# Flux v2.9.5

> CI/CD & App Delivery · 2026-08-31

A maintenance release with dependency updates, startup cleanup, and a fix for crashes caused by negative-length substring expressions. It also enforces inline credentials and certificates for kubeconfig Secrets used by the controllers.

## Check if affected
- **[breaking]** Inline credentials required for kubeconfig Secrets
  - Applies if you use `.spec.kubeConfig`.
  - Kubeconfigs from `.spec.kubeConfig` Secrets now reject local file references in `certificate-authority`, `tokenFile`, `client-certificate`, and `client-key`. Credentials and certificates must be embedded inline in the `helm-controller` and `kustomize-controller`.

## Other recorded changes
- 5 (value_changed 3, defect_corrected 2)

[Full analysis](https://ratatosk.io/en/releases/flux/v2.9.5)

[Original release notes](https://github.com/fluxcd/flux2/releases/tag/v2.9.5)