Skip to content

Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] - #185

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-helm.sh-helm-v3-vulnerability
Open

Update module helm.sh/helm/v3 to v3.20.2 [SECURITY]#185
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-helm.sh-helm-v3-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 6, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
helm.sh/helm/v3 v3.13.2 → v3.20.2 age confidence

Helm dependency management path traversal

CVE-2024-25620 / GHSA-v53g-5gjp-272r

More information

Details

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Impact

When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name.

Patches

This issue has been resolved in Helm v3.14.1.

Workarounds

Check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Credits

Disclosed by Dominykas Blyžė at Nearform Ltd.

Severity

  • CVSS Score: 6.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Helm's Missing YAML Content Leads To Panic

CVE-2024-26147 / GHSA-r53h-jv2g-vpx6

More information

Details

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Impact

When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm.

In the Helm SDK this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation.

Patches

This issue has been resolved in Helm v3.14.2.

Workarounds

If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.

If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

CVE-2025-32386 / GHSA-4hfp-h4cw-hj8p

More information

Details

A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

CVE-2025-32387 / GHSA-5xqw-8hwv-wg92

More information

Details

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.

Impact

A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Helm vulnerable to Code Injection through malicious chart.yaml content

CVE-2025-53547 / GHSA-557j-xg8c-q2mm

More information

Details

A Helm contributor discovered that a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated.

Impact

Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.

This affects when dependencies are updated. When using the helm command this happens when helm dependency update is run. helm dependency build can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader Manager performs an update.

Patches

This issue has been resolved in Helm v3.18.4

Workarounds

Ensure the Chart.lock file in a chart is not a symlink prior to updating dependencies.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

CVE-2025-55199 / GHSA-9h84-qmv7-982p

More information

Details

A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A malicious chart can point $ref in values.schema.json to a device (e.g. /dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of $ref pointing to /dev/zero.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Helm May Panic Due To Incorrect YAML Content

CVE-2025-55198 / GHSA-f9f8-9pmf-xv68

More information

Details

A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.

Impact

There are two areas of YAML validation that were impacted. First, when a Chart.yaml file had a null maintainer or the child or parent of a dependencies import-values could be parsed as something other than a string, helm lint would panic. Second, when an index.yaml had an empty entry in the list of chart versions Helm would panic on interactions with that repository.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Ensure YAML files are formatted as Helm expects prior to processing them with Helm.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

CVE-2026-35206 / GHSA-hr2v-4r36-88hr

More information

Details

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name.

Impact

The bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory <output dir>/, instead of the expected <output dir>/<chart name>/, potentially overwriting the contents of the targeted directory.

Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed.

Patches

This issue has been resolved in Helm v3.20.2 and v4.1.3

A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected.

Workarounds

Ensure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the pull --untar flag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory.

Credits

Oleh Konko
@​1seal

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

helm/helm (helm.sh/helm/v3)

v3.20.2: Helm v3.20.2

Compare Source

v3.20.2

Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

Installation and Upgrading

Download Helm v3.20.2. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Chart dot-name path bug 8fb76d6 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e (Terry Howe)

v3.20.1: Helm v3.20.1

Compare Source

Helm v3.20.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Backport of #​31644: Fixed a bug where user-provided nil value was not preserved when chart has an empty map or no default for a key
  • Backport of #​31601: Fixed a bug where OCI references with tag+digest failed with "invalid byte" error

Installation and Upgrading

Download Helm v3.20.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.0 and 3.21.0 are the next minor releases and will be on May 13, 2026
  • 4.1.4 and 3.20.2 are the next patch releases and will be on April 8, 2026

Changelog

  • chore(deps): bump the k8s-io group with 7 updates a2369ca (dependabot[bot])
  • add image index test 90e1056 (Pedro Tôrres)
  • fix pulling charts from OCI indices 911f2e9 (Pedro Tôrres)
  • Remove refactorring changes from coalesce_test.go 76dad33 (Evans Mungai)
  • Fix import 45c12f7 (Evans Mungai)
  • Update pkg/chart/common/util/coalesce_test.go 26c6f19 (Evans Mungai)
  • Fix lint warning 09f5129 (Evans Mungai)
  • Preserve nil values in chart already 417deb2 (Evans Mungai)
  • fix(values): preserve nil values when chart default is empty map 5417bfa (Evans Mungai)

v3.20.0: Helm v3.20.0

Compare Source

Helm v3.20.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • SDK: bump k8s API versions to v0.35.0
  • v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #​12564
  • v3 backport: Bump Go version to v1.25

Installation and Upgrading

Download Helm v3.20.0. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.1 and 3.20.1 are the next patch releases, scheduled for March 11, 2026
  • 4.2.0 and 3.21.0 are the next minor releases, scheduled for May 13, 2026

Changelog

  • bump version to v3.20 f6e17f6 (Scott Rigby)
  • chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 4f5a655 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 65c504a (dependabot[bot])
  • chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0 f3b8af4 (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates 89c2c61 (dependabot[bot])
  • [dev-v3] Replace deprecated NewSimpleClientset 526076e (George Jenkins)
  • [dev-v3] Bump Go v1.25, golangci-lint v2 0ae8e4f (George Jenkins)
  • chore(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0 e0d2595 (dependabot[bot])
  • chore(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.30 858acb1 (dependabot[bot])
  • fix(rollback): errors.Is instead of string comp 0cd9a60 (Hidde Beydals)
  • fix(uninstall): supersede deployed releases 8bb0b37 (Hidde Beydals)
  • Use latest patch release of Go in releases 930ba6f (Matt Farina)
  • chore(deps): bump the k8s-io group with 7 updates 582211c (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 585c25c (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0 6f17d46 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 46ff427 (dependabot[bot])
  • chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 28b813a (dependabot[bot])
  • chore(deps): bump github.com/rubenv/sql-migrate from 1.8.0 to 1.8.1 5dde5d6 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 362900b (dependabot[bot])
  • chore(deps): bump github.com/cyphar/filepath-securejoin ec61de5 (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates a490607 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.30.0 to 0.31.0 8509bcc (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 d495a94 (dependabot[bot])
  • Remove dev-v3 helm-latest-version publish 01dc6cc (George Jenkins)
  • chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 6647f84 (dependabot[bot])
  • chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 b548118 (dependabot[bot])
  • Revert "pkg/registry: Login option for passing TLS config in memory" 6a67b55 (Scott Rigby)
  • chore(deps): bump github.com/cyphar/filepath-securejoin 6d4f8c0 (dependabot[bot])
  • jsonschema: warn and ignore unresolved URN $ref to match v3.18.4 3f0da15 (Benoit Tigeot)
  • Fix helm pull untar dir check with repo urls e5e101c (Luna Stadler)
  • chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 6aae923 (dependabot[bot])
  • chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 1900c6a (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0 43e9297 (dependabot[bot])
  • chore(deps): bump github.com/cyphar/filepath-securejoin d347e2b (dependabot[bot])
  • [backport] fix: get-helm-3 script use helm3-latest-version bd337b4 (George Jenkins)
  • pkg/registry: Login option for passing TLS config in memory b80959f (Matheus Pimenta)
  • chore(deps): bump the k8s-io group with 7 updates 1ac9d34 (dependabot[bot])
  • Fix deprecation warning 9a366b4 (Benoit Tigeot)
  • chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0 0c5a17e (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0 b999021 (dependabot[bot])
  • Avoid "panic: interface conversion: interface {} is nil" 2fe49f9 (Benoit Tigeot)
  • bump version to v3.19.0 c3610ab (Scott Rigby)
  • chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10 73b449f (dependabot[bot])
  • fix: set repo authorizer in registry.Client.Resolve() ffbc537 (Eric Stroczynski)
  • fix null merge f0b699e (Ben Foster)
  • Add timeout flag to repo add and update flags 79a9cc5 (Reinhard Nägele)

v3.19.5: Helm v3.19.5

Compare Source

Helm v3.19.5 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Notable Changes
  • Fixed bug where removing subchart value via override resulted in warning #​31118
  • Fixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #​12556
Installation and Upgrading

Download Helm v3.19.5. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.1.0 and 3.20.0 is the next minor releases and will be on January 21, 2026
  • 4.1.1 and 3.20.1 are the next patch releases and will be on March 11, 2026
Changelog
  • fix(rollback): errors.Is instead of string comp 4a19a5b (Hidde Beydals)
  • fix(uninstall): supersede deployed releases 7a00235 (Hidde Beydals)
  • fix null merge 578564e (Ben Foster)

v3.19.4: Helm v3.19.4

Compare Source

Helm v3.19.4 is a security fix for a Go CVE in the previous tag. This patch release rebuilds the Helm v3.19.3 release with the latest Go toolchain, to fix the Go CVE. Users are encouraged to upgrade.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.19.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.19.5 and 4.0.4 are the next patch releases and will be on January 14, 2026
  • 3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026

Changelog

  • Use latest patch release of Go in releases 7cfb6e4 (Matt Farina)
  • chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 59c951f (dependabot[bot])
  • chore(deps): bump github.com/cyphar/filepath-securejoin d45f3f1 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 d459544 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 becd387 (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates edb1579 (dependabot[bot])

v3.19.3

Compare Source

v3.19.2: Helm v3.19.2

Compare Source

Helm v3.19.2 is a patch release. It is a rebuild of the v3.19.1 release with no code changes.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.19.2. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.19.3 and 4.0.1 are the next patch releases and will be on December 10, 2025
  • 3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026

Changelog

  • [backport] fix: get-helm-3 script use helm3-latest-version 8766e71 (George Jenkins)

v3.19.1: Helm v3.19.1

Compare Source

Helm v3.19.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.19.1. The common platform binaries are here:

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 6, 2024 08:51
@renovate

renovate Bot commented Aug 6, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 80 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.21 -> 1.24.0
github.com/google/uuid v1.4.0 -> v1.6.0
github.com/spf13/cobra v1.8.0 -> v1.9.1
github.com/spf13/pflag v1.0.5 -> v1.0.7
github.com/stretchr/testify v1.8.4 -> v1.10.0
go.uber.org/zap v1.26.0 -> v1.27.0
k8s.io/apimachinery v0.28.2 -> v0.33.3
k8s.io/cli-runtime v0.28.2 -> v0.33.3
k8s.io/client-go v0.28.2 -> v0.33.3
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 -> v0.0.0-20250102033503-faa5f7b0171c
github.com/BurntSushi/toml v1.3.2 -> v1.5.0
github.com/Masterminds/semver/v3 v3.2.1 -> v3.3.0
github.com/Masterminds/sprig/v3 v3.2.3 -> v3.3.0
github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535 -> v0.0.0-20230301143203-a9d515a09cc2
github.com/cespare/xxhash/v2 v2.2.0 -> v2.3.0
github.com/containerd/containerd v1.7.7 -> v1.7.27
github.com/cyphar/filepath-securejoin v0.2.4 -> v0.4.1
github.com/docker/docker-credential-helpers v0.7.0 -> v0.8.2
github.com/emicklei/go-restful/v3 v3.10.1 -> v3.11.0
github.com/evanphx/json-patch v5.6.0+incompatible -> v5.9.11+incompatible
github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d -> v0.0.0-20210407135951-1de76d718b3f
github.com/go-logr/logr v1.3.0 -> v1.4.2
github.com/go-openapi/jsonpointer v0.19.6 -> v0.21.0
github.com/go-openapi/swag v0.22.3 -> v0.23.0
github.com/golang/protobuf v1.5.3 -> v1.5.4
github.com/google/btree v1.0.1 -> v1.1.3
github.com/google/go-cmp v0.6.0 -> v0.7.0
github.com/gorilla/mux v1.8.0 -> v1.8.1
github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 -> v0.0.0-20190611155906-901d90724c79
github.com/huandu/xstrings v1.4.0 -> v1.5.0
github.com/jmoiron/sqlx v1.3.5 -> v1.4.0
github.com/klauspost/compress v1.17.3 -> v1.18.0
github.com/moby/spdystream v0.2.0 -> v0.5.0
github.com/moby/term v0.5.0 -> v0.5.2
github.com/opencontainers/image-spec v1.1.0-rc5 -> v1.1.1
github.com/prometheus/client_golang v1.17.0 -> v1.22.0
github.com/prometheus/client_model v0.5.0 -> v0.6.1
github.com/prometheus/common v0.45.0 -> v0.62.0
github.com/prometheus/procfs v0.12.0 -> v0.15.1
github.com/rubenv/sql-migrate v1.5.2 -> v1.8.0
github.com/shopspring/decimal v1.3.1 -> v1.4.0
github.com/spf13/cast v1.5.1 -> v1.7.0
golang.org/x/crypto v0.15.0 -> v0.40.0
golang.org/x/net v0.18.0 -> v0.41.0
golang.org/x/oauth2 v0.13.0 -> v0.28.0
golang.org/x/sync v0.5.0 -> v0.16.0
golang.org/x/sys v0.14.0 -> v0.34.0
golang.org/x/term v0.14.0 -> v0.33.0
golang.org/x/text v0.14.0 -> v0.27.0
golang.org/x/time v0.4.0 -> v0.9.0
google.golang.org/grpc v1.59.0 -> v1.68.1
google.golang.org/protobuf v1.31.0 -> v1.36.5
k8s.io/api v0.28.2 -> v0.33.3
k8s.io/apiextensions-apiserver v0.28.2 -> v0.33.3
k8s.io/apiserver v0.28.2 -> v0.33.3
k8s.io/component-base v0.28.2 -> v0.33.3
k8s.io/klog/v2 v2.100.1 -> v2.130.1
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 -> v0.0.0-20250318190949-c8a335a9a2ff
k8s.io/kubectl v0.28.2 -> v0.33.3
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 -> v0.0.0-20241104100929-3ea5e8cea738
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd -> v0.0.0-20241010143419-9aa6b5e7a4b3
sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 -> v0.19.0
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 -> v0.19.0
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 -> v4.6.0
sigs.k8s.io/yaml v1.3.0 -> v1.5.0
golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa -> v0.0.0-20240719175910-8a7402abbf56
github.com/Microsoft/hcsshim v0.11.1 -> v0.11.7
github.com/cenkalti/backoff/v4 v4.2.1 -> v4.3.0
github.com/go-sql-driver/mysql v1.7.1 -> v1.8.1
github.com/google/gnostic-models v0.6.8 -> v0.6.9
github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 -> v2.24.0
github.com/stretchr/objx v0.5.0 -> v0.5.2
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 -> v1.33.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 -> v1.33.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 -> v1.32.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0 -> v1.32.0
go.opentelemetry.io/otel/sdk v1.21.0 -> v1.33.0
go.opentelemetry.io/proto/otlp v1.0.0 -> v1.4.0
go.opentelemetry.io/otel v1.21.0 -> v1.33.0
go.opentelemetry.io/otel/metric v1.21.0 -> v1.33.0
go.opentelemetry.io/otel/trace v1.21.0 -> v1.33.0

@renovate
renovate Bot requested a review from a team as a code owner August 6, 2024 08:51
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 50d505e to 907bfe5 Compare April 10, 2025 13:51
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.14.2 [SECURITY] Update module helm.sh/helm/v3 to v3.17.3 [SECURITY] Apr 10, 2025
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 907bfe5 to 701f936 Compare May 7, 2025 11:05
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 701f936 to c3e57e7 Compare July 8, 2025 23:24
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.17.3 [SECURITY] Update module helm.sh/helm/v3 to v3.18.4 [SECURITY] Jul 8, 2025
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from c3e57e7 to f31a23f Compare July 16, 2025 21:32
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.4 [SECURITY] Update module helm.sh/helm/v3 to v3.17.4 [SECURITY] Jul 16, 2025
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 2 times, most recently from baa1a10 to de06afa Compare August 14, 2025 17:17
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.17.4 [SECURITY] Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Aug 14, 2025
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] - autoclosed Sep 10, 2025
@renovate renovate Bot closed this Sep 10, 2025
@renovate
renovate Bot deleted the renovate/go-helm.sh-helm-v3-vulnerability branch September 10, 2025 02:51
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] - autoclosed Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Sep 10, 2025
@renovate renovate Bot reopened this Sep 10, 2025
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from c0a8c47 to de06afa Compare September 10, 2025 06:38
@renovate

renovate Bot commented Dec 15, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 82 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.21 -> 1.25.0
github.com/google/uuid v1.4.0 -> v1.6.0
github.com/spf13/cobra v1.8.0 -> v1.10.2
github.com/spf13/pflag v1.0.5 -> v1.0.10
github.com/stretchr/testify v1.8.4 -> v1.11.1
go.uber.org/zap v1.26.0 -> v1.27.0
k8s.io/apimachinery v0.28.2 -> v0.35.1
k8s.io/cli-runtime v0.28.2 -> v0.35.1
k8s.io/client-go v0.28.2 -> v0.35.1
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 -> v0.0.0-20250102033503-faa5f7b0171c
github.com/BurntSushi/toml v1.3.2 -> v1.6.0
github.com/Masterminds/semver/v3 v3.2.1 -> v3.4.0
github.com/Masterminds/sprig/v3 v3.2.3 -> v3.3.0
github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535 -> v0.0.0-20230301143203-a9d515a09cc2
github.com/cespare/xxhash/v2 v2.2.0 -> v2.3.0
github.com/containerd/containerd v1.7.7 -> v1.7.30
github.com/cyphar/filepath-securejoin v0.2.4 -> v0.6.1
github.com/docker/docker-credential-helpers v0.7.0 -> v0.8.2
github.com/emicklei/go-restful/v3 v3.10.1 -> v3.12.2
github.com/evanphx/json-patch v5.6.0+incompatible -> v5.9.11+incompatible
github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d -> v0.0.0-20210407135951-1de76d718b3f
github.com/fsnotify/fsnotify v1.7.0 -> v1.9.0
github.com/go-logr/logr v1.3.0 -> v1.4.3
github.com/go-openapi/jsonpointer v0.19.6 -> v0.21.0
github.com/go-openapi/swag v0.22.3 -> v0.23.0
github.com/golang/protobuf v1.5.3 -> v1.5.4
github.com/google/btree v1.0.1 -> v1.1.3
github.com/google/go-cmp v0.6.0 -> v0.7.0
github.com/gorilla/mux v1.8.0 -> v1.8.1
github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 -> v0.0.0-20190611155906-901d90724c79
github.com/huandu/xstrings v1.4.0 -> v1.5.0
github.com/jmoiron/sqlx v1.3.5 -> v1.4.0
github.com/klauspost/compress v1.17.3 -> v1.18.0
github.com/moby/spdystream v0.2.0 -> v0.5.0
github.com/moby/term v0.5.0 -> v0.5.2
github.com/modern-go/reflect2 v1.0.2 -> v1.0.3-0.20250322232337-35a7c28c31ee
github.com/opencontainers/image-spec v1.1.0-rc5 -> v1.1.1
github.com/prometheus/client_golang v1.17.0 -> v1.23.2
github.com/prometheus/client_model v0.5.0 -> v0.6.2
github.com/prometheus/common v0.45.0 -> v0.66.1
github.com/prometheus/procfs v0.12.0 -> v0.16.1
github.com/rubenv/sql-migrate v1.5.2 -> v1.8.1
github.com/shopspring/decimal v1.3.1 -> v1.4.0
github.com/spf13/cast v1.5.1 -> v1.7.0
golang.org/x/crypto v0.15.0 -> v0.46.0
golang.org/x/net v0.18.0 -> v0.48.0
golang.org/x/oauth2 v0.13.0 -> v0.30.0
golang.org/x/sync v0.5.0 -> v0.19.0
golang.org/x/sys v0.14.0 -> v0.40.0
golang.org/x/term v0.14.0 -> v0.39.0
golang.org/x/text v0.14.0 -> v0.33.0
golang.org/x/time v0.4.0 -> v0.12.0
google.golang.org/grpc v1.59.0 -> v1.72.2
google.golang.org/protobuf v1.31.0 -> v1.36.8
k8s.io/api v0.28.2 -> v0.35.1
k8s.io/apiextensions-apiserver v0.28.2 -> v0.35.1
k8s.io/apiserver v0.28.2 -> v0.35.1
k8s.io/component-base v0.28.2 -> v0.35.1
k8s.io/klog/v2 v2.100.1 -> v2.130.1
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 -> v0.0.0-20250910181357-589584f1c912
k8s.io/kubectl v0.28.2 -> v0.35.1
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 -> v0.0.0-20251002143259-bc988d571ff4
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd -> v0.0.0-20250730193827-2d320260d730
sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 -> v0.20.1
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 -> v0.20.1
sigs.k8s.io/yaml v1.3.0 -> v1.6.0
golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa -> v0.0.0-20240719175910-8a7402abbf56
github.com/Microsoft/hcsshim v0.11.1 -> v0.11.7
github.com/cenkalti/backoff/v4 v4.2.1 -> v4.3.0
github.com/go-sql-driver/mysql v1.7.1 -> v1.8.1
github.com/google/gnostic-models v0.6.8 -> v0.7.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.1 -> v2.26.3
github.com/stretchr/objx v0.5.0 -> v0.5.2
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 -> v1.34.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 -> v1.34.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 -> v1.32.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0 -> v1.32.0
go.opentelemetry.io/otel/sdk v1.21.0 -> v1.36.0
go.opentelemetry.io/proto/otlp v1.0.0 -> v1.5.0
github.com/golang-jwt/jwt/v5 v5.1.0 -> v5.2.2
go.opentelemetry.io/otel v1.21.0 -> v1.36.0
go.opentelemetry.io/otel/metric v1.21.0 -> v1.36.0
go.opentelemetry.io/otel/trace v1.21.0 -> v1.36.0

@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] - autoclosed Mar 5, 2026
@renovate renovate Bot closed this Mar 5, 2026
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] - autoclosed Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Mar 5, 2026
@renovate renovate Bot reopened this Mar 5, 2026
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 2 times, most recently from de06afa to f8fe8e0 Compare March 5, 2026 08:52
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] - autoclosed Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 2 times, most recently from f8fe8e0 to 2239ca9 Compare March 30, 2026 22:05
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 2239ca9 to cbb266f Compare April 10, 2026 17:30
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.18.5 [SECURITY] Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] Apr 10, 2026
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] - autoclosed Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 2 times, most recently from cbb266f to 8a4a4f8 Compare April 27, 2026 21:43
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] - autoclosed Aug 29, 2026
@renovate renovate Bot closed this Aug 29, 2026
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] - autoclosed Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] Aug 29, 2026
@renovate renovate Bot reopened this Aug 29, 2026
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 2 times, most recently from 8a4a4f8 to ba62c8b Compare August 29, 2026 08:56
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] - autoclosed Sep 2, 2026
@renovate renovate Bot closed this Sep 2, 2026
@renovate renovate Bot changed the title Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] - autoclosed Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] Sep 3, 2026
@renovate renovate Bot reopened this Sep 3, 2026
@renovate
renovate Bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from ba62c8b to 3fea94b Compare September 3, 2026 03:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants