fix(deps): bump github.com/fluxcd/pkg/apis/meta from 1.31.0 to 1.32.0

[dependabot]

🤖 Generated by the Agentic Engineer

Why

The Flux update could not build alongside KSail's other embedded Kubernetes tools, leaving the dependency update blocked.

What

Upgrade Flux metadata while preserving compatibility with the embedded tools. The broader Kubernetes upgrade remains separate work.

Part of #7492

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Parked on a named blocker: this release of fluxcd/pkg moves to the Kubernetes 1.37 libraries, and ksail cannot build against those yet because vCluster (and Kyverno) still require the 1.36 libraries. Tracked in #7167 and #7143, which list the other dependency PRs held for the same reason. Nothing to fix in this PR itself; it becomes mergeable once those upstream releases land.

[devantler]

🤖 Generated by the Agentic Engineer

Parked on ksail#7259: this bump moves k8s.io/apimachinery to v0.37.0 while the rest of the Kubernetes libraries stay on v0.36, so the build fails inside dependencies. It can merge once Kyverno and vcluster ship releases that support v0.37.

[devantler]

🤖 Generated by the Agentic Engineer

The current branch is conflicted and all failing checks belong to a deleted workflow revision, so they cannot establish whether this dependency update still works on current main. The only extra commit is the reproducible ksail-bot module-sync output; recreating is therefore the safe refresh path and discards no authored adaptation.

@dependabot recreate

[devantler]

🤖 Generated by the Agentic Engineer

Refresh this bot-owned branch to demonstrate the rebase acceptance required by #7140. Its compatibility hold under #7259 remains. Auto-merge has been removed so a refresh cannot substitute for the complete review and compatibility decision.

@dependabot rebase

[devantler]

🤖 Generated by the Agentic Engineer

@dependabot recreate

[devantler]

🤖 Generated by the Agentic Engineer

Published compatibility repair at 3755856c2a9421848b6059a72e488121bb63fafa. Flux metadata is genuinely upgraded to v1.32.0. Its upstream release comparison changes module metadata and copyright text without changing the exported Go implementation.

The original mixed Kubernetes graph fails compilation in k8s.io/api/extensions/v1beta1. With a version-qualified replacement for only k8s.io/apimachinery v0.37.0, that same package and the actual apiserver REST caller compile against the existing v0.36.5 cohort. Streaming also resolves to v0.36.5. This does not advance the larger Kubernetes cohort or hide module identities; that work remains #7259 / #7492, and later apimachinery versions are not covered by this replacement.

At this head, the full Go suite, affected Flux/installer/vCluster/workload packages, configured lint, CLI build and all ten shipped Kubescape release-graph audits pass. Native CLI, desktop, vulnerability, managed analysis and provider checks remain gates; no readiness verdict is asserted while they run.

The CLI user trial at this exact built revision exported a HelmRepository-backed HelmRelease with its source namespace, version range, dependency and Secret values reference intact. An OCIRepository-backed HelmRelease also retained its chart reference and target-namespace creation settings. This trial rendered resources locally; it did not contact or mutate a cluster.

[github-code-quality]

Code Coverage Overview

Languages: Go

Go / code-coverage/go

The overall line coverage in commit 3755856 in the dependabot/go_module... branch remains at 71%, unchanged from commit 4dfe77d in the main branch.

Show a line coverage summary of the most impacted files.

File	main 4dfe77d	dependabot/go_module... 3755856	+/-
pkg/svc/mirror/keepalive.go	93%	89%	-4%
pkg/cli/cluster...i/distconfig.go	78%	81%	+3%
pkg/svc/provisi...base/bringup.go	90%	93%	+3%

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review skipped.

[coderabbitai]

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: dc6420ed-06ab-49af-a219-eafd28629e99

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 3755856

• CodeRabbit: the current-PR seat refusal, posted 2026-10-09T04:01:53Z after the exact-head full-review request, says the bot author has no assigned review seat. The command reply also says review skipped. The current-head guard finds no delivered review or finding. Recovery requires seat assignment; no purchase is authorized.
• Codex: the authenticated account code-review usage-limit notice, updated 2026-10-08T17:01:34Z, was freshly read. It requires account credits/settings action and states no reset. Fresh lane health still reports a usage limit at 2026-10-09T01:18:08Z, with no serving recovery. Complete current-PR surfaces contain no current-head Codex review or finding.
• Cursor Bugbot: the authenticated user/team usage-limit notice, updated 2026-10-08T15:43:03Z, was freshly read. It states no reset and requires account-admin action. Current-head Bugbot check-runs and current-PR surfaces contain no verdict or finding; no newer serving recovery was found. No paid usage is authorized.

Reviewed the complete three-file change against current main, the exact Flux metadata release comparison, and the resolved module graph. Flux metadata v1.32.0 retains the previous exported implementation. The replacement is qualified to apimachinery v0.37.0 and selects the genuine v0.36.5 source/checksum already used by the embedded Kubernetes callers; later versions cannot silently reuse it. The lint exception admits this specific documented replacement without disabling the linter. The larger Kubernetes/Talos cohort remains separately tracked.

The mixed-cohort compilation regression and the actual apiserver caller pass after the repair. Full local Go tests, lint, all ten shipped release-graph audits and exact-revision CLI resource exports pass. Native CLI/desktop, managed and owned analysis, vulnerability checks and all Docker system tests are now green at this same head. Reviewed all conversation comments, complete review objects and threads; no unresolved thread or non-thread finding remains.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 3755856c2a9421848b6059a72e488121bb63fafa: all reported native checks are complete and green, including managed/owned analysis, CLI/desktop builds, vulnerability checks, release-graph audits and all 27 Docker system tests. That run is successful and its head matches this PR. The real-provider matrix includes Flux configurations on Vanilla, K3s, VCluster, Talos and KWOK.

The exact-revision CLI user trial exports both HelmRepository- and OCIRepository-backed releases with source/target namespaces, version/dependency and values references preserved. Local full Go tests, lint, the mixed-cohort RED → GREEN compilation check and actual apiserver caller also pass. This evaluates the retained embedded Kubernetes behavior; it does not accept the larger cohort upgrade in #7259.

The current-head local fallback review is classified GREEN self@3755856c2a9421848b6059a72e488121bb63fafa. All three provider availability facts are recorded there with primary receipts. Complete thread/review surfaces have no unresolved finding. Required status/workflow checks pass; code_quality setup=configured remains API-unverified, while GitHub reports native merge state CLEAN. No check or rule is waived.

[devantler]

🤖 Generated by the Agentic Engineer

Post-merge user-path verification passed at dba170901fe548d017e1e1a80137ade698f965c0. A fresh Go 1.26.9 CLI build records that exact revision with vcs.modified=false and genuine Flux meta v1.32.0. The built CLI generated both HelmRepository-sourced and OCIRepository-referenced HelmRelease exports; assertions confirmed their Flux v2 API, source/reference type and chart identity. This supplements the exact-head green native checks and 27 successful Docker system tests recorded before the normal protected merge.