Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update module helm.sh/helm/v3 to v3.14.2 [security] #25

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

plural-renovate[bot]
Copy link

@plural-renovate plural-renovate bot commented Feb 15, 2024

This PR contains the following updates:

Package Type Update Change
helm.sh/helm/v3 require minor v3.11.2 -> v3.14.2

GitHub Vulnerability Alerts

CVE-2024-25620

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Impact

When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name.

Patches

This issue has been resolved in Helm v3.14.1.

Workarounds

Check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Credits

Disclosed by Dominykas Blyžė at Nearform Ltd.

CVE-2024-26147

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Impact

When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm.

In the Helm SDK this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation.

Patches

This issue has been resolved in Helm v3.14.2.

Workarounds

If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.

If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.


Release Notes

helm/helm (helm.sh/helm/v3)

v3.14.2: Helm v3.14.2

Compare Source

Helm v3.14.2 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Jakub Ciolek with AlphaSense discovered the vulnerability.

Installation and Upgrading

Download Helm v3.14.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.3 will contain only bug fixes and be released on March 13, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

v3.14.1: Helm v3.14.1

Compare Source

Helm v3.14.1 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Dominykas Blyžė with Nearform Ltd. discovered the vulnerability.

Installation and Upgrading

Download Helm v3.14.1. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.2 will contain only bug fixes and be released on March 13, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

v3.14.0: Helm v3.14.0

Compare Source

Helm v3.14.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • New helm search flag of --fail-on-no-result
  • Allow a nested tpl invocation access to defines
  • Speed up the tpl function
  • Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate
  • Added --kube-version to lint command
  • The ignore pkg is now public

Installation and Upgrading

Download Helm v3.14.0. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.1 will contain only bug fixes and will be on February 14, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

Changelog

  • Improve release action 3fc9f4b (George Jenkins)
  • bump version to 69dcc92 (Matt Farina)
  • Fix issues when verify generation readiness was merged c042264 (Matt Farina)
  • fix test to use the default code's k8sVersionMinor 6e5332e (Joe Julian)
  • lint: Add --kube-version flag to set capabilities and deprecation rules 869c1d2 (Antoine Deschênes)
  • Update to Go 1.21 for builds 847369c (Matt Farina)
  • chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 08ea59c (dependabot[bot])
  • chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 30e1a2c (dependabot[bot])
  • Removing Asset Transparency 803cf2d (Matt Farina)
  • tests(pkg/engine): test RenderWithClientProvider a997de1 (Marcin Owsiany)
  • Make the ignore pkg public again 5586760 (Ismail Alidzhikov)
  • chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 b3cb20a (dependabot[bot])
  • Updating to Kubernetes 1.29.0 libraries e5fff68 (Matt Farina)
  • feature(pkg/engine): introduce RenderWithClientProvider bfec4ec (Marcin Owsiany)
  • chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 70c1519 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 be10183 (dependabot[bot])
  • Updating Helm libraries for k8s 1.28.4 015e174 (Matt Farina)
  • chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 2a211bf (dependabot[bot])
  • Remove excessive logging ce87ece (Sean Mills)
  • chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 3cb6b06 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 42c5af2 (dependabot[bot])
  • Update CONTRIBUTING.md 312a073 (lixin18)
  • Fixing release labelling in rollback 8814bfb (Marcin Chojnacki)
  • chore(deps): bump github.com/docker/docker c54e39a (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 d6e9197 (dependabot[bot])
  • feat: move livenessProbe and readinessProbe values to default values file 9f0313e (Denis Policastro)
  • Revert "fix(main): fix basic auth for helm pull or push" 24e2864 (Matt Farina)
  • chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 c5fe7dd (dependabot[bot])
  • Revert "fix(registry): address anonymous pull issue" 992dc58 (Matt Farina)
  • Update get-helm-3 81362d9 (Marcel Humburg)
  • chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 6d1f6cd (dependabot[bot])
  • chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 372ccca (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 a1a21ae (dependabot[bot])
  • Drop filterSystemLabels usage from Query method 250f0bd (Dmitry Chepurovskiy)
  • Apply review suggestions 0ec47f8 (Dmitry Chepurovskiy)
  • Update get-helm-3 to get version through get.helm.sh f94e5db (Ian Zink)
  • feat: print failed hook name b0d1637 (Serge Logvinov)
  • chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 544cabb (dependabot[bot])
  • Fixing precedence issue with the import of values. 25371e2 (Matt Farina)
  • chore(create): indent to spaces 919bffe (genofire)
  • Allow using label selectors for system labels for sql backend. e6d9b99 (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for secrets and configmap backends. e219c75 (Dmitry Chepurovskiy)
  • remove useless print during prepareUpgrade f004d42 (b4nks)
  • Add missing with clause to release gh action 9d3d17a (Ian Zink)
  • FIX Default ServiceAccount yaml 828763e (Lars Zimmermann)
  • fix(registry): address anonymous pull issue fe4c01f (Hidde Beydals)
  • fix(registry): unswallow error da3c666 (Hidde Beydals)
  • Fix missing run statement on release action 21ea847 (Ian Zink)
  • Add qps/HELM_QPS parameter 415af5b (Andy Smith)
  • chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 102e931 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 2505592 (dependabot[bot])
  • bump version to v3.13.0 c372b15 (Matt Farina)
  • chore(deps): bump github.com/evanphx/json-patch 8b0a78c (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 58ccfc0 (dependabot[bot])
  • Write latest version to get.helm.sh bucket 0619d08 (Ian Zink)
  • Increased release information key name max length. 4199be8 (abrarcv170)
  • Pin gox to specific commit 0403305 (Antony Chazapis)
  • Remove GoFish from package managers for installing the binary a9377f9 (y-yagi)
  • Test update for "Allow a nested tpl invocation access to defines in a containing one" b261a1b (Graham Reed)
  • Test update for "Speed up tpl" 36d417d (Graham Reed)
  • addressing comment 1a3e9a9 (Stefan McShane)
  • Add support for RISC-V 786707c (Antony Chazapis)
  • lint and validate dependency metadata to reference dependencies with a unique key (name or alias) 6a4035a (Daniel Strobusch)
  • Work around template.Clone omitting options 95905f1 (Graham Reed)
  • fix: pass 'passCredentialsAll' as env-var to getter fa067ec (Mathias Neerup)
  • feat: pass basic auth to env-vars when running download plugins f28447c (Mathias Neerup)
  • helm search: New CLI Flag --fail-on-no-result b9cece6 (Bhargav Ravuri)
  • Update pkg/kube/ready.go 141fa4a (muang0)
  • Update pkg/kube/ready.go 4cb62d1 (muang0)
  • Update pkg/kube/ready.go dbb21fc (muang0)
  • Update pkg/kube/ready.go fcc0332 (muang0)
  • Update pkg/kube/ready.go a1a1aaf (muang0)
  • fix post install hook deletion due to before-hook-creation policy fa025fc (zak905)
  • Allow a nested tpl invocation access to defines in a containing one a7d3fd6 (Graham Reed)
  • Remove the 'reference templates' concept e2a7c79 (Graham Reed)
  • Speed up tpl db4f330 (Graham Reed)
  • ready checker- comment update Signed-off-by: James Oden [email protected] d008340 (James Oden)
  • ready checker- remove duplicate statefulset generational check Signed-off-by: James Oden [email protected] 4f99c86 (James Oden)
  • Verify generation in readiness checks d94c509 (James Oden)
  • feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' a9d59f9 (Quentin Devos)

v3.13.3: Helm v3.13.3

Compare Source

Helm v3.13.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.3. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • Updating Helm libraries for k8s 1.28.4 c8b9489 (Matt Farina)
  • Remove excessive logging 2f03d01 (Sean Mills)
  • chore(create): indent to spaces 2e63576 (genofire)

v3.13.2: Helm v3.13.2

Compare Source

Helm v3.13.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.3 is a patch release and will be on December 13, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 2a2fb3b (dependabot[bot])
  • Update get-helm-3 8f554be (Marcel Humburg)
  • chore(deps): bump github.com/docker/docker 00a334c (dependabot[bot])
  • Fixing release labelling in rollback 12826e8 (Marcin Chojnacki)
  • Drop filterSystemLabels usage from Query method 666b199 (Dmitry Chepurovskiy)
  • Apply review suggestions 7e0084a (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for sql backend. 10018ff (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for secrets and configmap backends. 3b4cacf (Dmitry Chepurovskiy)
  • Revert "fix(main): fix basic auth for helm pull or push" e785e6c (Matt Farina)
  • Revert "fix(registry): address anonymous pull issue" 268dced (Matt Farina)
  • chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 99ce118 (dependabot[bot])
  • Update get-helm-3 to get version through get.helm.sh 28f208c (Ian Zink)

v3.13.1: Helm v3.13.1

Compare Source

Helm v3.13.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.1. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.2 is a patch release and will be on November 08, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • Fixing precedence issue with the import of values. 3547a4b (Matt Farina)
  • Add missing with clause to release gh action 6f9ad87 (Ian Zink)
  • FIX Default ServiceAccount yaml bae7b32 (Lars Zimmermann)
  • fix(registry): unswallow error 06e4fb1 (Hidde Beydals)
  • remove useless print during prepareUpgrade 0e7ec78 (b4nks)
  • fix(registry): address anonymous pull issue 0ac7894 (Hidde Beydals)
  • Fix missing run statement on release action 0901269 (Ian Zink)
  • Write latest version to get.helm.sh bucket 6101393 (Ian Zink)
  • chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 c99a8ac (dependabot[bot])
  • Increased release information key name max length. 52a029d (abrarcv170)
  • chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 ff8e61d (dependabot[bot])

v3.13.0: Helm v3.13.0

Compare Source

Helm v3.13.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • The --dry-run flag now has multiple options which can enable Helm to connect to a Kubernetes instance. The default, when --dry-run is used, is unchanged.
  • Values handling had numerous issues fixed and now consistently has a priority of (1) User specified values (e.g CLI), (2) parent chart values, (3) imported values, and (4) subchart values. Additionally, null can now consistently be used to remove values. Note, there is a regression around this in 3.13.0 that's fixed in 3.13.1.
  • Can work with OCI registries over HTTP using the --plain-http flag
  • Helm now adds the OCI creation annotation
  • New helm get metadata command
  • The SQL driver now only needs write on the first run or when the schema is updated
  • Added labels support for install and upgrade commands
  • The ability to have index.yaml holding JSON content instead of YAML using the --json flag when creating it. JSON is faster to parse and uses less memory which impacts larger files. This is backwards compatible as Helm, all the way back to 3.0.0, parsing can handle JSON content in the index.yaml file.

