chore(deps): bump the go group with 2 updates

[dependabot]

Bumps the go group with 2 updates: github.com/fluxcd/source-controller/api and go.podman.io/image/v5.

Updates github.com/fluxcd/source-controller/api from 1.9.3 to 1.9.4

Release notes

Sourced from github.com/fluxcd/source-controller/api's releases.

v1.9.4

Changelog

v1.9.4 changelog

Container images

• docker.io/fluxcd/source-controller:v1.9.4
• ghcr.io/fluxcd/source-controller:v1.9.4

Supported architectures: linux/amd64, linux/arm64 and linux/arm/v7.

The container images are built on GitHub hosted runners and are signed with cosign and GitHub OIDC. To verify the images and their provenance (SLSA level 3), please see the security documentation.

Changelog

Sourced from github.com/fluxcd/source-controller/api's changelog.

1.9.4

Release date: 2026-08-07

This patch release aligns Helm repository index loading with upstream Helm v4 by skipping empty entries, improves the error handling in the Bucket reconciler for optional fields in Azure responses, resolves OCI Helm charts by digest so that verification and download operate on the same content, and limits GCS static authentication to secrets holding service account keys. It also updates the fluxcd/pkg dependencies, which align the ECR host detection with upstream.

Fixes:

• Align index loading with upstream Helm v4 #2121
• Improve error handling in Bucket reconciliation #2123
• Pin OCI chart verification by digest #2125
• Limit GCS static authentication to service account keys #2130

Improvements:

• Update fluxcd/pkg dependencies #2131

Commits

• 6b10a9e Merge pull request #2132 from fluxcd/release-v1.9.4
• 5e277c3 Release v1.9.4
• d687f6d Add changelog entry for v1.9.4
• 9dbb071 Merge pull request #2131 from fluxcd/update-pkg-deps/release/v1.9.x
• f20cec3 Update fluxcd/pkg dependencies
• aaae31a Merge pull request #2130 from fluxcd/backport-2126-to-release/v1.9.x
• 66b3951 fix: restrict GCS static auth to SA keys
• 6b6b3ee Merge pull request #2125 from fluxcd/backport-2124-to-release/v1.9.x
• 2a7329f fix: pin OCI chart verification by digest
• cd41ce8 Merge pull request #2123 from fluxcd/backport-2122-to-release/v1.9.x
• Additional commits viewable in compare view

Updates go.podman.io/image/v5 from 5.40.0 to 5.41.1

Commits

• 490df5a [podman-6.1] Bump c/image to 5.41.1
• eecee9c GetBlobAt supports mirror fallback infrastructure
• 750d63c docker: add blob-level mirror fallback in dockerImageSource
• 3b1057b Bump c/common to v0.69.0
• 08fd022 Bump c/storage 1.64.0, c/image 5.41.0 in c/common
• 4407c63 Bump c/image to v5.41.0
• 92a98f8 Vendor c/storage 1.64 into image and common
• 3aa788d Bump c/storage to v1.64.0
• e16e000 Merge pull request #1036 from Luap99/pasta
• 5b803a9 common/libnetwork: fix pesto port publish on connect
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions