Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update module helm.sh/helm/v3 to v3.14.2 [SECURITY] - autoclosed #84

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Nov 20, 2022

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
helm.sh/helm/v3 v3.7.1 -> v3.14.2 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-36055

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the _strvals_ package that can cause an out of memory panic. Out of memory panics cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

Impact

The _strvals_ package contains a parser that turns strings into Go structures. For example, the Helm client has command line flags like --set, --set-string, and others that enable the user to pass in strings that are merged into the values. The _strvals_ package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing an out of memory panic.

Applications that use the _strvals_ package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with input to --set, --set-string, and other value setting flags that causes an out of memory panic. Helm is not a long running service so the panic will not affect future uses of the Helm client.

Patches

This issue has been resolved in 3.9.4.

Workarounds

SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.

CVE-2022-23524

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the strvals package that can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the strvals package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

Impact

The strvals package contains a parser that turns strings into Go structures. For example, the Helm client has command line flags like --set, --set-string, and others that enable the user to pass in strings that are merged into the values. The strvals package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing a stack overflow.

Applications that use the strvals package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with input to --set, --set-string, and other value setting flags that causes a stack overflow. Helm is not a long running service so the panic will not affect future uses of the Helm client.

Patches

This issue has been resolved in 3.10.3.

Workarounds

SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the strvals functions.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.

CVE-2023-25165

A Helm contributor discovered an information disclosure vulnerability using the getHostByName template function.

Impact

getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with helm install|upgrade|template or when the Helm SDK is used to render a chart.

Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server.

Patches

The issue has been fixed in Helm 3.11.1.

Workarounds

Prior to using a chart with Helm verify the getHostByName function is not being used in a template to disclose any information you do not want passed to DNS servers.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Philipp Stehle at SAP.

CVE-2022-23525

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the _repo_ package that can cause a segmentation violation. Applications that use functions from the _repo_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

Impact

The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation.

Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client.

Patches

This issue has been resolved in 3.10.3.

Workarounds

SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.

CVE-2022-23526

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the _chartutil_ package that can cause a segmentation violation. Applications that use functions from the _chartutil_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

Impact

The _chartutil_ package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The _chartutil_ package parses the schema file and loads it into structures Go can work with. Some schema files can cause array data structures to be created causing a memory violation.

Applications that use the _chartutil_ package in the Helm SDK to parse a schema file can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with a schema file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client.

Patches

This issue has been resolved in 3.10.3.

Workarounds

SDK users can validate schema files that are correctly formatted before passing them to the _chartutil_ functions.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.

CVE-2024-25620

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Impact

When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name.

Patches

This issue has been resolved in Helm v3.14.1.

Workarounds

Check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Credits

Disclosed by Dominykas Blyžė at Nearform Ltd.

CVE-2024-26147

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Impact

When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm.

In the Helm SDK this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation.

Patches

This issue has been resolved in Helm v3.14.2.

Workarounds

If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.

If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.


Release Notes

helm/helm (helm.sh/helm/v3)

v3.14.2: Helm v3.14.2

Compare Source

Helm v3.14.2 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Jakub Ciolek with AlphaSense discovered the vulnerability.

Installation and Upgrading

Download Helm v3.14.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.3 will contain only bug fixes and be released on March 13, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

v3.14.1: Helm v3.14.1

Compare Source

Helm v3.14.1 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Dominykas Blyžė with Nearform Ltd. discovered the vulnerability.

Installation and Upgrading

Download Helm v3.14.1. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.2 will contain only bug fixes and be released on March 13, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

v3.14.0: Helm v3.14.0

Compare Source

Helm v3.14.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • New helm search flag of --fail-on-no-result
  • Allow a nested tpl invocation access to defines
  • Speed up the tpl function
  • Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate
  • Added --kube-version to lint command
  • The ignore pkg is now public

Installation and Upgrading

Download Helm v3.14.0. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.1 will contain only bug fixes and will be on February 14, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

Changelog

  • Improve release action 3fc9f4b (George Jenkins)
  • bump version to 69dcc92 (Matt Farina)
  • Fix issues when verify generation readiness was merged c042264 (Matt Farina)
  • fix test to use the default code's k8sVersionMinor 6e5332e (Joe Julian)
  • lint: Add --kube-version flag to set capabilities and deprecation rules 869c1d2 (Antoine Deschênes)
  • Update to Go 1.21 for builds 847369c (Matt Farina)
  • chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 08ea59c (dependabot[bot])
  • chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 30e1a2c (dependabot[bot])
  • Removing Asset Transparency 803cf2d (Matt Farina)
  • tests(pkg/engine): test RenderWithClientProvider a997de1 (Marcin Owsiany)
  • Make the ignore pkg public again 5586760 (Ismail Alidzhikov)
  • chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 b3cb20a (dependabot[bot])
  • Updating to Kubernetes 1.29.0 libraries e5fff68 (Matt Farina)
  • feature(pkg/engine): introduce RenderWithClientProvider bfec4ec (Marcin Owsiany)
  • chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 70c1519 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 be10183 (dependabot[bot])
  • Updating Helm libraries for k8s 1.28.4 015e174 (Matt Farina)
  • chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 2a211bf (dependabot[bot])
  • Remove excessive logging ce87ece (Sean Mills)
  • chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 3cb6b06 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 42c5af2 (dependabot[bot])
  • Update CONTRIBUTING.md 312a073 (lixin18)
  • Fixing release labelling in rollback 8814bfb (Marcin Chojnacki)
  • chore(deps): bump github.com/docker/docker c54e39a (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 d6e9197 (dependabot[bot])
  • feat: move livenessProbe and readinessProbe values to default values file 9f0313e (Denis Policastro)
  • Revert "fix(main): fix basic auth for helm pull or push" 24e2864 (Matt Farina)
  • chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 c5fe7dd (dependabot[bot])
  • Revert "fix(registry): address anonymous pull issue" 992dc58 (Matt Farina)
  • Update get-helm-3 81362d9 (Marcel Humburg)
  • chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 6d1f6cd (dependabot[bot])
  • chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 372ccca (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 a1a21ae (dependabot[bot])
  • Drop filterSystemLabels usage from Query method 250f0bd (Dmitry Chepurovskiy)
  • Apply review suggestions 0ec47f8 (Dmitry Chepurovskiy)
  • Update get-helm-3 to get version through get.helm.sh f94e5db (Ian Zink)
  • feat: print failed hook name b0d1637 (Serge Logvinov)
  • chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 544cabb (dependabot[bot])
  • Fixing precedence issue with the import of values. 25371e2 (Matt Farina)
  • chore(create): indent to spaces 919bffe (genofire)
  • Allow using label selectors for system labels for sql backend. e6d9b99 (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for secrets and configmap backends. e219c75 (Dmitry Chepurovskiy)
  • remove useless print during prepareUpgrade f004d42 (b4nks)
  • Add missing with clause to release gh action 9d3d17a (Ian Zink)
  • FIX Default ServiceAccount yaml 828763e (Lars Zimmermann)
  • fix(registry): address anonymous pull issue fe4c01f (Hidde Beydals)
  • fix(registry): unswallow error da3c666 (Hidde Beydals)
  • Fix missing run statement on release action 21ea847 (Ian Zink)
  • Add qps/HELM_QPS parameter 415af5b (Andy Smith)
  • chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 102e931 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 2505592 (dependabot[bot])
  • bump version to v3.13.0 c372b15 (Matt Farina)
  • chore(deps): bump github.com/evanphx/json-patch 8b0a78c (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 58ccfc0 (dependabot[bot])
  • Write latest version to get.helm.sh bucket 0619d08 (Ian Zink)
  • Increased release information key name max length. 4199be8 (abrarcv170)
  • Pin gox to specific commit 0403305 (Antony Chazapis)
  • Remove GoFish from package managers for installing the binary a9377f9 (y-yagi)
  • Test update for "Allow a nested tpl invocation access to defines in a containing one" b261a1b (Graham Reed)
  • Test update for "Speed up tpl" 36d417d (Graham Reed)
  • addressing comment 1a3e9a9 (Stefan McShane)
  • Add support for RISC-V 786707c (Antony Chazapis)
  • lint and validate dependency metadata to reference dependencies with a unique key (name or alias) 6a4035a (Daniel Strobusch)
  • Work around template.Clone omitting options 95905f1 (Graham Reed)
  • fix: pass 'passCredentialsAll' as env-var to getter fa067ec (Mathias Neerup)
  • feat: pass basic auth to env-vars when running download plugins f28447c (Mathias Neerup)
  • helm search: New CLI Flag --fail-on-no-result b9cece6 (Bhargav Ravuri)
  • Update pkg/kube/ready.go 141fa4a (muang0)
  • Update pkg/kube/ready.go 4cb62d1 (muang0)
  • Update pkg/kube/ready.go dbb21fc (muang0)
  • Update pkg/kube/ready.go fcc0332 (muang0)
  • Update pkg/kube/ready.go a1a1aaf (muang0)
  • fix post install hook deletion due to before-hook-creation policy fa025fc (zak905)
  • Allow a nested tpl invocation access to defines in a containing one a7d3fd6 (Graham Reed)
  • Remove the 'reference templates' concept e2a7c79 (Graham Reed)
  • Speed up tpl db4f330 (Graham Reed)
  • ready checker- comment update Signed-off-by: James Oden james.oden.dev@gmail.com d008340 (James Oden)
  • ready checker- remove duplicate statefulset generational check Signed-off-by: James Oden james.oden.dev@gmail.com 4f99c86 (James Oden)
  • Verify generation in readiness checks d94c509 (James Oden)
  • feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' a9d59f9 (Quentin Devos)

v3.13.3: Helm v3.13.3

Compare Source

Helm v3.13.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.3. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • Updating Helm libraries for k8s 1.28.4 c8b9489 (Matt Farina)
  • Remove excessive logging 2f03d01 (Sean Mills)
  • chore(create): indent to spaces 2e63576 (genofire)

v3.13.2: Helm v3.13.2

Compare Source

Helm v3.13.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.3 is a patch release and will be on December 13, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 2a2fb3b (dependabot[bot])
  • Update get-helm-3 8f554be (Marcel Humburg)
  • chore(deps): bump github.com/docker/docker 00a334c (dependabot[bot])
  • Fixing release labelling in rollback 12826e8 (Marcin Chojnacki)
  • Drop filterSystemLabels usage from Query method 666b199 (Dmitry Chepurovskiy)
  • Apply review suggestions 7e0084a (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for sql backend. 10018ff (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for secrets and configmap backends. 3b4cacf (Dmitry Chepurovskiy)
  • Revert "fix(main): fix basic auth for helm pull or push" e785e6c (Matt Farina)
  • Revert "fix(registry): address anonymous pull issue" 268dced (Matt Farina)
  • chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 99ce118 (dependabot[bot])
  • Update get-helm-3 to get version through get.helm.sh 28f208c (Ian Zink)

v3.13.1: Helm v3.13.1

Compare Source

Helm v3.13.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.1. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.2 is a patch release and will be on November 08, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • Fixing precedence issue with the import of values. 3547a4b (Matt Farina)
  • Add missing with clause to release gh action 6f9ad87 (Ian Zink)
  • FIX Default ServiceAccount yaml bae7b32 (Lars Zimmermann)
  • fix(registry): unswallow error 06e4fb1 (Hidde Beydals)
  • remove useless print during prepareUpgrade 0e7ec78 (b4nks)
  • fix(registry): address anonymous pull issue 0ac7894 (Hidde Beydals)
  • Fix missing run statement on release action 0901269 (Ian Zink)
  • Write latest version to get.helm.sh bucket 6101393 (Ian Zink)
  • chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 c99a8ac (dependabot[bot])
  • Increased release information key name max length. 52a029d (abrarcv170)
  • chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 ff8e61d (dependabot[bot])

v3.13.0: Helm v3.13.0

Compare Source

Helm v3.13.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • The --dry-run flag now has multiple options which can enable Helm to connect to a Kubernetes instance. The default, when --dry-run is used, is unchanged.
  • Values handling had numerous issues fixed and now consistently has a priority of (1) User specified values (e.g CLI), (2) parent chart values, (3) imported values, and (4) subchart values. Additionally, null can now consistently be used to remove values. Note, there is a regression around this in 3.13.0 that's fixed in 3.13.1.
  • Can work with OCI registries over HTTP using the --plain-http flag
  • Helm now adds the OCI creation annotation
  • New helm get metadata command
  • The SQL driver now only needs write on the first run or when the schema is updated
  • Added labels support for install and upgrade commands
  • The ability to have index.yaml holding JSON content instead of YAML using the --json flag when creating it. JSON is faster to parse and uses less memory which impacts larger files. This is backwards compatible as Helm, all the way back to 3.0.0, parsing can handle JSON content in the index.yaml file.

Installation and Upgrading

Download Helm v3.13.0. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.1 is the next bug fix release and will be on October 11, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • bump version to v3.13.0 825e86f (Matt Farina)
  • Fix leaking goroutines in Install 169561a (Michał Słapek)
  • chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 417040d (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 610217f (dependabot[bot])
  • Update Helm to use k8s 1.28.2 libraries c2ab954 (Matt Farina)
  • chore(deps): bump github.com/cyphar/filepath-securejoin b9fd7f5 (dependabot[bot])
  • make the dependabot k8s.io group explicit ca3a05e (Joe Julian)
  • use dependabot's group support for k8s.io dependencies 04ec71a (Joe Julian)
  • chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action ebb3168 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 fa45978 (dependabot[bot])
  • doc:Executing helm rollback release 0 will roll back to the previous release e01731d (ithrael)
  • fix conflict 4944acb (Maxim Trofimov)
  • add big tests 6138e10 (Maxim Trofimov)
  • fix conflict 199784f (Maxim Trofimov)
  • fix b786cb4 (Maxim Trofimov)
  • add check if all migrations already applied df5904d (Maxim Trofimov)
  • chore(deps): bump github.com/moby/term fa89665 (dependabot[bot])
  • chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 4283b2c (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 d82cc90 (dependabot[bot])
  • Use labels instead of selectorLabels for pod labels 479be0c (Tim Chaplin)
  • fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook 4e5e68d (Bingtan Lu)
  • chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 3c26d65 (dependabot[bot])
  • remove blank ee1cbed (ithrael)
  • add blank 0eb3df6 (ithrael)
  • add rollback unit test 0688046 (ithrael)
  • fix: helm rollback err tips db9460c (ithrael)
  • chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 817e646 (dependabot[bot])
  • Add Ian Zink (z4ce) as triage maintainer 758dc01 (Ian Zink)
  • chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 04850dc (dependabot[bot])
  • chore: HTTPGetter add default timeout 2011a31 (0xff-dev)
  • fix: precedence typo [bf543d9](https://togithub.com/helm

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependency label Nov 20, 2022
@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from b914ad4 to 15c757a Compare March 16, 2023 11:43
@renovate renovate bot changed the title Update module helm.sh/helm/v3 to v3.9.4 [SECURITY] Update module helm.sh/helm/v3 to v3.11.1 [SECURITY] Mar 16, 2023
@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from 15c757a to 7abd192 Compare March 24, 2023 21:57
@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from 7abd192 to 853ae54 Compare February 15, 2024 16:04
@renovate renovate bot changed the title Update module helm.sh/helm/v3 to v3.11.1 [SECURITY] Update module helm.sh/helm/v3 to v3.14.1 [SECURITY] Feb 15, 2024
@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from 853ae54 to 4dcb088 Compare February 22, 2024 23:07
@renovate renovate bot changed the title Update module helm.sh/helm/v3 to v3.14.1 [SECURITY] Update module helm.sh/helm/v3 to v3.14.2 [SECURITY] Feb 22, 2024
@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from 4dcb088 to 5c123a4 Compare April 14, 2024 10:21
@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from 5c123a4 to d3e7e69 Compare May 9, 2024 12:06
Copy link
Author

renovate bot commented Jun 4, 2024

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.16 -> 1.22.5
github.com/sirupsen/logrus v1.8.1 -> v1.9.3
github.com/spf13/cobra v1.2.1 -> v1.8.0
github.com/stretchr/testify v1.7.0 -> v1.8.4
k8s.io/api v0.22.1 -> v0.29.0
k8s.io/apimachinery v0.22.1 -> v0.29.0
k8s.io/cli-runtime v0.22.1 -> v0.29.0
k8s.io/client-go v0.22.1 -> v0.29.0

@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from d3e7e69 to 793ee86 Compare June 17, 2024 13:56
@renovate renovate bot force-pushed the renovate/go-helm.sh/helm/v3-vulnerability branch from 793ee86 to 9fff184 Compare July 14, 2024 11:35
@renovate renovate bot changed the title Update module helm.sh/helm/v3 to v3.14.2 [SECURITY] Update module helm.sh/helm/v3 to v3.14.2 [SECURITY] - autoclosed Aug 6, 2024
@renovate renovate bot closed this Aug 6, 2024
@renovate renovate bot deleted the renovate/go-helm.sh/helm/v3-vulnerability branch August 6, 2024 08:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

0 participants