Installation and Upgrading

Download Helm v3.13.0. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.1 is the next bug fix release and will be on October 11, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • bump version to v3.13.0 825e86f (Matt Farina)
  • Fix leaking goroutines in Install 169561a (Michał Słapek)
  • chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 417040d (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 610217f (dependabot[bot])
  • Update Helm to use k8s 1.28.2 libraries c2ab954 (Matt Farina)
  • chore(deps): bump github.com/cyphar/filepath-securejoin b9fd7f5 (dependabot[bot])
  • make the dependabot k8s.io group explicit ca3a05e (Joe Julian)
  • use dependabot's group support for k8s.io dependencies 04ec71a (Joe Julian)
  • chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action ebb3168 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 fa45978 (dependabot[bot])
  • doc:Executing helm rollback release 0 will roll back to the previous release e01731d (ithrael)
  • fix conflict 4944acb (Maxim Trofimov)
  • add big tests 6138e10 (Maxim Trofimov)
  • fix conflict 199784f (Maxim Trofimov)
  • fix b786cb4 (Maxim Trofimov)
  • add check if all migrations already applied df5904d (Maxim Trofimov)
  • chore(deps): bump github.com/moby/term fa89665 (dependabot[bot])
  • chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 4283b2c (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 d82cc90 (dependabot[bot])
  • Use labels instead of selectorLabels for pod labels 479be0c (Tim Chaplin)
  • fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook 4e5e68d (Bingtan Lu)
  • chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 3c26d65 (dependabot[bot])
  • remove blank ee1cbed (ithrael)
  • add blank 0eb3df6 (ithrael)
  • add rollback unit test 0688046 (ithrael)
  • fix: helm rollback err tips db9460c (ithrael)
  • chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 817e646 (dependabot[bot])
  • Add Ian Zink (z4ce) as triage maintainer 758dc01 (Ian Zink)
  • chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 04850dc (dependabot[bot])
  • chore: HTTPGetter add default timeout 2011a31 (0xff-dev)
  • fix: precedence typo bf543d9 (guoguangwu)
  • Avoid nil dereference if passing a nil resolver 3607cd7 (Antonio Gamez Diaz)
  • Add required changes after merge 197d1de (Antonio Gamez Diaz)
  • goimports 5b08985 (satoru)
  • Fix #​3352, add support for --ignore-not-found just like kubectl delete 48dbda2 (suzaku)
  • chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 aab4c45 (dependabot[bot])
  • chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 c3a4122 (dependabot[bot])
  • Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject 5c7a631 (MR ZHAO)
  • Restore helm get metadata command 0b5e9d3 (Mikhail Kopylov)
  • Revert "Add helm get metadata command" e8e6da2 (Joe Julian)
  • Update pkg/action/install.go 735ff8f (Dmitry Chepurovskiy)
  • test: replace ensure.TempDir with t.TempDir 2ceebff (Eng Zer Jun)
  • chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 95ba0c6 (dependabot[bot])
  • use json api url + report curl/wget error on fail 9d038a2 (shoce)
  • Added error in case try to supply custom label with name of system label during install/upgrade 7b13ac9 (Dmitry Chepurovskiy)
  • Updated per feedback from gjenkins8 e8a748d (Matt Farina)
  • fix(main): fix basic auth for helm pull or push 4a27baa (cuisongliu)
  • chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 48cf02b (dependabot[bot])
  • cmd: support generating index in JSON format 2544aa2 (Hidde Beydals)
  • repo: detect JSON and unmarshal efficiently e21c9cf (Hidde Beydals)
  • Tweaking new dry-run internal handling 96e33e2 (Matt Farina)
  • chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 2e22395 (dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 7d0deb3 (dependabot[bot])
  • chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 f11e2da (dependabot[bot])
  • chore(deps): bump github.com/opencontainers/image-spec ef0f3e5 (dependabot[bot])
  • bump kubernetes modules to v0.27.3 9c4f733 (Joe Julian)
  • chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 f9e5db3 (dependabot[bot])
  • chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 6e2bddd (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 31e9e54 (dependabot[bot])
  • chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 87cbd34 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 91a3f73 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 0ff4b74 (dependabot[bot])
  • chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 b1fe927 (dependabot[bot])
  • chore(deps): bump github.com/docker/docker b262738 (dependabot[bot])
  • Remove warning for template directory not found. 9dab6e9 (James Blair)
  • Add gjenkins8 as triage maintainer 5840269 (George Jenkins)
  • Added tests for created OCI annotation time format d72b42d (Andrew Block)
  • Add created OCI annotation c4870d9 (Andrew Block)
  • Fix multiple bugs in values handling 0a5148f (Matt Farina)
  • chore: fix a typo in manager.go 15e6066 (Yarden Shoham)
  • chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 d0febd5 (dependabot[bot])
  • add GetRegistryClient method c87f846 (wujunwei)
  • chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 d8caa67 (dependabot[bot])
  • oci: add tests for plain HTTP and insecure HTTPS registries 6defb96 (Sanskar Jaiswal)
  • chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 2bfc367 (dependabot[bot])
  • oci: Add flag --plain-http to enable working with HTTP registries 2538b92 (Sanskar Jaiswal)
  • docs: add an example for using the upgrade command with existing values e35bf1f (Jose Diaz-Gonzalez)
  • Replace fmt.Fprintf with fmt.Fprint in get_metadata.go 587c85f (Mikhail Kopylov)
  • Replace fmt.Fprintln with fmt.Fprintf in get_metadata.go 5eb1e9d (Mikhail Kopylov)
  • update kubernetes dependencies from v0.27.0 to v0.27.1 54ca3a8 (Joe Julian)
  • Add ClientOptResolver to test util file 770c51e (Antonio Gamez Diaz)
  • Check that missing keys are still handled in tpl f235f0f (Graham Reed)
  • chore(deps): bump github.com/docker/distribution 36dee32 (dependabot[bot])
  • tests: change crd golden file to match after #​11870 [126e4f4](https://togithub.com/helm/helm/commit/126e

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@plural-renovate plural-renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch 2 times, most recently from 024ca18 to 4434f4e Compare February 22, 2024 21:26
@plural-renovate plural-renovate bot changed the title fix(deps): update module helm.sh/helm/v3 to v3.14.1 [security] fix(deps): update module helm.sh/helm/v3 to v3.14.2 [security] Feb 22, 2024
@plural-renovate plural-renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from 4434f4e to 0ff2b43 Compare April 26, 2024 07:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants