From 0d3a331073ac45b1f30918f1c3925a8dfaa0a317 Mon Sep 17 00:00:00 2001
From: Sebastien Tardif <sebtardif@ncf.ca>
Date: Sat, 4 Jul 2026 07:25:23 -0700
Subject: [PATCH] fix(registry): set default HTTP client timeout for registry
 client

The default http.Client had no Timeout, so an unresponsive registry could
hang helm registry operations indefinitely.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
---
 pkg/registry/client.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/registry/client.go b/pkg/registry/client.go
index 4c7b9a6c8..76592f8f3 100644
--- a/pkg/registry/client.go
+++ b/pkg/registry/client.go
@@ -30,6 +30,7 @@ import (
 	"os"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/opencontainers/image-spec/specs-go"
@@ -97,6 +98,8 @@ func NewClient(options ...ClientOption) (*Client, error) {
 	}
 	if client.httpClient == nil {
 		client.httpClient = &http.Client{
+			// Bound registry operations so an unresponsive registry cannot hang forever.
+			Timeout:   30 * time.Second,
 			Transport: NewTransport(client.debug),
 		}
 	}