From 5a30c7ae8504218fd68d87c5a7d929d0a3bb3891 Mon Sep 17 00:00:00 2001
From: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Date: Sun, 12 Jul 2026 23:00:17 -0500
Subject: [PATCH 01/35] fix(scripts): add cache-busting to get-helm-3 version
 check

The get-helm-3 script queries get.helm.sh/helm3-latest-version to
determine the latest release. The CDN serving this file has no
Cache-Control header, so edge servers can serve stale cached
responses for hours after a new release.

This causes non-deterministic behavior: machines running get-helm-3
at the same time can install different versions depending on which
CDN edge node they hit.

Fix: Append a timestamp query string (?ts=1783837438) to bust CDN
caches, and add Cache-Control: no-cache header to both curl and wget
requests.

Fixes #32329

Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
---
 scripts/get-helm-3 | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index 5f265a52f..dad66ab20 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -114,12 +114,14 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    local latest_release_url="https://get.helm.sh/helm3-latest-version"
+    # Append a cache-busting query string to avoid CDN edge servers
+    # serving stale version files after a new release.
+    local latest_release_url="https://get.helm.sh/helm3-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
-      latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true )
+      latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
     TAG=$( echo "$latest_release_response" | grep '^v[0-9]' )
     if [ "x$TAG" == "x" ]; then

From f8180e6de473bb4b1008b76aa2ac63b8bcd104c0 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Wed, 26 Nov 2025 18:06:31 +0100
Subject: [PATCH 02/35] feat(rollback): add --description flag to provide
 rollback reason

Add a new --description flag to the helm rollback command that allows
users to specify a custom description explaining why the rollback was
performed. This description is stored in the release metadata.

Changes:
- Add Description field to the Rollback action struct
- Add --description flag to the rollback CLI command
- Add 512 character limit validation for the description
- Default to 'Rollback to <version>' when no description is provided

The description flag is optional and follows the same pattern used by
the install and upgrade commands.

Closes #XXXX

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/rollback.go                        |  10 +-
 pkg/action/rollback_test.go                   | 135 +++++++++++++++++-
 pkg/cmd/rollback.go                           |   9 ++
 pkg/cmd/rollback_test.go                      |  84 +++++++++++
 .../output/rollback-with-description.txt      |   2 +
 5 files changed, 236 insertions(+), 4 deletions(-)
 create mode 100644 pkg/cmd/testdata/output/rollback-with-description.txt

diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index 6fc449c30..a4eb09643 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -59,6 +59,8 @@ type Rollback struct {
 	ServerSideApply string
 	CleanupOnFail   bool
 	MaxHistory      int // MaxHistory limits the maximum number of revisions saved per release
+	// Description is the description of this rollback operation
+	Description string
 }
 
 // NewRollback creates a new Rollback object with the given configuration.
@@ -169,6 +171,12 @@ func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Rele
 		return nil, nil, false, err
 	}
 
+	// Determine the description for this rollback
+	description := fmt.Sprintf("Rollback to %d", previousVersion)
+	if r.Description != "" {
+		description = r.Description
+	}
+
 	// Store a new release object with previous release's configuration
 	targetRelease := &release.Release{
 		Name:      name,
@@ -183,7 +191,7 @@ func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Rele
 			RollbackRevision: previousVersion,
 			// Because we lose the reference to previous version elsewhere, we set the
 			// message here, and only override it later if we experience failure.
-			Description: fmt.Sprintf("Rollback to %d", previousVersion),
+			Description: description,
 		},
 		Version:     currentRelease.Version + 1,
 		Labels:      previousRelease.Labels,
diff --git a/pkg/action/rollback_test.go b/pkg/action/rollback_test.go
index 7ffd90d25..f85d1a690 100644
--- a/pkg/action/rollback_test.go
+++ b/pkg/action/rollback_test.go
@@ -27,14 +27,26 @@ import (
 
 	"helm.sh/helm/v4/pkg/kube"
 	kubefake "helm.sh/helm/v4/pkg/kube/fake"
+	"helm.sh/helm/v4/pkg/release/common"
 )
 
+func rollbackAction(t *testing.T) *Rollback {
+	t.Helper()
+	config := actionConfigFixture(t)
+	rollAction := NewRollback(config)
+	return rollAction
+}
+
 func TestNewRollback(t *testing.T) {
+	is := assert.New(t)
 	config := actionConfigFixture(t)
-	client := NewRollback(config)
 
-	assert.NotNil(t, client)
-	assert.Equal(t, config, client.cfg)
+	rollback := NewRollback(config)
+
+	is.NotNil(rollback)
+	is.Equal(config, rollback.cfg)
+	is.Equal(DryRunNone, rollback.DryRunStrategy)
+	is.Empty(rollback.Description)
 }
 
 func TestRollbackRun_UnreachableKubeClient(t *testing.T) {
@@ -131,3 +143,120 @@ func TestRollbackRevisionZeroForNonRollback(t *testing.T) {
 
 	assert.Equal(t, 0, r.Info.RollbackRevision)
 }
+
+func TestRollback_WithDescription(t *testing.T) {
+	is := assert.New(t)
+	req := require.New(t)
+
+	rollAction := rollbackAction(t)
+
+	// Create two releases - version 1 (superseded) and version 2 (deployed)
+	rel1 := releaseStub()
+	rel1.Name = "test-release"
+	rel1.Version = 1
+	rel1.Info.Status = common.StatusSuperseded
+	rel1.ApplyMethod = "csa" // client-side apply
+	req.NoError(rollAction.cfg.Releases.Create(rel1))
+
+	rel2 := releaseStub()
+	rel2.Name = "test-release"
+	rel2.Version = 2
+	rel2.Info.Status = common.StatusDeployed
+	rel2.ApplyMethod = "csa" // client-side apply
+	req.NoError(rollAction.cfg.Releases.Create(rel2))
+
+	// Set custom description
+	customDescription := "Rollback due to critical bug in version 2"
+	rollAction.Description = customDescription
+	rollAction.Version = 1
+	rollAction.ServerSideApply = "false" // Disable server-side apply for testing
+
+	err := rollAction.Run("test-release")
+	req.NoError(err)
+
+	// Get the new release (version 3)
+	newReleasei, err := rollAction.cfg.Releases.Get("test-release", 3)
+	req.NoError(err)
+	newRelease, err := releaserToV1Release(newReleasei)
+	req.NoError(err)
+
+	// Verify the custom description was set
+	is.Equal(customDescription, newRelease.Info.Description)
+}
+
+func TestRollback_DefaultDescription(t *testing.T) {
+	is := assert.New(t)
+	req := require.New(t)
+
+	rollAction := rollbackAction(t)
+
+	// Create two releases - version 1 (superseded) and version 2 (deployed)
+	rel1 := releaseStub()
+	rel1.Name = "test-release-default"
+	rel1.Version = 1
+	rel1.Info.Status = common.StatusSuperseded
+	rel1.ApplyMethod = "csa" // client-side apply
+	req.NoError(rollAction.cfg.Releases.Create(rel1))
+
+	rel2 := releaseStub()
+	rel2.Name = "test-release-default"
+	rel2.Version = 2
+	rel2.Info.Status = common.StatusDeployed
+	rel2.ApplyMethod = "csa" // client-side apply
+	req.NoError(rollAction.cfg.Releases.Create(rel2))
+
+	// Don't set a description, rely on default
+	rollAction.Version = 1
+	rollAction.ServerSideApply = "false" // Disable server-side apply for testing
+
+	err := rollAction.Run("test-release-default")
+	req.NoError(err)
+
+	// Get the new release (version 3)
+	newReleasei, err := rollAction.cfg.Releases.Get("test-release-default", 3)
+	req.NoError(err)
+	newRelease, err := releaserToV1Release(newReleasei)
+	req.NoError(err)
+
+	// Verify the default description was set
+	is.Equal("Rollback to 1", newRelease.Info.Description)
+}
+
+func TestRollback_EmptyDescription(t *testing.T) {
+	is := assert.New(t)
+	req := require.New(t)
+
+	rollAction := rollbackAction(t)
+
+	// Create two releases - version 1 (superseded) and version 2 (deployed)
+	rel1 := releaseStub()
+	rel1.Name = "test-release-empty"
+	rel1.Version = 1
+	rel1.Info.Status = common.StatusSuperseded
+	rel1.ApplyMethod = "csa" // client-side apply
+	req.NoError(rollAction.cfg.Releases.Create(rel1))
+
+	rel2 := releaseStub()
+	rel2.Name = "test-release-empty"
+	rel2.Version = 2
+	rel2.Info.Status = common.StatusDeployed
+	rel2.ApplyMethod = "csa" // client-side apply
+	req.NoError(rollAction.cfg.Releases.Create(rel2))
+
+	// Set empty description (should use default)
+	rollAction.Description = ""
+	rollAction.Version = 1
+	rollAction.ServerSideApply = "false" // Disable server-side apply for testing
+
+	err := rollAction.Run("test-release-empty")
+	req.NoError(err)
+
+	// Get the new release (version 3)
+	newReleasei, err := rollAction.cfg.Releases.Get("test-release-empty", 3)
+	req.NoError(err)
+	newRelease, err := releaserToV1Release(newReleasei)
+	req.NoError(err)
+
+	// Verify the default description was used for empty string
+	is.Equal("Rollback to 1", newRelease.Info.Description)
+}
diff --git a/pkg/cmd/rollback.go b/pkg/cmd/rollback.go
index b716dae10..fb2b80c5c 100644
--- a/pkg/cmd/rollback.go
+++ b/pkg/cmd/rollback.go
@@ -38,6 +38,9 @@ second is a revision (version) number. If this argument is omitted or set to
 To see revision numbers, run 'helm history RELEASE'.
 `
 
+// maxDescriptionLength is the maximum length allowed for a rollback description
+const maxDescriptionLength = 512
+
 func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	client := action.NewRollback(cfg)
 	client.WaitOptions = append(client.WaitOptions, defaultCLIWaitOptions()...)
@@ -67,6 +70,11 @@ func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 				client.Version = ver
 			}
 
+			// Validate description length
+			if len(client.Description) > maxDescriptionLength {
+				return fmt.Errorf("description must be %d characters or less, got %d", maxDescriptionLength, len(client.Description))
+			}
+
 			dryRunStrategy, err := cmdGetDryRunFlagStrategy(cmd, false)
 			if err != nil {
 				return err
@@ -83,6 +91,7 @@ func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	}
 
 	f := cmd.Flags()
+	f.StringVar(&client.Description, "description", "", fmt.Sprintf("add a custom description for the rollback (max %d characters)", maxDescriptionLength))
 	f.BoolVar(&client.ForceReplace, "force-replace", false, "force resource updates by replacement")
 	f.BoolVar(&client.ForceReplace, "force", false, "deprecated")
 	f.MarkDeprecated("force", "use --force-replace instead")
diff --git a/pkg/cmd/rollback_test.go b/pkg/cmd/rollback_test.go
index 21d6a65af..f607f57b1 100644
--- a/pkg/cmd/rollback_test.go
+++ b/pkg/cmd/rollback_test.go
@@ -18,6 +18,7 @@ package cmd
 
 import (
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -81,6 +82,11 @@ func TestRollbackCmd(t *testing.T) {
 		golden:    "output/rollback-no-args.txt",
 		rels:      rels,
 		wantError: true,
+	}, {
+		name:   "rollback a release with description",
+		cmd:    "rollback funny-honey 1 --description 'Reverting due to bug in version 2'",
+		golden: "output/rollback-with-description.txt",
+		rels:   rels,
 	}}
 	runTestCmd(t, tests)
 }
@@ -127,6 +133,84 @@ func TestRollbackFileCompletion(t *testing.T) {
 	checkFileCompletion(t, "rollback myrelease 1", false)
 }
 
+func TestRollbackWithDescription(t *testing.T) {
+	releaseName := "funny-bunny-desc"
+	rels := []*release.Release{
+		{
+			Name:    releaseName,
+			Info:    &release.Info{Status: common.StatusSuperseded},
+			Chart:   &chart.Chart{},
+			Version: 1,
+		},
+		{
+			Name:    releaseName,
+			Info:    &release.Info{Status: common.StatusDeployed},
+			Chart:   &chart.Chart{},
+			Version: 2,
+		},
+	}
+	storage := storageFixture()
+	for _, rel := range rels {
+		if err := storage.Create(rel); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	customDescription := "Rollback due to critical bug in version 2"
+	_, _, err := executeActionCommandC(storage, fmt.Sprintf("rollback %s 1 --description '%s'", releaseName, customDescription))
+	if err != nil {
+		t.Fatalf("unexpected error, got '%v'", err)
+	}
+
+	// Verify the description was stored correctly
+	updatedReli, err := storage.Get(releaseName, 3)
+	if err != nil {
+		t.Fatalf("unexpected error getting release, got '%v'", err)
+	}
+	updatedRel, err := releaserToV1Release(updatedReli)
+	if err != nil {
+		t.Fatalf("unexpected error converting release, got '%v'", err)
+	}
+
+	if updatedRel.Info.Description != customDescription {
+		t.Errorf("Expected description '%s', got '%s'", customDescription, updatedRel.Info.Description)
+	}
+}
+
+func TestRollbackDescriptionTooLong(t *testing.T) {
+	releaseName := "funny-bunny-long-desc"
+	rels := []*release.Release{
+		{
+			Name:    releaseName,
+			Info:    &release.Info{Status: common.StatusSuperseded},
+			Chart:   &chart.Chart{},
+			Version: 1,
+		},
+		{
+			Name:    releaseName,
+			Info:    &release.Info{Status: common.StatusDeployed},
+			Chart:   &chart.Chart{},
+			Version: 2,
+		},
+	}
+	storage := storageFixture()
+	for _, rel := range rels {
+		if err := storage.Create(rel); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// Create a description that exceeds the 512 character limit
+	longDescription := strings.Repeat("a", 513)
+	_, _, err := executeActionCommandC(storage, fmt.Sprintf("rollback %s 1 --description '%s'", releaseName, longDescription))
+	if err == nil {
+		t.Error("expected error for description exceeding max length, got success")
+	}
+	if err != nil && !strings.Contains(err.Error(), "description must be 512 characters or less") {
+		t.Errorf("expected error about description length, got: %v", err)
+	}
+}
+
 func TestRollbackWithLabels(t *testing.T) {
 	labels1 := map[string]string{"operation": "install", "firstLabel": "firstValue"}
 	labels2 := map[string]string{"operation": "upgrade", "secondLabel": "secondValue"}
diff --git a/pkg/cmd/testdata/output/rollback-with-description.txt b/pkg/cmd/testdata/output/rollback-with-description.txt
new file mode 100644
index 000000000..a034dd2df
--- /dev/null
+++ b/pkg/cmd/testdata/output/rollback-with-description.txt
@@ -0,0 +1,2 @@
+Rollback was a success! Happy Helming!
+

From b606955f095408270914c47eac8414b9061bfb49 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 16 Feb 2026 13:50:56 +0100
Subject: [PATCH 03/35] Set 256 as limit for maxDescriptionLength. 256 comes
 from MAX value for key and value

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/cmd/rollback.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/rollback.go b/pkg/cmd/rollback.go
index fb2b80c5c..35257a779 100644
--- a/pkg/cmd/rollback.go
+++ b/pkg/cmd/rollback.go
@@ -39,7 +39,7 @@ To see revision numbers, run 'helm history RELEASE'.
 `
 
 // maxDescriptionLength is the maximum length allowed for a rollback description
-const maxDescriptionLength = 512
+const maxDescriptionLength = 256
 
 func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	client := action.NewRollback(cfg)

From e69e424ab1917f0d53eafe63c408b5280b39624a Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Tue, 17 Feb 2026 13:17:34 +0100
Subject: [PATCH 04/35] Changed if construction

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/rollback.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index a4eb09643..5f4c5a8a9 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -172,9 +172,9 @@ func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Rele
 	}
 
 	// Determine the description for this rollback
-	description := fmt.Sprintf("Rollback to %d", previousVersion)
-	if r.Description != "" {
-		description = r.Description
+	description := r.Description
+	if description == "" {
+		description = fmt.Sprintf("Rollback to %d", previousVersion)
 	}
 
 	// Store a new release object with previous release's configuration

From cb91040c447723a7338a513a6d1604e5daaa1e0b Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 23 Feb 2026 08:40:44 +0100
Subject: [PATCH 05/35] Enhanced rollback description length

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/rollback.go      |  6 ++++
 pkg/action/rollback_test.go | 64 +++++++++++++++++++++++++++++++++++++
 pkg/cmd/rollback.go         |  9 ++----
 pkg/cmd/rollback_test.go    |  5 ++-
 4 files changed, 75 insertions(+), 9 deletions(-)

diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index 5f4c5a8a9..93a7ab194 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -31,6 +31,8 @@ import (
 	"helm.sh/helm/v4/pkg/storage/driver"
 )
 
+const MaxDescriptionLength = 256
+
 // Rollback is the action for rolling back to a given release.
 //
 // It provides the implementation of 'helm rollback'.
@@ -118,6 +120,10 @@ func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Rele
 		return nil, nil, false, errInvalidRevision
 	}
 
+	if len(r.Description) > MaxDescriptionLength {
+		return nil, nil, false, fmt.Errorf("description must be %d characters or less, got %d", MaxDescriptionLength, len(r.Description))
+	}
+
 	currentReleasei, err := r.cfg.Releases.Last(name)
 	if err != nil {
 		return nil, nil, false, err
diff --git a/pkg/action/rollback_test.go b/pkg/action/rollback_test.go
index f85d1a690..1d483a17e 100644
--- a/pkg/action/rollback_test.go
+++ b/pkg/action/rollback_test.go
@@ -20,6 +20,7 @@ import (
 	"context"
 	"errors"
 	"io"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -260,3 +261,66 @@ func TestRollback_EmptyDescription(t *testing.T) {
 	// Verify the default description was used for empty string
 	is.Equal("Rollback to 1", newRelease.Info.Description)
 }
+
+func TestRollback_DescriptionTooLong(t *testing.T) {
+	req := require.New(t)
+
+	rollAction := rollbackAction(t)
+
+	rel1 := releaseStub()
+	rel1.Name = "test-release-desc-long"
+	rel1.Version = 1
+	rel1.Info.Status = common.StatusSuperseded
+	rel1.ApplyMethod = "csa"
+	req.NoError(rollAction.cfg.Releases.Create(rel1))
+
+	rel2 := releaseStub()
+	rel2.Name = "test-release-desc-long"
+	rel2.Version = 2
+	rel2.Info.Status = common.StatusDeployed
+	rel2.ApplyMethod = "csa"
+	req.NoError(rollAction.cfg.Releases.Create(rel2))
+
+	rollAction.Description = strings.Repeat("a", MaxDescriptionLength+1)
+	rollAction.Version = 1
+	rollAction.ServerSideApply = "false"
+
+	err := rollAction.Run("test-release-desc-long")
+	req.Error(err)
+	req.Contains(err.Error(), "description must be")
+}
+
+func TestRollback_DescriptionAtMaxLength(t *testing.T) {
+	is := assert.New(t)
+	req := require.New(t)
+
+	rollAction := rollbackAction(t)
+
+	rel1 := releaseStub()
+	rel1.Name = "test-release-desc-max"
+	rel1.Version = 1
+	rel1.Info.Status = common.StatusSuperseded
+	rel1.ApplyMethod = "csa"
+	req.NoError(rollAction.cfg.Releases.Create(rel1))
+
+	rel2 := releaseStub()
+	rel2.Name = "test-release-desc-max"
+	rel2.Version = 2
+	rel2.Info.Status = common.StatusDeployed
+	rel2.ApplyMethod = "csa"
+	req.NoError(rollAction.cfg.Releases.Create(rel2))
+
+	rollAction.Description = strings.Repeat("a", MaxDescriptionLength)
+	rollAction.Version = 1
+	rollAction.ServerSideApply = "false"
+
+	err := rollAction.Run("test-release-desc-max")
+	req.NoError(err)
+
+	newReleasei, err := rollAction.cfg.Releases.Get("test-release-desc-max", 3)
+	req.NoError(err)
+	newRelease, err := releaserToV1Release(newReleasei)
+	req.NoError(err)
+
+	is.Equal(strings.Repeat("a", MaxDescriptionLength), newRelease.Info.Description)
+}
diff --git a/pkg/cmd/rollback.go b/pkg/cmd/rollback.go
index 35257a779..1fbd04fc8 100644
--- a/pkg/cmd/rollback.go
+++ b/pkg/cmd/rollback.go
@@ -38,9 +38,6 @@ second is a revision (version) number. If this argument is omitted or set to
 To see revision numbers, run 'helm history RELEASE'.
 `
 
-// maxDescriptionLength is the maximum length allowed for a rollback description
-const maxDescriptionLength = 256
-
 func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	client := action.NewRollback(cfg)
 	client.WaitOptions = append(client.WaitOptions, defaultCLIWaitOptions()...)
@@ -71,8 +68,8 @@ func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 			}
 
 			// Validate description length
-			if len(client.Description) > maxDescriptionLength {
-				return fmt.Errorf("description must be %d characters or less, got %d", maxDescriptionLength, len(client.Description))
+			if len(client.Description) > action.MaxDescriptionLength {
+				return fmt.Errorf("description must be %d characters or less, got %d", action.MaxDescriptionLength, len(client.Description))
 			}
 
 			dryRunStrategy, err := cmdGetDryRunFlagStrategy(cmd, false)
@@ -91,7 +88,7 @@ func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	}
 
 	f := cmd.Flags()
-	f.StringVar(&client.Description, "description", "", fmt.Sprintf("add a custom description for the rollback (max %d characters)", maxDescriptionLength))
+	f.StringVar(&client.Description, "description", "", fmt.Sprintf("add a custom description for the rollback (max %d characters)", action.MaxDescriptionLength))
 	f.BoolVar(&client.ForceReplace, "force-replace", false, "force resource updates by replacement")
 	f.BoolVar(&client.ForceReplace, "force", false, "deprecated")
 	f.MarkDeprecated("force", "use --force-replace instead")
diff --git a/pkg/cmd/rollback_test.go b/pkg/cmd/rollback_test.go
index f607f57b1..44119d9e7 100644
--- a/pkg/cmd/rollback_test.go
+++ b/pkg/cmd/rollback_test.go
@@ -200,13 +200,12 @@ func TestRollbackDescriptionTooLong(t *testing.T) {
 		}
 	}
 
-	// Create a description that exceeds the 512 character limit
-	longDescription := strings.Repeat("a", 513)
+	longDescription := strings.Repeat("a", action.MaxDescriptionLength+1)
 	_, _, err := executeActionCommandC(storage, fmt.Sprintf("rollback %s 1 --description '%s'", releaseName, longDescription))
 	if err == nil {
 		t.Error("expected error for description exceeding max length, got success")
 	}
-	if err != nil && !strings.Contains(err.Error(), "description must be 512 characters or less") {
+	if err != nil && !strings.Contains(err.Error(), fmt.Sprintf("description must be %d characters or less", action.MaxDescriptionLength)) {
 		t.Errorf("expected error about description length, got: %v", err)
 	}
 }

From 8a34f3b7b4d9ffa4e82c7893eb3d8572fd464198 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 23 Feb 2026 08:45:48 +0100
Subject: [PATCH 06/35] Use rune count to count properly multi-byte UTF-8
 characters

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/rollback.go      |  5 +++--
 pkg/action/rollback_test.go | 36 ++++++++++++++++++++++++++++++++++++
 pkg/cmd/rollback.go         |  5 +++--
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index 93a7ab194..497842c3c 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -21,6 +21,7 @@ import (
 	"errors"
 	"fmt"
 	"time"
+	"unicode/utf8"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
@@ -120,8 +121,8 @@ func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Rele
 		return nil, nil, false, errInvalidRevision
 	}
 
