Skip to content

fix(deps): update module helm.sh/helm/v3 to v3.18.5 [security] #5403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update module helm.sh/helm/v3 to v3.18.5 [security] #5403

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jul 9, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
helm.sh/helm/v3 v3.17.3 -> v3.18.5 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-53547

A Helm contributor discovered that a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated.

Impact

Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.

This affects when dependencies are updated. When using the helm command this happens when helm dependency update is run. helm dependency build can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader Manager performs an update.

Patches

This issue has been resolved in Helm v3.18.4

Workarounds

Ensure the Chart.lock file in a chart is not a symlink prior to updating dependencies.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

CVE-2025-55199

A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A malicious chart can point $ref in values.schema.json to a device (e.g. /dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of $ref pointing to /dev/zero.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

CVE-2025-55198

A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.

Impact

There are two areas of YAML validation that were impacted. First, when a Chart.yaml file had a null maintainer or the child or parent of a dependencies import-values could be parsed as something other than a string, helm lint would panic. Second, when an index.yaml had an empty entry in the list of chart versions Helm would panic on interactions with that repository.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Ensure YAML files are formatted as Helm expects prior to processing them with Helm.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Release Notes

helm/helm (helm.sh/helm/v3)

v3.18.5: Helm v3.18.5

Compare Source

Helm v3.18.5 is a security release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security Advisories

Installation and Upgrading

Download Helm v3.18.5. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.18.6 will contain only bug fixes.
  • 3.19.5 is the next feature release. This release will focus on ...

Changelog

  • fix Chart.yaml handling 7799b48 (Matt Farina)
  • Handle messy index files dd8502f (Matt Farina)
  • json schema fix cb8595b (Robert Sirchia)

v3.18.4: Helm v3.18.4

Compare Source

Helm v3.18.4 is a security release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security Advisories

Installation and Upgrading

Download Helm v3.18.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.18.5 is the next patch release and will be on August 13, 2025
  • 3.19.0 is the next minor release and will be on September 11, 2025

Changelog

  • Disabling linter due to unknown issue f20a4ad (Matt Farina)
  • build(deps): bump the k8s-io group with 7 updates 563b094 (dependabot[bot])
  • Updating link handling 00de613 (Matt Farina)

v3.18.3: Helm 3.18.3

Compare Source

Helm v3.18.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.18.3. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.18.4 is the next patch release and will be on July 09, 2025
  • 3.19.0 is the next minor release and will be on September 11, 2025

Changelog

  • build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0 6838ebc (dependabot[bot])
  • fix: user username password for login 5b9e2f6 (Terry Howe)
  • Update pkg/registry/transport.go 2782412 (Terry Howe)
  • Update pkg/registry/transport.go e66cf6a (Terry Howe)
  • fix: add debug logging to oci transport 191f05c (Terry Howe)

v3.18.2: Helm 3.18.2

Compare Source

Helm v3.18.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.18.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.18.3 is the next patch release and will be on July 09, 2025
  • 3.19.0 is the next minor release and will be on September 11, 2025

Changelog

  • fix: legacy docker support broken for login 04cad46 (Terry Howe)
  • Handle an empty registry config file. bc9f8a2 (Matt Farina)

v3.18.1: Helm v3.18.1

Compare Source

Helm v3.18.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

Notes:

  • This release fixes regressions around template generation and OCI registry interaction in 3.18.0
  • There are at least 2 known regressions unaddressed in this release. They are being worked on.
    • Empty registry configuration files. When the file exists but it is empty.
    • Login to Docker Hub on some domains fails.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.18.1. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.18.2 will contain only bug fixes.
  • 3.19.0 on September 11th, 2025 is the next feature release.

Changelog

  • fix(client): skipnode utilization for PreCopy f6f8700 (Brandt Keller)
  • fix(client): layers now returns manifest - remove duplicate from descriptors 4da7015 (Brandt Keller)
  • fix(client): return nil on non-allowed media types 1a8507f (Brandt Keller)
  • Prevent fetching newReference again as we have in calling method 015531c (Benoit Tigeot)
  • Prevent failure when resolving version tags in oras memory store 9db1a12 (Benoit Tigeot)
  • Update pkg/plugin/plugin.go e8bfa0e (Benoit Tigeot)
  • Update pkg/plugin/plugin.go 24b4490 (Benoit Tigeot)
  • Wait for Helm v4 before raising when platformCommand and Command are set 7e8f534 (Benoit Tigeot)
  • Fix 3.18.0 regression: registry login with scheme ea04cea (Scott Rigby)
  • Revert "fix (helm) : toToml` renders int as float [ backport to v3 ]" bec6609 (Matt Farina)

v3.18.0: Helm v3.18.0

Compare Source

Helm v3.18.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Add support for JSON Schema 2020
  • Enabled cpu and memory profiling
  • Add hook annotation to output hook logs to client on error

Installation and Upgrading

Download Helm v3.18.0. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.18.1 on June 11th, 2025 will contain only bug fixes.
  • 3.19.0 on September 11th, 2025 is the next feature release.

Changelog

  • build(deps): bump the k8s-io group with 7 updates cc58e3f (dependabot[bot])
  • fix: govulncheck workflow bf1436b (Matthieu MOREL)
  • bump version to v3.18.0 d8edc2a (Robert Sirchia)
  • fix:add proxy support when mTLS configured 48377fe (Rongrong Liu)
  • docs: Note about http fallback for OCI registries cdd7c10 (Terry Howe)
  • Bump net package to avoid CVE on dev-v3 f9ab8f7 (Benoit Tigeot)
  • Bump toml 087fa18 (Benoit Tigeot)
  • backport #​30677to dev3 2a5f83b (dongjiang)
  • build(deps): bump github.com/rubenv/sql-migrate from 1.7.2 to 1.8.0 5df2f30 (dependabot[bot])
  • Add install test for TakeOwnership flag 0906fe7 (Evans Mungai)
  • Fix --take-ownership 4ee3a19 (Patrick Seidensal)
  • build(deps): bump github.com/rubenv/sql-migrate from 1.7.1 to 1.7.2 3538c2a (dependabot[bot])
  • build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0 6fa95c8 (dependabot[bot])
  • build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0 741b5be (dependabot[bot])
  • Testing text bump 017f9fa (Benoit Tigeot)
  • Permit more Go version and not only 1.23.8 6667252 (Benoit Tigeot)
  • Bumps github.com/distribution/distribution/v3 from 3.0.0-rc.3 to 3.0.0 4ad1ccd (Benoit Tigeot)
  • Unarchiving fix 3ce10e4 (Matt Farina)
  • Fix typo 422c58e (Benoit Tigeot)
  • Report as debug log, the time spent waiting for resources 5e7f12d (Benoit Tigeot)
  • build(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27 dcc286c (dependabot[bot])
  • Update pkg/registry/fallback.go 1435ec7 (Terry Howe)
  • automatic fallback to http 674e882 (Terry Howe)
  • chore(oci): upgrade to ORAS v2 c188441 (Terry Howe)
  • Updating to 0.37.0 for x/net 2b12490 (Matt Farina)
  • build(deps): bump the k8s-io group with 7 updates 0648918 (dependabot[bot])
  • build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0 0911b9c (dependabot[bot])
  • build(deps): bump github.com/opencontainers/image-spec 2f22d55 (dependabot[bot])
  • build(deps): bump github.com/containerd/containerd from 1.7.25 to 1.7.26 89361c9 (dependabot[bot])
  • build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0 6d64160 (dependabot[bot])
  • Fix cherry-pick helm.sh/helm/v4 -> helm.sh/helm/v3 bcb83e4 (Scott Rigby)
  • Refactor based on review comment 2aa90b8 (Chris Berry)
  • Refactor based on review comment 5739197 (Chris Berry)
  • Add HookOutputFunc and generic yaml unmarshaller b8e1387 (Chris Berry)
  • clarify fix error message 97b0e11 (Scott Rigby)
  • fix err check 2f79afb (Scott Rigby)
  • remove comments about previous functionality c77f4ec (Scott Rigby)
  • add short circuit return 3cd6afe (Scott Rigby)
  • Update based on review comments 5367001 (Chris Berry)
  • Update based on review comments 3c44515 (Chris Berry)
  • Fix lint 4cb639e (Chris Berry)
  • Tidy up imports 20f859c (Chris)
  • Add hook annotations to output pod logs to client on success and fail ca90972 (Chris Berry)
  • chore: use []error instead of []string a9e2075 (Evans Mungai)
  • Update cmd/helm/profiling.go 996ad84 (Evans Mungai)
  • chore: update profiling doc in CONTRIBUTING.md 867c97e (Evans Mungai)
  • Update CONTRIBUTING guide af24101 (Evans Mungai)
  • Prefer environment variables to CLI flags c7dfa87 (Evans Mungai)
  • Fix linter warning b39411a (Evans Mungai)
  • Move pprof paths to HELM_PPROF env variable 4c50f01 (Evans Mungai)
  • Update CONTRIBUTING.md 3b43f7b (Evans Mungai)
  • Update CONTRIBUTING.md a32e11b (Evans Mungai)
  • Additional review fixes from PR 483ebf9 (Evans Mungai)
  • feat: Add flags to enable CPU and memory profiling 461197f (Evans Mungai)
  • build(deps): bump github.com/distribution/distribution/v3 e7fa545 (dependabot[bot])
  • build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 d1687ba (dependabot[bot])
  • Moving to SetOut and SetErr for Cobra 4c2f88b (Matt Farina)
  • build(deps): bump the k8s-io group with 7 updates a2413aa (dependabot[bot])
  • build(deps): bump golang.org/x/crypto from 0.32.0 to 0.33.0 959d643 (dependabot[bot])
  • build(deps): bump golang.org/x/term from 0.28.0 to 0.29.0 3a87c68 (dependabot[bot])
  • build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0 711cef8 (dependabot[bot])
  • build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6 7680623 (dependabot[bot])
  • build(deps): bump github.com/cyphar/filepath-securejoin 03747d9 (dependabot[bot])
  • build(deps): bump github.com/evanphx/json-patch f1db83f (dependabot[bot])
  • build(deps): bump the k8s-io group with 7 updates 3bc3751 (dependabot[bot])
  • fix: check group for resource info match 2ebce78 (Jiasheng Zhu)
  • Bump github.com/cyphar/filepath-securejoin from 0.3.6 to 0.4.0 8e86e76 (dependabot[bot])
  • add test for nullifying nested global value 326c1e3 (Ryan Hockstad)
  • Ensuring the file paths are clean prior to passing to securejoin fba9d08 (Matt Farina)
  • Bump github.com/containerd/containerd from 1.7.24 to 1.7.25 a79be7d (dependabot[bot])
  • Bump golang.org/x/crypto from 0.31.0 to 0.32.0 b029d74 (dependabot[bot])
  • Bump golang.org/x/term from 0.27.0 to 0.28.0 a1c0ae8 (dependabot[bot])
  • bump version to v3.17.0 d6db69e (Matt Farina)
  • Bump github.com/moby/term from 0.5.0 to 0.5.2 54ffefb (dependabot[bot])
  • Add test case for removing an entire object ef2eb55 (Ryan Hockstad)
  • Tests for bugfix: Override subcharts with null values #​12879 60fcce1 (Scott Rigby)
  • feat: Added multi-platform plugin hook support to v3 Signed-off-by: Steve Hipwell [email protected] 83dddb1 (Andrew Block)
  • This commit fixes the issue where the yaml.Unmarshaller converts all int values into float64, this passes in option to decoder, which enables conversion of int into . 0a6834f (Althaf M)
  • merge null child chart objects 5a58751 (Ryan Hockstad)

v3.17.4: Helm v3.17.4

Compare Source

Helm v3.17.4 is a patch release, this bring is the security release noted below. This is intended for Helm SDK users. CLI users are recommended to use the latest version of Helm.

Security Advisories

GHSA-557j-xg8c-q2mm: Chart Dependency Updating With Malicious Chart.yaml Content And Symlink

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.17.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.18.5 is the next patch release and will be on August 13, 2025
  • 3.19.0 is the next minor release and will be on September 11, 2025

Changelog

  • fixup! Updating link handling 0e59b9e (Luis Rascao)
  • Updating link handling 3663598 (Robert Sirchia)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jul 9, 2025
@renovate renovate bot requested a review from a team as a code owner July 9, 2025 01:16
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jul 9, 2025
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jul 9, 2025

/it-go

@renovate renovate bot enabled auto-merge (squash) July 16, 2025 23:57
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from c3c4047 to 914d78d Compare July 16, 2025 23:57
@renovate renovate bot changed the title fix(deps): update module helm.sh/helm/v3 to v3.18.4 [security] fix(deps): update module helm.sh/helm/v3 to v3.17.4 [security] Jul 16, 2025
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 914d78d to cfc2cff Compare July 17, 2025 14:15
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from cfc2cff to 747dd47 Compare July 18, 2025 07:14
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 747dd47 to 4ab4359 Compare July 23, 2025 10:00
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 4ab4359 to 33c6527 Compare July 23, 2025 13:47
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 33c6527 to 2d676e1 Compare July 24, 2025 12:24
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 2d676e1 to 93d6e1f Compare July 24, 2025 13:39
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 93d6e1f to 1c638f8 Compare July 25, 2025 07:56
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 1c638f8 to 418b81c Compare July 25, 2025 10:59
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 418b81c to 574dd2a Compare July 25, 2025 11:51
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 574dd2a to 9c3b2a4 Compare July 29, 2025 10:41
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 9c3b2a4 to b9f117c Compare August 1, 2025 09:47
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 1, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from b9f117c to 2164612 Compare August 1, 2025 10:07
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 1, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 2164612 to e1ce8c3 Compare August 4, 2025 14:36
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 4, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from e1ce8c3 to 7803a5f Compare August 4, 2025 14:44
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 4, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 7803a5f to 1dc1dd1 Compare August 5, 2025 13:10
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 5, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 1dc1dd1 to ad1777d Compare August 6, 2025 09:12
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 6, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from ad1777d to 8465199 Compare August 6, 2025 11:37
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 6, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 8465199 to 7bb8bb1 Compare August 6, 2025 11:52
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 6, 2025

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 7bb8bb1 to a8da104 Compare August 13, 2025 06:39
@github-actions GitHub Actions
Copy link
Contributor

/it-go

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from a8da104 to 3d8def5 Compare August 14, 2025 21:32
@renovate renovate bot changed the title fix(deps): update module helm.sh/helm/v3 to v3.17.4 [security] fix(deps): update module helm.sh/helm/v3 to v3.18.5 [security] Aug 14, 2025
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Aug 14, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 34 additional dependencies were updated

Details:

Package Change
github.com/BurntSushi/toml v1.4.0 -> v1.5.0
github.com/evanphx/json-patch v5.9.0+incompatible -> v5.9.11+incompatible
github.com/spf13/pflag v1.0.6 -> v1.0.7
golang.org/x/mod v0.22.0 -> v0.25.0
golang.org/x/text v0.24.0 -> v0.27.0
github.com/cyphar/filepath-securejoin v0.3.6 -> v0.4.1
github.com/google/gnostic-models v0.6.8 -> v0.6.9
github.com/gorilla/websocket v1.5.0 -> v1.5.4-0.20250319132907-e064f32e3674
k8s.io/apiextensions-apiserver v0.32.2 -> v0.33.3
k8s.io/component-base v0.32.2 -> v0.33.3
k8s.io/kubectl v0.32.2 -> v0.33.3
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 -> v0.0.0-20250102033503-faa5f7b0171c
github.com/containerd/containerd v1.7.24 -> v1.7.27
github.com/docker/docker-credential-helpers v0.8.0 -> v0.8.2
github.com/google/btree v1.0.1 -> v1.1.3
github.com/klauspost/compress v1.17.4 -> v1.18.0
github.com/moby/term v0.5.0 -> v0.5.2
github.com/opencontainers/image-spec v1.1.0 -> v1.1.1
github.com/prometheus/client_golang v1.19.1 -> v1.22.0
github.com/prometheus/common v0.55.0 -> v0.62.0
golang.org/x/crypto v0.37.0 -> v0.40.0
golang.org/x/net v0.39.0 -> v0.41.0
golang.org/x/sync v0.14.0 -> v0.16.0
golang.org/x/sys v0.32.0 -> v0.34.0
golang.org/x/term v0.31.0 -> v0.33.0
k8s.io/api v0.32.2 -> v0.33.3
k8s.io/apimachinery v0.32.2 -> v0.33.3
k8s.io/cli-runtime v0.32.2 -> v0.33.3
k8s.io/client-go v0.32.2 -> v0.33.3
k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f -> v0.0.0-20250318190949-c8a335a9a2ff
sigs.k8s.io/kustomize/api v0.18.0 -> v0.19.0
sigs.k8s.io/kustomize/kyaml v0.18.1 -> v0.19.0
sigs.k8s.io/structured-merge-diff/v4 v4.4.2 -> v4.6.0
sigs.k8s.io/yaml v1.4.0 -> v1.5.0

@github-actions GitHub Actions
Copy link
Contributor

/it-go

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants