From 25bb4dfecbe6d62a7803bf647b6f2b98baf1254f Mon Sep 17 00:00:00 2001
From: Sebastien Tardif <sebtardif@ncf.ca>
Date: Sat, 4 Jul 2026 07:25:23 -0700
Subject: [PATCH] fix(registry): set default HTTP client timeout for registry
 client

The default http.Client had no Timeout, so an unresponsive registry could
hang helm registry operations indefinitely.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
---
 pkg/registry/client.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/registry/client.go b/pkg/registry/client.go
index 4d7da78dc..4e9c8da08 100644
--- a/pkg/registry/client.go
+++ b/pkg/registry/client.go
@@ -30,6 +30,7 @@ import (
 	"os"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/opencontainers/image-spec/specs-go"
@@ -97,6 +98,8 @@ func NewClient(options ...ClientOption) (*Client, error) {
 	}
 	if client.httpClient == nil {
 		client.httpClient = &http.Client{
+			// Bound registry operations so an unresponsive registry cannot hang forever.
+			Timeout:   30 * time.Second,
 			Transport: NewTransport(client.debug),
 		}
 	}