-controller/releases/download/v1.8.2/kustomize-controller.crds.yaml
- https://github.com/fluxcd/kustomize-controller/releases/download/v1.8.2/kustomize-controller.deployment.yaml
+- https://github.com/fluxcd/kustomize-controller/releases/download/v1.8.1/kustomize-controller.crds.yaml
+- https://github.com/fluxcd/kustomize-controller/releases/download/v1.8.1/kustomize-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
--- a/manifests/bases/notification-controller/kustomization.yaml
+++ b/manifests/bases/notification-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/notification-controller/releases/download/v1.8.2/notification-controller.crds.yaml
- https://github.com/fluxcd/notification-controller/releases/download/v1.8.2/notification-controller.deployment.yaml
+- https://github.com/fluxcd/notification-controller/releases/download/v1.8.1/notification-controller.crds.yaml
+- https://github.com/fluxcd/notification-controller/releases/download/v1.8.1/notification-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
--- a/manifests/bases/source-controller/kustomization.yaml
+++ b/manifests/bases/source-controller/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/source-controller/releases/download/v1.8.1/source-controller.crds.yaml
- https://github.com/fluxcd/source-controller/releases/download/v1.8.1/source-controller.deployment.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.8.0/source-controller.crds.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.8.0/source-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
--- a/manifests/bases/source-watcher/kustomization.yaml
+++ b/manifests/bases/source-watcher/kustomization.yaml
@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/source-watcher/releases/download/v2.1.1/source-watcher.crds.yaml
- https://github.com/fluxcd/source-watcher/releases/download/v2.1.1/source-watcher.deployment.yaml
+- https://github.com/fluxcd/source-watcher/releases/download/v2.1.0/source-watcher.crds.yaml
+- https://github.com/fluxcd/source-watcher/releases/download/v2.1.0/source-watcher.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml
--- a/manifests/crds/kustomization.yaml
+++ b/manifests/crds/kustomization.yaml
@@ -1,10 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- https://github.com/fluxcd/source-controller/releases/download/v1.8.1/source-controller.crds.yaml
- https://github.com/fluxcd/kustomize-controller/releases/download/v1.8.2/kustomize-controller.crds.yaml
- https://github.com/fluxcd/helm-controller/releases/download/v1.5.3/helm-controller.crds.yaml
- https://github.com/fluxcd/notification-controller/releases/download/v1.8.2/notification-controller.crds.yaml
- https://github.com/fluxcd/image-reflector-controller/releases/download/v1.1.1/image-reflector-controller.crds.yaml
- https://github.com/fluxcd/image-automation-controller/releases/download/v1.1.1/image-automation-controller.crds.yaml
- https://github.com/fluxcd/source-watcher/releases/download/v2.1.1/source-watcher.crds.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.8.0/source-controller.crds.yaml
+- https://github.com/fluxcd/kustomize-controller/releases/download/v1.8.1/kustomize-controller.crds.yaml
+- https://github.com/fluxcd/helm-controller/releases/download/v1.5.1/helm-controller.crds.yaml
+- https://github.com/fluxcd/notification-controller/releases/download/v1.8.1/notification-controller.crds.yaml
+- https://github.com/fluxcd/image-reflector-controller/releases/download/v1.1.0/image-reflector-controller.crds.yaml
+- https://github.com/fluxcd/image-automation-controller/releases/download/v1.1.0/image-automation-controller.crds.yaml
+- https://github.com/fluxcd/source-watcher/releases/download/v2.1.0/source-watcher.crds.yaml
--- a/rfcs/0010-multi-tenant-workload-identity/README.md
+++ b/rfcs/0010-multi-tenant-workload-identity/README.md
@@ -1,10 +1,15 @@
 # RFC-0010 Multi-Tenant Workload Identity

-**Status:** implemented
+**Status:** implementable
+
+<!--
+Status represents the current state of the RFC.
+Must be one of `provisional`, `implementable`, `implemented`, `deferred`, `rejected`, `withdrawn`, or `replaced`.
+-->

 **Creation date:** 2025-02-22

-**Last update:** 2026-03-13
+**Last update:** 2025-04-29

 ## Summary

@@ -1415,11 +1420,10 @@ options to call `gcp.NewTokenSource()` and feed this token source to the
  `HelmRepository` and `HelmChart`, as well as for SOPS decryption
  in the `Kustomization` API and Azure Event Hubs in the
  `Provider` API.
-* In Flux 2.7 object-level workload identity was introduced for all
-  the remaining APIs that support cloud providers, i.e. `Bucket`,
-  `GitRepository` and `ImageUpdateAutomation`, and also all the
-  remaining types for the `Provider` API, i.e. `azuredevops` and
-  `googlepubsub`. In addition, support for controller and
-  object-level workload identity was introduced for the
-  `Kustomization` and `HelmRelease` APIs for remote cluster
-  access.
+
+<!--
+Major milestones in the lifecycle of the RFC such as:
+- The first Flux release where an initial version of the RFC was available.
+- The version of Flux where the RFC graduated to general availability.
+- The version of Flux where the RFC was retired or superseded.
+-->
--- a/rfcs/0011-opentelemetry-tracing/README.md
+++ b/rfcs/0011-opentelemetry-tracing/README.md
@@ -1,10 +1,15 @@
 # RFC-0011: OpenTelemetry Tracing

-**Status:** implemented
+**Status:** provisional
+
+<!--
+Status represents the current state of the RFC.
+Must be one of `provisional`, `implementable`, `implemented`, `deferred`, `rejected`, `withdrawn`, or `replaced`.
+-->

 **Creation date:** 2025-04-24

-**Last update:** 2026-03-13
+**Last update:** 2025-08-13

 ## Summary
 The aim is to be able to collect traces via OpenTelemetry (OTel) across all Flux related objects, such as HelmReleases, Kustomizations and among others. These may be sent towards a tracing provider where may be potentially stored and visualized. Flux does not have any responsibility on storing and visualizing those, it keeps being completely stateless. Thereby, being seamless for the user, the implementation is going to be part of the already existing `Alert` API Type. Therefore, `EventSources` is going to discriminate the events belonging to the specific sources, which are going to be looked up to and send them out towards the `Provider` set. In this way, it could facilitate the observability and monitoring of Flux related objects.
@@ -205,4 +210,9 @@ This design ensures trace continuity even in challenging distributed environment

 ## Implementation History

-* RFC implemented and generally available in Flux [v2.7.0](https://github.com/fluxcd/flux2/releases/tag/v2.7.0)
+<!--
+Major milestones in the lifecycle of the RFC such as:
+- The first Flux release where an initial version of the RFC was available.
+- The version of Flux where the RFC graduated to general availability.
+- The version of Flux where the RFC was retired or superseded.
+-->
--- a/rfcs/0012-external-artifact/README.md
+++ b/rfcs/0012-external-artifact/README.md
@@ -1,10 +1,10 @@
 # RFC-0012 External Artifact

-**Status:** implemented
+**Status:** provisional

 **Creation date:** 2025-04-08

-**Last update:** 2026-03-13
+**Last update:** 2025-09-03

 ## Summary

@@ -319,4 +319,9 @@ control the adoption of the `ExternalArtifact` feature in their clusters.

 ## Implementation History

-* RFC implemented and generally available in Flux [v2.7.0](https://github.com/fluxcd/flux2/releases/tag/v2.7.0)
+<!--
+Major milestones in the lifecycle of the RFC such as:
+- The first Flux release where an initial version of the RFC was available.
+- The version of Flux where the RFC graduated to general availability.
+- The version of Flux where the RFC was retired or superseded.
+-->
--- a/tests/integration/go.mod
+++ b/tests/integration/go.mod
@@ -11,10 +11,10 @@ require (
 	github.com/fluxcd/image-reflector-controller/api v1.0.4
 	github.com/fluxcd/kustomize-controller/api v1.7.3
 	github.com/fluxcd/notification-controller/api v1.7.5
-	github.com/fluxcd/pkg/apis/event v0.25.0
-	github.com/fluxcd/pkg/apis/meta v1.26.0
-	github.com/fluxcd/pkg/git v0.46.0
-	github.com/fluxcd/pkg/runtime v0.103.0
+	github.com/fluxcd/pkg/apis/event v0.24.0
+	github.com/fluxcd/pkg/apis/meta v1.25.0
+	github.com/fluxcd/pkg/git v0.43.0
+	github.com/fluxcd/pkg/runtime v0.100.3
 	github.com/fluxcd/source-controller/api v1.7.4
 	github.com/fluxcd/test-infra/tftestenv v0.0.0-20250626232827-e0ca9c3f8d7b
 	github.com/go-git/go-git/v5 v5.16.5
@@ -24,10 +24,10 @@ require (
 	github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5
 	github.com/onsi/gomega v1.39.0
 	google.golang.org/grpc v1.77.0
-	k8s.io/api v0.35.2
-	k8s.io/apimachinery v0.35.2
-	k8s.io/client-go v0.35.2
-	sigs.k8s.io/controller-runtime v0.23.3
+	k8s.io/api v0.35.1
+	k8s.io/apimachinery v0.35.1
+	k8s.io/client-go v0.35.1
+	sigs.k8s.io/controller-runtime v0.23.1
 )

 require (
@@ -53,7 +53,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.3.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -66,9 +66,9 @@ require (
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fluxcd/pkg/apis/acl v0.9.0 // indirect
-	github.com/fluxcd/pkg/apis/kustomize v1.16.0 // indirect
+	github.com/fluxcd/pkg/apis/kustomize v1.15.0 // indirect
 	github.com/fluxcd/pkg/ssh v0.24.0 // indirect
-	github.com/fluxcd/pkg/version v0.14.0 // indirect
+	github.com/fluxcd/pkg/version v0.12.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.7.0 // indirect
@@ -143,7 +143,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.35.2 // indirect
+	k8s.io/apiextensions-apiserver v0.35.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
--- a/tests/integration/go.sum
+++ b/tests/integration/go.sum
@@ -78,8 +78,8 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/chainguard-dev/git-urls v1.0.2 h1:pSpT7ifrpc5X55n4aTTm7FFUE+ZQHKiqpiwNkJrVcKQ=
 github.com/chainguard-dev/git-urls v1.0.2/go.mod h1:rbGgj10OS7UgZlbzdUQIQpT0k/D4+An04HJY7Ol+Y/o=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f h1:Y8xYupdHxryycyPlc9Y+bSQAYZnetRJ70VMVKm5CKI0=
 github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f/go.mod h1:HlzOvOjVBOfTGSRXRyY0OiCS/3J1akRGQQpRO/7zyF4=
@@ -136,22 +136,22 @@ github.com/fluxcd/notification-controller/api v1.7.5 h1:6CO5bKyjodiK9exQFOdBcz0X
 github.com/fluxcd/notification-controller/api v1.7.5/go.mod h1:IciwSg8Q0pVtdbsyDyEXx/MxBKWeagxAazpm64C8oCE=
 github.com/fluxcd/pkg/apis/acl v0.9.0 h1:wBpgsKT+jcyZEcM//OmZr9RiF8klL3ebrDp2u2ThsnA=
 github.com/fluxcd/pkg/apis/acl v0.9.0/go.mod h1:TttNS+gocsGLwnvmgVi3/Yscwqrjc17+vhgYfqkfrV4=
-github.com/fluxcd/pkg/apis/event v0.25.0 h1:zdwytvDhG+fk+Ywl5DOtv7TklkrVgM21WHm1f+YhleE=
-github.com/fluxcd/pkg/apis/event v0.25.0/go.mod h1:TlK8HWYrTwl0raqBRC+ROoNpYW5fdVnwcwOBOx5Kzw8=
-github.com/fluxcd/pkg/apis/kustomize v1.16.0 h1:PhWXEhqQqsisIpwp1/wHvTvo+MO+GGzsBPoN0ZnRE3Y=
-github.com/fluxcd/pkg/apis/kustomize v1.16.0/go.mod h1:IZOy4CCtR/hxMGb7erK1RfbGnczVv4/dRBoVD37AywI=
-github.com/fluxcd/pkg/apis/meta v1.26.0 h1:dxP1FfBpTCYso6odzRcltVnnRuBb2VyhhgV0VX9YbUE=
-github.com/fluxcd/pkg/apis/meta v1.26.0/go.mod h1:c7o6mJGLCMvNrfdinGZehkrdZuFT9vZdZNrn66DtVD0=
-github.com/fluxcd/pkg/git v0.46.0 h1:QMh0+ZzQ2jO6rIGj4ffR5trZ8g/cxvt8cVajReJ8Iyw=
-github.com/fluxcd/pkg/git v0.46.0/go.mod h1:iHcIjx9c8zye3PQiajTJYxgOMRiy7WCs+hfLKDswpfI=
-github.com/fluxcd/pkg/gittestserver v0.26.0 h1:+RZrCzFRsE+d5WaqAoqaPCEgcgv/jZp6+f7DS0+Ynb8=
-github.com/fluxcd/pkg/gittestserver v0.26.0/go.mod h1:7fybYb0yej1fFNiF1ohs0Jr0XzyaZQ/cRh3AFEoCtuc=
-github.com/fluxcd/pkg/runtime v0.103.0 h1:J5y5GPhWdkyqIUBlaI1FP2N02TtZmsjbWhhZubuTSFk=
-github.com/fluxcd/pkg/runtime v0.103.0/go.mod h1:mbo2f3azo3yVQgm7XZGxQB6/2zvzQ5Wgtd8TjRRwwAw=
+github.com/fluxcd/pkg/apis/event v0.24.0 h1:WVPf0FrJ5JExRDDGoo4W0jZgHZt0n4E48/e8b3TSmkA=
+github.com/fluxcd/pkg/apis/event v0.24.0/go.mod h1:Hoi4DejaNKVahGkRXqGBjT9h1aKmhc7RCYcsgoTieqc=
+github.com/fluxcd/pkg/apis/kustomize v1.15.0 h1:p8wPIxdmn0vy0a664rsE9JKCfnliZz4HUsDcTy4ZOxA=
+github.com/fluxcd/pkg/apis/kustomize v1.15.0/go.mod h1:XWdsx8P15OiMaQIvmUjYWdmD3zAwhl5q9osl5iCqcOk=
+github.com/fluxcd/pkg/apis/meta v1.25.0 h1:fmZgMoe7yITGfhFqdOs7w2GOu3Y/2Vvz4+4p/eay3eA=
+github.com/fluxcd/pkg/apis/meta v1.25.0/go.mod h1:1D92RqAet0/n/cH5S0khBXweirHWkw9rCO0V4NCY6xc=
+github.com/fluxcd/pkg/git v0.43.0 h1:11LKsTHw+yx3rcGSrSbkURcdc4huUv3FxQZhHIAMofc=
+github.com/fluxcd/pkg/git v0.43.0/go.mod h1:cr9eoYLZHKP3NWgJhhJ8pBcllTpl2SbXVoifW37IyIQ=
+github.com/fluxcd/pkg/gittestserver v0.25.0 h1:thnS0OOuU2mEA0PjByxrSxrvlvSwVxJSZY1me782Vq4=
+github.com/fluxcd/pkg/gittestserver v0.25.0/go.mod h1:cQqa3cOdKdrIDUqV8SCYbIoNw4/a8frJRGofBLv7sWw=
+github.com/fluxcd/pkg/runtime v0.100.3 h1:iwbmB8lgJ5zM+lfieiOOJn2JgzRbUvYW4EhnVyQXBRw=
+github.com/fluxcd/pkg/runtime v0.100.3/go.mod h1:eAM9vzJueVHhEWexMf29zQt9Xb7J4kWMPMu+0cfy5/c=
 github.com/fluxcd/pkg/ssh v0.24.0 h1:hrPlxs0hhXf32DRqs68VbsXs0XfQMphyRVIk0rYYJa4=
 github.com/fluxcd/pkg/ssh v0.24.0/go.mod h1:xWammEqalrpurpcMiixJRXtynRQtBEoqheyU5F/vWrg=
-github.com/fluxcd/pkg/version v0.14.0 h1:T3llSc8sUnsuFrW5ng2ePSfXwGXUKv0YG9QXf0ErhWw=
-github.com/fluxcd/pkg/version v0.14.0/go.mod h1:YHdg/78kzf+kCqS+SqSOiUxum5AjxlixiqwpX6AUZB8=
+github.com/fluxcd/pkg/version v0.12.0 h1:MGbdbNf2D5wazMqAkNPn+Lh5j+oY0gxQJFTGyet5Hfc=
+github.com/fluxcd/pkg/version v0.12.0/go.mod h1:YHdg/78kzf+kCqS+SqSOiUxum5AjxlixiqwpX6AUZB8=
 github.com/fluxcd/source-controller/api v1.7.4 h1:+EOVnRA9LmLxOx7J273l7IOEU39m+Slt/nQGBy69ygs=
 github.com/fluxcd/source-controller/api v1.7.4/go.mod h1:ruf49LEgZRBfcP+eshl2n9SX1MfHayCcViAIGnZcaDY=
 github.com/fluxcd/test-infra/tftestenv v0.0.0-20250626232827-e0ca9c3f8d7b h1:FSPtvaVgL8azcyweqLmD71elAw4vozuXH/QvsJQ7tg0=
@@ -520,22 +520,22 @@ gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-k8s.io/api v0.35.2 h1:tW7mWc2RpxW7HS4CoRXhtYHSzme1PN1UjGHJ1bdrtdw=
-k8s.io/api v0.35.2/go.mod h1:7AJfqGoAZcwSFhOjcGM7WV05QxMMgUaChNfLTXDRE60=
-k8s.io/apiextensions-apiserver v0.35.2 h1:iyStXHoJZsUXPh/nFAsjC29rjJWdSgUmG1XpApE29c0=
-k8s.io/apiextensions-apiserver v0.35.2/go.mod h1:OdyGvcO1FtMDWQ+rRh/Ei3b6X3g2+ZDHd0MSRGeS8rU=
-k8s.io/apimachinery v0.35.2 h1:NqsM/mmZA7sHW02JZ9RTtk3wInRgbVxL8MPfzSANAK8=
-k8s.io/apimachinery v0.35.2/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
-k8s.io/client-go v0.35.2 h1:YUfPefdGJA4aljDdayAXkc98DnPkIetMl4PrKX97W9o=
-k8s.io/client-go v0.35.2/go.mod h1:4QqEwh4oQpeK8AaefZ0jwTFJw/9kIjdQi0jpKeYvz7g=
+k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q=
+k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM=
+k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w=
+k8s.io/apiextensions-apiserver v0.35.1/go.mod h1:2CN4fe1GZ3HMe4wBr25qXyJnJyZaquy4nNlNmb3R7AQ=
+k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU=
+k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/client-go v0.35.1 h1:+eSfZHwuo/I19PaSxqumjqZ9l5XiTEKbIaJ+j1wLcLM=
+k8s.io/client-go v0.35.1/go.mod h1:1p1KxDt3a0ruRfc/pG4qT/3oHmUj1AhSHEcxNSGg+OA=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
-sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
+sigs.k8s.io/controller-runtime v0.23.1 h1:TjJSM80Nf43Mg21+RCy3J70aj/W6KyvDtOlpKf+PupE=
+sigs.k8s.io/controller-runtime v0.23.1/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
Author	SHA1	Message	Date
Matheus Pimenta	97222a775a	Merge pull request #5741 from fluxcd/backport-5740-to-release/v2.8.x [release/v2.8.x] Update toolkit components	2026-02-27 09:39:11 +00:00
fluxcdbot	959025e649	Update toolkit components - helm-controller to v1.5.1 https://github.com/fluxcd/helm-controller/blob/v1.5.1/CHANGELOG.md - kustomize-controller to v1.8.1 https://github.com/fluxcd/kustomize-controller/blob/v1.8.1/CHANGELOG.md - notification-controller to v1.8.1 https://github.com/fluxcd/notification-controller/blob/v1.8.1/CHANGELOG.md Signed-off-by: GitHub <noreply@github.com> (cherry picked from commit `ab4bbffa5b`)	2026-02-27 09:28:19 +00:00
Matheus Pimenta	75f5e33fd1	Merge pull request #5739 from fluxcd/update-pkg-deps/release/v2.8.x Update fluxcd/pkg dependencies	2026-02-27 09:05:41 +00:00
matheuscscp	79cae5d033	Update fluxcd/pkg dependencies Signed-off-by: GitHub <noreply@github.com>	2026-02-27 08:52:59 +00:00
Matheus Pimenta	41505fd5f3	Merge pull request #5735 from fluxcd/backport-5733-to-release/v2.8.x [release/v2.8.x] Remove no longer needed workaround for Flux 2.8	2026-02-25 11:10:32 +00:00
Matheus Pimenta	2042ddf849	Remove no longer needed workaround for Flux 2.8 Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> (cherry picked from commit `2666eaf8fc`)	2026-02-25 11:00:30 +00:00