-	if len(r.Description) > MaxDescriptionLength {
-		return nil, nil, false, fmt.Errorf("description must be %d characters or less, got %d", MaxDescriptionLength, len(r.Description))
+	if utf8.RuneCountInString(r.Description) > MaxDescriptionLength {
+		return nil, nil, false, fmt.Errorf("description must be %d characters or less, got %d", MaxDescriptionLength, utf8.RuneCountInString(r.Description))
 	}
 
 	currentReleasei, err := r.cfg.Releases.Last(name)
diff --git a/pkg/action/rollback_test.go b/pkg/action/rollback_test.go
index 1d483a17e..af7fe6107 100644
--- a/pkg/action/rollback_test.go
+++ b/pkg/action/rollback_test.go
@@ -324,3 +324,39 @@ func TestRollback_DescriptionAtMaxLength(t *testing.T) {
 
 	is.Equal(strings.Repeat("a", MaxDescriptionLength), newRelease.Info.Description)
 }
+
+func TestRollback_DescriptionMultiByteCharacters(t *testing.T) {
+	is := assert.New(t)
+	req := require.New(t)
+
+	rollAction := rollbackAction(t)
+
+	rel1 := releaseStub()
+	rel1.Name = "test-release-desc-utf8"
+	rel1.Version = 1
+	rel1.Info.Status = common.StatusSuperseded
+	rel1.ApplyMethod = "csa"
+	req.NoError(rollAction.cfg.Releases.Create(rel1))
+
+	rel2 := releaseStub()
+	rel2.Name = "test-release-desc-utf8"
+	rel2.Version = 2
+	rel2.Info.Status = common.StatusDeployed
+	rel2.ApplyMethod = "csa"
+	req.NoError(rollAction.cfg.Releases.Create(rel2))
+
+	// "é" is 2 bytes in UTF-8 but 1 rune
+	rollAction.Description = strings.Repeat("é", MaxDescriptionLength)
+	rollAction.Version = 1
+	rollAction.ServerSideApply = "false"
+
+	err := rollAction.Run("test-release-desc-utf8")
+	req.NoError(err)
+
+	newReleasei, err := rollAction.cfg.Releases.Get("test-release-desc-utf8", 3)
+	req.NoError(err)
+	newRelease, err := releaserToV1Release(newReleasei)
+	req.NoError(err)
+
+	is.Equal(strings.Repeat("é", MaxDescriptionLength), newRelease.Info.Description)
+}
diff --git a/pkg/cmd/rollback.go b/pkg/cmd/rollback.go
index 1fbd04fc8..bad1e3068 100644
--- a/pkg/cmd/rollback.go
+++ b/pkg/cmd/rollback.go
@@ -21,6 +21,7 @@ import (
 	"io"
 	"strconv"
 	"time"
+	"unicode/utf8"
 
 	"github.com/spf13/cobra"
 
@@ -68,8 +69,8 @@ func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 			}
 
 			// Validate description length
-			if len(client.Description) > action.MaxDescriptionLength {
-				return fmt.Errorf("description must be %d characters or less, got %d", action.MaxDescriptionLength, len(client.Description))
+			if utf8.RuneCountInString(client.Description) > action.MaxDescriptionLength {
+				return fmt.Errorf("description must be %d characters or less, got %d", action.MaxDescriptionLength, utf8.RuneCountInString(client.Description))
 			}
 
 			dryRunStrategy, err := cmdGetDryRunFlagStrategy(cmd, false)

From a92611c20241be8e7dc32f9b229afd2a722a06f8 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 23 Feb 2026 09:07:13 +0100
Subject: [PATCH 07/35] Enhance rune count in pkg/cmd/rollback.go and
 pkg/action/rollback.go

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/rollback.go | 4 ++--
 pkg/cmd/rollback.go    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index 497842c3c..9a5526e94 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -121,8 +121,8 @@ func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Rele
 		return nil, nil, false, errInvalidRevision
 	}
 
-	if utf8.RuneCountInString(r.Description) > MaxDescriptionLength {
-		return nil, nil, false, fmt.Errorf("description must be %d characters or less, got %d", MaxDescriptionLength, utf8.RuneCountInString(r.Description))
+	if descLen := utf8.RuneCountInString(r.Description); descLen > MaxDescriptionLength {
+		return nil, nil, false, fmt.Errorf("description must be %d characters or less, got %d", MaxDescriptionLength, descLen)
 	}
 
 	currentReleasei, err := r.cfg.Releases.Last(name)
diff --git a/pkg/cmd/rollback.go b/pkg/cmd/rollback.go
index bad1e3068..62d0be4af 100644
--- a/pkg/cmd/rollback.go
+++ b/pkg/cmd/rollback.go
@@ -69,8 +69,8 @@ func newRollbackCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 			}
 
 			// Validate description length
-			if utf8.RuneCountInString(client.Description) > action.MaxDescriptionLength {
-				return fmt.Errorf("description must be %d characters or less, got %d", action.MaxDescriptionLength, utf8.RuneCountInString(client.Description))
+			if descLen := utf8.RuneCountInString(client.Description); descLen > action.MaxDescriptionLength {
+				return fmt.Errorf("description must be %d characters or less, got %d", action.MaxDescriptionLength, descLen)
 			}
 
 			dryRunStrategy, err := cmdGetDryRunFlagStrategy(cmd, false)

From b177a8e9060720e91c402cdba2224c6d58789fa3 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 23 Feb 2026 17:45:01 +0100
Subject: [PATCH 08/35] Removed extra space in rollback-with-description.txt

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/cmd/testdata/output/rollback-with-description.txt | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkg/cmd/testdata/output/rollback-with-description.txt b/pkg/cmd/testdata/output/rollback-with-description.txt
index a034dd2df..ae3c6f1c4 100644
--- a/pkg/cmd/testdata/output/rollback-with-description.txt
+++ b/pkg/cmd/testdata/output/rollback-with-description.txt
@@ -1,2 +1 @@
 Rollback was a success! Happy Helming!
-

From e73dfab5fb47c9f3a0f24cb3f3a7a4aa8b65143e Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Tue, 24 Feb 2026 10:29:30 +0100
Subject: [PATCH 09/35] refactor(test): reuse existing rollback.txt golden file

Remove duplicate rollback-with-description.txt fixture that had
identical content to rollback.txt.

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/cmd/rollback_test.go                              | 2 +-
 pkg/cmd/testdata/output/rollback-with-description.txt | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)
 delete mode 100644 pkg/cmd/testdata/output/rollback-with-description.txt

diff --git a/pkg/cmd/rollback_test.go b/pkg/cmd/rollback_test.go
index 44119d9e7..2e523a5f6 100644
--- a/pkg/cmd/rollback_test.go
+++ b/pkg/cmd/rollback_test.go
@@ -85,7 +85,7 @@ func TestRollbackCmd(t *testing.T) {
 	}, {
 		name:   "rollback a release with description",
 		cmd:    "rollback funny-honey 1 --description 'Reverting due to bug in version 2'",
-		golden: "output/rollback-with-description.txt",
+		golden: "output/rollback.txt",
 		rels:   rels,
 	}}
 	runTestCmd(t, tests)
diff --git a/pkg/cmd/testdata/output/rollback-with-description.txt b/pkg/cmd/testdata/output/rollback-with-description.txt
deleted file mode 100644
index ae3c6f1c4..000000000
--- a/pkg/cmd/testdata/output/rollback-with-description.txt
+++ /dev/null
@@ -1 +0,0 @@
-Rollback was a success! Happy Helming!

From 91520a78063582ab8265d9364815665f688deebc Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Tue, 24 Feb 2026 10:32:41 +0100
Subject: [PATCH 10/35] refactor(rollback): validate description length before
 cluster reachability check

Move description length validation to the beginning of Run(), before
IsReachable(), so programmatic callers get an immediate validation
error instead of a potentially misleading cluster reachability failure.

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/rollback.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index 9a5526e94..52fdfbbf8 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -77,6 +77,10 @@ func NewRollback(cfg *Configuration) *Rollback {
 
 // Run executes 'helm rollback' against the given release.
 func (r *Rollback) Run(name string) error {
+	if descLen := utf8.RuneCountInString(r.Description); descLen > MaxDescriptionLength {
+		return fmt.Errorf("description must be %d characters or less, got %d", MaxDescriptionLength, descLen)
+	}
+
 	if err := r.cfg.KubeClient.IsReachable(); err != nil {
 		return err
 	}
@@ -121,10 +125,6 @@ func (r *Rollback) prepareRollback(name string) (*release.Release, *release.Rele
 		return nil, nil, false, errInvalidRevision
 	}
 
-	if descLen := utf8.RuneCountInString(r.Description); descLen > MaxDescriptionLength {
-		return nil, nil, false, fmt.Errorf("description must be %d characters or less, got %d", MaxDescriptionLength, descLen)
-	}
-
 	currentReleasei, err := r.cfg.Releases.Last(name)
 	if err != nil {
 		return nil, nil, false, err

From 4fcc4e4b3db363654f3dd5240211b195e309970e Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 22 Jun 2026 08:25:49 +0200
Subject: [PATCH 11/35] Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/action/rollback.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index 52fdfbbf8..b24b4a83d 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -32,6 +32,8 @@ import (
 	"helm.sh/helm/v4/pkg/storage/driver"
 )
 
+// MaxDescriptionLength is the maximum length allowed for a rollback description,
+// including values provided via the --description flag and Rollback.Description.
 const MaxDescriptionLength = 256
 
 // Rollback is the action for rolling back to a given release.

From f1ede7c9c114c745da2f5c6cef8d27e1eb342498 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Tue, 23 Jun 2026 10:58:37 +0200
Subject: [PATCH 12/35] Potential fix for pull request finding

If the CLI-side description validation is removed, the unicode/utf8 import becomes unused and should also be dropped.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/cmd/rollback.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkg/cmd/rollback.go b/pkg/cmd/rollback.go
index 62d0be4af..12f4b6b3c 100644
--- a/pkg/cmd/rollback.go
+++ b/pkg/cmd/rollback.go
@@ -21,7 +21,6 @@ import (
 	"io"
 	"strconv"
 	"time"
-	"unicode/utf8"
 
 	"github.com/spf13/cobra"
 

From 500f02d597628d8ca7be8b530edcbedbf397b676 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Tue, 23 Jun 2026 14:22:55 +0200
Subject: [PATCH 13/35] Readded "unicode/utf8"

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/cmd/rollback.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/cmd/rollback.go b/pkg/cmd/rollback.go
index 12f4b6b3c..62d0be4af 100644
--- a/pkg/cmd/rollback.go
+++ b/pkg/cmd/rollback.go
@@ -21,6 +21,7 @@ import (
 	"io"
 	"strconv"
 	"time"
+	"unicode/utf8"
 
 	"github.com/spf13/cobra"
 

From 94a3315f4d699c6bb4140550d4c98b46bb4382d2 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 27 Jul 2026 09:41:29 +0200
Subject: [PATCH 14/35] Added missing import

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/cmd/rollback_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/cmd/rollback_test.go b/pkg/cmd/rollback_test.go
index 2e523a5f6..00b314a4e 100644
--- a/pkg/cmd/rollback_test.go
+++ b/pkg/cmd/rollback_test.go
@@ -23,6 +23,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"helm.sh/helm/v4/pkg/action"
 
 	chart "helm.sh/helm/v4/pkg/chart/v2"
 	"helm.sh/helm/v4/pkg/release/common"

From f3edb83df48c505878ffd3ebb89ef6a809e14008 Mon Sep 17 00:00:00 2001
From: MrJack <36191829+biagiopietro@users.noreply.github.com>
Date: Mon, 27 Jul 2026 14:46:55 +0200
Subject: [PATCH 15/35] Make golangci-lint happy

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>
---
 pkg/cmd/rollback_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/cmd/rollback_test.go b/pkg/cmd/rollback_test.go
index 00b314a4e..1a617b228 100644
--- a/pkg/cmd/rollback_test.go
+++ b/pkg/cmd/rollback_test.go
@@ -23,8 +23,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"helm.sh/helm/v4/pkg/action"
 
+	"helm.sh/helm/v4/pkg/action"
 	chart "helm.sh/helm/v4/pkg/chart/v2"
 	"helm.sh/helm/v4/pkg/release/common"
 	release "helm.sh/helm/v4/pkg/release/v1"

From bbaf420a101379dad4f8452129cf26f2fff7e536 Mon Sep 17 00:00:00 2001
From: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Date: Mon, 27 Jul 2026 10:42:43 -0500
Subject: [PATCH 16/35] fix(scripts): address cache-busting review feedback

Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
---
 scripts/get-helm-3 | 4 ++--
 scripts/get-helm-4 | 8 +++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index dad66ab20..117ae3e03 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -114,8 +114,8 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    # Append a cache-busting query string to avoid CDN edge servers
-    # serving stale version files after a new release.
+    # The current CDN does not revalidate on the request no-cache directive,
+    # so use a unique query while retaining no-cache for compliant intermediaries.
     local latest_release_url="https://get.helm.sh/helm3-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
diff --git a/scripts/get-helm-4 b/scripts/get-helm-4
index 1c90bbad5..0ff312a7f 100644
--- a/scripts/get-helm-4
+++ b/scripts/get-helm-4
@@ -114,12 +114,14 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    local latest_release_url="https://get.helm.sh/helm4-latest-version"
+    # The current CDN does not revalidate on the request no-cache directive,
+    # so use a unique query while retaining no-cache for compliant intermediaries.
+    local latest_release_url="https://get.helm.sh/helm4-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
-      latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true )
+      latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
     TAG=$( echo "$latest_release_response" | grep '^v[0-9]' )
     if [ "x$TAG" == "x" ]; then

From 24bbb46c62a54000394ce77c4e3fda17d5566ffc Mon Sep 17 00:00:00 2001
From: Matthieu MOREL <matthieu.morel35@gmail.com>
Date: Mon, 27 Jul 2026 19:53:24 +0200
Subject: [PATCH 17/35] chore: fix gofumpt issues

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
---
 .golangci.yml                                 |   5 +
 internal/chart/v3/lint/lint_test.go           |  18 ++-
 .../chart/v3/lint/rules/chartfile_test.go     |  22 +--
 internal/chart/v3/lint/rules/template_test.go |  17 +-
 .../chart/v3/lint/support/message_test.go     |   2 +-
 internal/monocular/client.go                  |   1 -
 .../plugin/installer/http_installer_test.go   |   4 +-
 .../plugin/installer/vcs_installer_test.go    |   1 +
 internal/plugin/loader.go                     |   1 -
 internal/plugin/metadata.go                   |   3 +-
 internal/plugin/verify_test.go                |   6 +-
 internal/release/v2/release.go                |   6 +-
 .../release/v2/util/manifest_sorter_test.go   |  15 +-
 internal/third_party/dep/fs/fs_test.go        |  12 +-
 internal/tlsutil/tls.go                       |   3 +-
 pkg/action/get_metadata_test.go               |   2 +-
 pkg/action/hooks.go                           |  12 +-
 pkg/action/hooks_test.go                      |  10 +-
 pkg/action/install.go                         |   1 -
 pkg/action/install_test.go                    |   4 +
 pkg/action/list.go                            |   3 +-
 pkg/action/release_testing.go                 |   1 -
 pkg/action/rollback.go                        |   1 -
 pkg/action/uninstall.go                       |   1 -
 pkg/action/uninstall_test.go                  |   1 +
 pkg/chart/common.go                           |   8 +-
 pkg/chart/common/capabilities.go              |   1 -
 pkg/chart/v2/lint/lint_test.go                |  18 ++-
 pkg/chart/v2/lint/rules/chartfile.go          |   1 -
 pkg/chart/v2/lint/rules/chartfile_test.go     |  26 +--
 pkg/chart/v2/lint/rules/template_test.go      |  11 +-
 pkg/chart/v2/lint/support/message_test.go     |   2 +-
 pkg/chart/v2/loader/load_test.go              |   3 +-
 pkg/cmd/completion.go                         |   1 +
 pkg/cmd/dependency_build_test.go              |   3 -
 pkg/cmd/dependency_test.go                    |  12 +-
 pkg/cmd/dependency_update_test.go             |   1 -
 pkg/cmd/flags.go                              |   1 -
 pkg/cmd/get_hooks.go                          |   1 -
 pkg/cmd/get_manifest.go                       |   1 -
 pkg/cmd/get_metadata.go                       |   1 -
 pkg/cmd/get_notes.go                          |   1 -
 pkg/cmd/get_values.go                         |   1 -
 pkg/cmd/load_plugins.go                       |   1 -
 pkg/cmd/pull.go                               |   1 -
 pkg/cmd/pull_test.go                          |   3 +-
 pkg/cmd/push.go                               |   1 -
 pkg/cmd/repo_remove_test.go                   |   4 +-
 pkg/cmd/repo_update_test.go                   |   2 +-
 pkg/cmd/root.go                               |   3 -
 pkg/cmd/search_hub_test.go                    |  10 +-
 pkg/cmd/search_repo_test.go                   |   3 +-
 pkg/cmd/show.go                               |   1 -
 pkg/cmd/status_test.go                        |   3 +-
 pkg/cmd/template.go                           |   1 -
 pkg/engine/engine.go                          |   8 +-
 pkg/engine/engine_test.go                     |   1 +
 pkg/engine/funcs.go                           |   1 -
 pkg/engine/funcs_test.go                      | 152 +++++++++---------
 pkg/getter/ocigetter.go                       |   1 -
 pkg/getter/plugingetter.go                    |   1 -
 pkg/getter/plugingetter_test.go               |   1 -
 pkg/kube/client.go                            |   6 +-
 pkg/kube/client_test.go                       |   3 +-
 pkg/kube/converter.go                         |   8 +-
 pkg/provenance/sign.go                        |   1 -
 pkg/registry/client.go                        |   4 +-
 pkg/registry/client_scope_test.go             |   1 +
 pkg/release/common.go                         |   4 +-
 pkg/release/v1/release.go                     |   6 +-
 pkg/release/v1/util/manifest_sorter_test.go   |  15 +-
 pkg/repo/v1/index_test.go                     |   2 +-
 pkg/repo/v1/repo_test.go                      |  10 +-
 pkg/storage/driver/labels_test.go             |   2 +-
 pkg/storage/driver/memory_test.go             |  10 +-
 pkg/storage/driver/records_test.go            |  12 +-
 pkg/storage/driver/sql.go                     |  21 +--
 pkg/storage/driver/util_test.go               |   4 +-
 pkg/storage/storage_test.go                   |   9 +-
 pkg/strvals/literal_parser_test.go            |   3 +-
 pkg/strvals/parser_test.go                    |   3 +-
 81 files changed, 307 insertions(+), 260 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 5b6d7cf8e..9daa85ad5 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,6 +1,7 @@
 formatters:
   enable:
     - gofmt
+    - gofumpt
     - goimports
 
   exclusions:
@@ -10,6 +11,10 @@ formatters:
     gofmt:
       simplify: true
 
+    gofumpt:
+      module-path: helm.sh/helm/v4
+      extra-rules: false
+
     goimports:
       local-prefixes:
         - helm.sh/helm/v4
diff --git a/internal/chart/v3/lint/lint_test.go b/internal/chart/v3/lint/lint_test.go
index b0a7ce651..5eb185f07 100644
--- a/internal/chart/v3/lint/lint_test.go
+++ b/internal/chart/v3/lint/lint_test.go
@@ -30,14 +30,16 @@ import (
 
 const namespace = "testNamespace"
 
-const badChartDir = "rules/testdata/badchartfile"
-const badValuesFileDir = "rules/testdata/badvaluesfile"
-const badYamlFileDir = "rules/testdata/albatross"
-const badCrdFileDir = "rules/testdata/badcrdfile"
-const goodChartDir = "rules/testdata/goodone"
-const subChartValuesDir = "rules/testdata/withsubchart"
-const malformedTemplate = "rules/testdata/malformed-template"
-const invalidChartFileDir = "rules/testdata/invalidchartfile"
+const (
+	badChartDir         = "rules/testdata/badchartfile"
+	badValuesFileDir    = "rules/testdata/badvaluesfile"
+	badYamlFileDir      = "rules/testdata/albatross"
+	badCrdFileDir       = "rules/testdata/badcrdfile"
+	goodChartDir        = "rules/testdata/goodone"
+	subChartValuesDir   = "rules/testdata/withsubchart"
+	malformedTemplate   = "rules/testdata/malformed-template"
+	invalidChartFileDir = "rules/testdata/invalidchartfile"
+)
 
 func TestBadChartV3(t *testing.T) {
 	var values map[string]any
diff --git a/internal/chart/v3/lint/rules/chartfile_test.go b/internal/chart/v3/lint/rules/chartfile_test.go
index 0638589b6..e06d7bdc4 100644
--- a/internal/chart/v3/lint/rules/chartfile_test.go
+++ b/internal/chart/v3/lint/rules/chartfile_test.go
@@ -44,8 +44,10 @@ var (
 	nonExistingChartFilePath = filepath.Join(os.TempDir(), "Chart.yaml")
 )
 
-var badChart, _ = chartutil.LoadChartfile(badChartFilePath)
-var badChartName, _ = chartutil.LoadChartfile(badChartNamePath)
+var (
+	badChart, _     = chartutil.LoadChartfile(badChartFilePath)
+	badChartName, _ = chartutil.LoadChartfile(badChartNamePath)
+)
 
 // Validation functions Test
 func TestValidateChartYamlNotDirectory(t *testing.T) {
@@ -68,7 +70,7 @@ func TestValidateChartName(t *testing.T) {
 }
 
 func TestValidateChartVersion(t *testing.T) {
-	var failTest = []struct {
+	failTest := []struct {
 		Version  string
 		ErrorMsg string
 	}{
@@ -80,7 +82,7 @@ func TestValidateChartVersion(t *testing.T) {
 		{"1", "'1' is not a valid SemVerV2"},
 	}
 
-	var successTest = []string{"0.0.1", "0.0.1+build", "0.0.1-beta"}
+	successTest := []string{"0.0.1", "0.0.1+build", "0.0.1-beta"}
 
 	for i, test := range failTest {
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
@@ -96,7 +98,7 @@ func TestValidateChartVersion(t *testing.T) {
 }
 
 func TestValidateChartMaintainer(t *testing.T) {
-	var failTest = []struct {
+	failTest := []struct {
 		Name     string
 		Email    string
 		ErrorMsg string
@@ -106,7 +108,7 @@ func TestValidateChartMaintainer(t *testing.T) {
 		{"John Snow", "wrongFormatEmail.com", "invalid email"},
 	}
 
-	var successTest = []struct {
+	successTest := []struct {
 		Name  string
 		Email string
 	}{
@@ -134,8 +136,8 @@ func TestValidateChartMaintainer(t *testing.T) {
 }
 
 func TestValidateChartSources(t *testing.T) {
-	var failTest = []string{"", "RiverRun", "john@winterfell", "riverrun.io"}
-	var successTest = []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish"}
+	failTest := []string{"", "RiverRun", "john@winterfell", "riverrun.io"}
+	successTest := []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish"}
 	for _, test := range failTest {
 		t.Run(test, func(t *testing.T) {
 			badChart.Sources = []string{test}
@@ -166,8 +168,8 @@ func TestValidateChartIconPresence(t *testing.T) {
 }
 
 func TestValidateChartIconURL(t *testing.T) {
-	var failTest = []string{"RiverRun", "john@winterfell", "riverrun.io"}
-	var successTest = []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish.png"}
+	failTest := []string{"RiverRun", "john@winterfell", "riverrun.io"}
+	successTest := []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish.png"}
 	for _, test := range failTest {
 		t.Run(test, func(t *testing.T) {
 			badChart.Icon = test
diff --git a/internal/chart/v3/lint/rules/template_test.go b/internal/chart/v3/lint/rules/template_test.go
index 3271a5bbe..4a1e15f55 100644
--- a/internal/chart/v3/lint/rules/template_test.go
+++ b/internal/chart/v3/lint/rules/template_test.go
@@ -35,11 +35,11 @@ import (
 const templateTestBasedir = "./testdata/albatross"
 
 func TestValidateAllowedExtension(t *testing.T) {
-	var failTest = []string{"/foo", "/test.toml"}
+	failTest := []string{"/foo", "/test.toml"}
 	for _, test := range failTest {
 		require.ErrorContains(t, validateAllowedExtension(test), "Valid extensions are .yaml, .yml, .tpl, or .txt", "validateAllowedExtension('%s') to return \"Valid extensions are .yaml, .yml, .tpl, or .txt\", got no error", test)
 	}
-	var successTest = []string{"/foo.yaml", "foo.yaml", "foo.tpl", "/foo/bar/baz.yaml", "NOTES.txt"}
+	successTest := []string{"/foo.yaml", "foo.yaml", "foo.tpl", "/foo/bar/baz.yaml", "NOTES.txt"}
 	for _, test := range successTest {
 		assert.NoError(t, validateAllowedExtension(test), "validateAllowedExtension('%s') to return no error", test)
 	}
@@ -47,8 +47,10 @@ func TestValidateAllowedExtension(t *testing.T) {
 
 var values = map[string]any{"nameOverride": "", "httpPort": 80}
 
-const namespace = "testNamespace"
-const strict = false
+const (
+	namespace = "testNamespace"
+	strict    = false
+)
 
 func TestTemplateParsing(t *testing.T) {
 	linter := support.Linter{ChartDir: templateTestBasedir}
@@ -59,8 +61,10 @@ func TestTemplateParsing(t *testing.T) {
 	assert.ErrorContains(t, res[0].Err, "deliberateSyntaxError")
 }
 
-var wrongTemplatePath = filepath.Join(templateTestBasedir, "templates", "fail.yaml")
-var ignoredTemplatePath = filepath.Join(templateTestBasedir, "fail.yaml.ignored")
+var (
+	wrongTemplatePath   = filepath.Join(templateTestBasedir, "templates", "fail.yaml")
+	ignoredTemplatePath = filepath.Join(templateTestBasedir, "fail.yaml.ignored")
+)
 
 // Test a template with all the existing features:
 // namespaces, partial templates
@@ -382,6 +386,7 @@ func TestEmptyWithCommentsManifests(t *testing.T) {
 	}
 	require.Empty(t, linter.Messages, "Expected 0 lint errors")
 }
+
 func TestValidateListAnnotations(t *testing.T) {
 	md := &k8sYamlStruct{
 		APIVersion: "v1",
diff --git a/internal/chart/v3/lint/support/message_test.go b/internal/chart/v3/lint/support/message_test.go
index d07cf9ed4..6edd9261f 100644
--- a/internal/chart/v3/lint/support/message_test.go
+++ b/internal/chart/v3/lint/support/message_test.go
@@ -27,7 +27,7 @@ import (
 var errLint = errors.New("lint failed")
 
 func TestRunLinterRule(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		Severity                int
 		LintError               error
 		ExpectedMessages        int
diff --git a/internal/monocular/client.go b/internal/monocular/client.go
index cd1a0d666..a6e6be0d4 100644
--- a/internal/monocular/client.go
+++ b/internal/monocular/client.go
@@ -26,7 +26,6 @@ var ErrHostnameNotProvided = errors.New("no hostname provided")
 
 // Client represents a client capable of communicating with the Monocular API.
 type Client struct {
-
 	// The base URL for requests
 	BaseURL string
 }
diff --git a/internal/plugin/installer/http_installer_test.go b/internal/plugin/installer/http_installer_test.go
index df8385ed6..3ae813b14 100644
--- a/internal/plugin/installer/http_installer_test.go
+++ b/internal/plugin/installer/http_installer_test.go
@@ -173,7 +173,7 @@ func TestExtract(t *testing.T) {
 	// Write a tarball to a buffer for us to extract
 	var tarbuf bytes.Buffer
 	tw := tar.NewWriter(&tarbuf)
-	var files = []struct {
+	files := []struct {
 		Name, Body string
 		Mode       int64
 	}{
@@ -293,7 +293,7 @@ func TestExtractWithNestedDirectories(t *testing.T) {
 	// Write a tarball with nested directory structure
 	var tarbuf bytes.Buffer
 	tw := tar.NewWriter(&tarbuf)
-	var files = []struct {
+	files := []struct {
 		Name     string
 		Body     string
 		Mode     int64
diff --git a/internal/plugin/installer/vcs_installer_test.go b/internal/plugin/installer/vcs_installer_test.go
index 82401d069..0fee301a4 100644
--- a/internal/plugin/installer/vcs_installer_test.go
+++ b/internal/plugin/installer/vcs_installer_test.go
@@ -105,6 +105,7 @@ func TestVCSInstallerNonExistentVersion(t *testing.T) {
 	}
 	require.EqualErrorf(t, err, fmt.Sprintf("requested version %q does not exist for plugin %q", version, source), "expected error for version does not exists")
 }
+
 func TestVCSInstallerUpdate(t *testing.T) {
 	ensure.HelmHome(t)
 
diff --git a/internal/plugin/loader.go b/internal/plugin/loader.go
index cfa618f39..af9e175b4 100644
--- a/internal/plugin/loader.go
+++ b/internal/plugin/loader.go
@@ -216,7 +216,6 @@ func findPlugins(pluginsDirs []string, findFn findFunc, filterFn filterFunc) ([]
 	var found []Plugin
 	for _, pluginsDir := range pluginsDirs {
 		ps, err := findFn(pluginsDir)
-
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/plugin/metadata.go b/internal/plugin/metadata.go
index 53d6da4e6..ad42fe98a 100644
--- a/internal/plugin/metadata.go
+++ b/internal/plugin/metadata.go
@@ -154,8 +154,7 @@ func buildLegacyConfig(m MetadataLegacy, pluginType string) Config {
 func buildLegacyRuntimeConfig(m MetadataLegacy) RuntimeConfig {
 	var protocolCommands []SubprocessProtocolCommand
 	if len(m.Downloaders) > 0 {
-		protocolCommands =
-			make([]SubprocessProtocolCommand, 0, len(m.Downloaders))
+		protocolCommands = make([]SubprocessProtocolCommand, 0, len(m.Downloaders))
 		for _, d := range m.Downloaders {
 			protocolCommands = append(protocolCommands, SubprocessProtocolCommand{
 				Protocols:       d.Protocols,
diff --git a/internal/plugin/verify_test.go b/internal/plugin/verify_test.go
index 4f5b26a97..ab7238973 100644
--- a/internal/plugin/verify_test.go
+++ b/internal/plugin/verify_test.go
@@ -26,8 +26,10 @@ import (
 	"helm.sh/helm/v4/pkg/provenance"
 )
 
-const testKeyFile = "../../pkg/cmd/testdata/helm-test-key.secret"
-const testPubFile = "../../pkg/cmd/testdata/helm-test-key.pub"
+const (
+	testKeyFile = "../../pkg/cmd/testdata/helm-test-key.secret"
+	testPubFile = "../../pkg/cmd/testdata/helm-test-key.pub"
+)
 
 const testPluginYAML = `apiVersion: v1
 name: test-plugin
diff --git a/internal/release/v2/release.go b/internal/release/v2/release.go
index 8b8f2ee07..d32a1cdc4 100644
--- a/internal/release/v2/release.go
+++ b/internal/release/v2/release.go
@@ -22,8 +22,10 @@ import (
 
 type ApplyMethod string
 
-const ApplyMethodClientSideApply ApplyMethod = "csa"
-const ApplyMethodServerSideApply ApplyMethod = "ssa"
+const (
+	ApplyMethodClientSideApply ApplyMethod = "csa"
+	ApplyMethodServerSideApply ApplyMethod = "ssa"
+)
 
 // Release describes a deployment of a chart, together with the chart
 // and the variables used to deploy that chart.
diff --git a/internal/release/v2/util/manifest_sorter_test.go b/internal/release/v2/util/manifest_sorter_test.go
index 6cf529bff..e132ef072 100644
--- a/internal/release/v2/util/manifest_sorter_test.go
+++ b/internal/release/v2/util/manifest_sorter_test.go
@@ -61,7 +61,8 @@ metadata:
   annotations:
     "helm.sh/hook": post-install
 `,
-		}, {
+		},
+		{
 			name:  []string{"third"},
 			path:  "three",
 			kind:  []string{"ReplicaSet"},
@@ -73,7 +74,8 @@ metadata:
   annotations:
     "helm.sh/hook": no-such-hook
 `,
-		}, {
+		},
+		{
 			name:  []string{"fourth"},
 			path:  "four",
 			kind:  []string{"Pod"},
@@ -84,7 +86,8 @@ metadata:
   name: fourth
   annotations:
     nothing: here`,
-		}, {
+		},
+		{
 			name:  []string{"fifth"},
 			path:  "five",
 			kind:  []string{"ReplicaSet"},
@@ -96,14 +99,16 @@ metadata:
   annotations:
     "helm.sh/hook": post-delete, post-install
 `,
-		}, {
+		},
+		{
 			// Regression test: files with an underscore in the base name should be skipped.
 			name:     []string{"sixth"},
 			path:     "six/_six",
 			kind:     []string{"ReplicaSet"},
 			hooks:    map[string][]release.HookEvent{"sixth": nil},
 			manifest: `invalid manifest`, // This will fail if partial is not skipped.
-		}, {
+		},
+		{
 			// Regression test: files with no content should be skipped.
 			name:     []string{"seventh"},
 			path:     "seven",
diff --git a/internal/third_party/dep/fs/fs_test.go b/internal/third_party/dep/fs/fs_test.go
index d777b6af4..eb910d6c7 100644
--- a/internal/third_party/dep/fs/fs_test.go
+++ b/internal/third_party/dep/fs/fs_test.go
@@ -126,7 +126,7 @@ func TestCopyDirFail_SrcInaccessible(t *testing.T) {
 		t.Skip("skipping on windows")
 	}
 
-	var currentUID = os.Getuid()
+	currentUID := os.Getuid()
 
 	if currentUID == 0 {
 		// Skipping if root, because all files are accessible
@@ -155,7 +155,7 @@ func TestCopyDirFail_DstInaccessible(t *testing.T) {
 		t.Skip("skipping on windows")
 	}
 
-	var currentUID = os.Getuid()
+	currentUID := os.Getuid()
 
 	if currentUID == 0 {
 		// Skipping if root, because all files are accessible
@@ -217,7 +217,7 @@ func TestCopyDirFailOpen(t *testing.T) {
 		t.Skip("skipping on windows")
 	}
 
-	var currentUID = os.Getuid()
+	currentUID := os.Getuid()
 
 	if currentUID == 0 {
 		// Skipping if root, because all files are accessible
@@ -319,7 +319,7 @@ func TestCopyFileFail(t *testing.T) {
 		t.Skip("skipping on windows")
 	}
 
-	var currentUID = os.Getuid()
+	currentUID := os.Getuid()
 
 	if currentUID == 0 {
 		// Skipping if root, because all files are accessible
@@ -389,7 +389,7 @@ func setupInaccessibleDir(t *testing.T, op func(dir string) error) func() {
 }
 
 func TestIsDir(t *testing.T) {
-	var currentUID = os.Getuid()
+	currentUID := os.Getuid()
 
 	if currentUID == 0 {
 		// Skipping if root, because all files are accessible
@@ -441,7 +441,7 @@ func TestIsDir(t *testing.T) {
 }
 
 func TestIsSymlink(t *testing.T) {
-	var currentUID = os.Getuid()
+	currentUID := os.Getuid()
 
 	if currentUID == 0 {
 		// Skipping if root, because all files are accessible
diff --git a/internal/tlsutil/tls.go b/internal/tlsutil/tls.go
index e986e6909..d0123daf5 100644
--- a/internal/tlsutil/tls.go
+++ b/internal/tlsutil/tls.go
@@ -19,10 +19,9 @@ package tlsutil
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"os"
-
-	"errors"
 )
 
 type TLSConfigOptions struct {
diff --git a/pkg/action/get_metadata_test.go b/pkg/action/get_metadata_test.go
index f8851e456..9e32d840c 100644
--- a/pkg/action/get_metadata_test.go
+++ b/pkg/action/get_metadata_test.go
@@ -546,7 +546,7 @@ func TestMetadata_FormattedDepNames(t *testing.T) {
 }
 
 func convertDeps(deps []*chart.Dependency) []ci.Dependency {
-	var newDeps = make([]ci.Dependency, len(deps))
+	newDeps := make([]ci.Dependency, len(deps))
 	for i, c := range deps {
 		newDeps[i] = c
 	}
diff --git a/pkg/action/hooks.go b/pkg/action/hooks.go
index d7824d69f..3c434e291 100644
--- a/pkg/action/hooks.go
+++ b/pkg/action/hooks.go
@@ -34,7 +34,8 @@ import (
 // execHook executes all of the hooks for the given hook event.
 func (cfg *Configuration) execHook(rl *release.Release, hook release.HookEvent,
 	waitStrategy kube.WaitStrategy, waitOptions []kube.WaitOption,
-	timeout time.Duration, serverSideApply bool) error {
+	timeout time.Duration, serverSideApply bool,
+) error {
 	shutdown, err := cfg.execHookWithDelayedShutdown(rl, hook, waitStrategy, waitOptions, timeout, serverSideApply)
 	if shutdown == nil {
 		return err
@@ -57,7 +58,8 @@ func shutdownNoOp() error {
 // execHookWithDelayedShutdown executes all of the hooks for the given hook event and returns a shutdownHook function to trigger deletions after doing other things like e.g. retrieving logs.
 func (cfg *Configuration) execHookWithDelayedShutdown(rl *release.Release, hook release.HookEvent,
 	waitStrategy kube.WaitStrategy, waitOptions []kube.WaitOption, timeout time.Duration,
-	serverSideApply bool) (ExecuteShutdownFunc, error) {
+	serverSideApply bool,
+) (ExecuteShutdownFunc, error) {
 	executingHooks := []*release.Hook{}
 
 	for _, h := range rl.Hooks {
@@ -176,7 +178,8 @@ func (x hookByWeight) Less(i, j int) bool {
 
 // deleteHookByPolicy deletes a hook if the hook policy instructs it to
 func (cfg *Configuration) deleteHookByPolicy(h *release.Hook, policy release.HookDeletePolicy,
-	waitStrategy kube.WaitStrategy, waitOptions []kube.WaitOption, timeout time.Duration) error {
+	waitStrategy kube.WaitStrategy, waitOptions []kube.WaitOption, timeout time.Duration,
+) error {
 	// Never delete CustomResourceDefinitions; this could cause lots of
 	// cascading garbage collection.
 	if h.Kind == "CustomResourceDefinition" {
@@ -210,7 +213,8 @@ func (cfg *Configuration) deleteHookByPolicy(h *release.Hook, policy release.Hoo
 
 // deleteHooksByPolicy deletes all hooks if the hook policy instructs it to
 func (cfg *Configuration) deleteHooksByPolicy(hooks []*release.Hook, policy release.HookDeletePolicy,
-	waitStrategy kube.WaitStrategy, waitOptions []kube.WaitOption, timeout time.Duration) error {
+	waitStrategy kube.WaitStrategy, waitOptions []kube.WaitOption, timeout time.Duration,
+) error {
 	for _, h := range hooks {
 		if err := cfg.deleteHookByPolicy(h, policy, waitStrategy, waitOptions, timeout); err != nil {
 			return err
diff --git a/pkg/action/hooks_test.go b/pkg/action/hooks_test.go
index ad3a4b618..4cb176d36 100644
--- a/pkg/action/hooks_test.go
+++ b/pkg/action/hooks_test.go
@@ -252,7 +252,6 @@ func (*HookFailingKubeClient) Build(reader io.Reader, _ bool) (kube.ResourceList
 	configMap := &v1.ConfigMap{}
 
 	err := yaml.NewYAMLOrJSONDecoder(reader, 1000).Decode(configMap)
-
 	if err != nil {
 		return kube.ResourceList{}, err
 	}
@@ -358,10 +357,12 @@ data:
 						},
 					},
 				},
-			}, resource.Info{
+			},
+			resource.Info{
 				Name:      "build-config-2",
 				Namespace: "test",
-			}, []resource.Info{
+			},
+			[]resource.Info{
 				{
 					// This should be in the record for `before-hook-creation`
 					Name:      "build-config-1",
@@ -382,7 +383,8 @@ data:
 					Name:      "build-config-1",
 					Namespace: "test",
 				},
-			}, true,
+			},
+			true,
 		},
 	}
 
diff --git a/pkg/action/install.go b/pkg/action/install.go
index d73eca619..605c423bc 100644
--- a/pkg/action/install.go
+++ b/pkg/action/install.go
@@ -733,7 +733,6 @@ func writeToFile(outputDir string, name string, data string, appendData bool) er
 	defer f.Close()
 
 	_, err = fmt.Fprintf(f, "---\n# Source: %s\n%s\n", name, data)
-
 	if err != nil {
 		return err
 	}
diff --git a/pkg/action/install_test.go b/pkg/action/install_test.go
index 4dbeb7c79..80f3bd724 100644
--- a/pkg/action/install_test.go
+++ b/pkg/action/install_test.go
@@ -631,6 +631,7 @@ func TestInstallRelease_Wait(t *testing.T) {
 
 	is.Equal(goroutines, instAction.getGoroutineCount())
 }
+
 func TestInstallRelease_Wait_Interrupted(t *testing.T) {
 	is := assert.New(t)
 	req := require.New(t)
@@ -655,6 +656,7 @@ func TestInstallRelease_Wait_Interrupted(t *testing.T) {
 	time.Sleep(10 * time.Second)                           // wait for goroutine to finish
 	is.Equal(goroutines, instAction.getGoroutineCount())
 }
+
 func TestInstallRelease_WaitForJobs(t *testing.T) {
 	is := assert.New(t)
 	req := require.New(t)
@@ -722,6 +724,7 @@ func TestInstallRelease_RollbackOnFailure(t *testing.T) {
 		is.ErrorContains(err, "an error occurred while uninstalling the release")
 	})
 }
+
 func TestInstallRelease_RollbackOnFailure_Interrupted(t *testing.T) {
 	is := assert.New(t)
 	req := require.New(t)
@@ -754,6 +757,7 @@ func TestInstallRelease_RollbackOnFailure_Interrupted(t *testing.T) {
 	time.Sleep(10 * time.Second)                           // wait for goroutine to finish
 	is.Equal(goroutines, instAction.getGoroutineCount())
 }
+
 func TestNameTemplate(t *testing.T) {
 	testCases := []nameTemplateTestCase{
 		// Just a straight up nop please
diff --git a/pkg/action/list.go b/pkg/action/list.go
index a055f760d..7902837fd 100644
--- a/pkg/action/list.go
+++ b/pkg/action/list.go
@@ -172,7 +172,6 @@ func (l *List) Run() ([]ri.Releaser, error) {
 
 		return true
 	})
-
 	if err != nil {
 		return nil, err
 	}
@@ -264,7 +263,7 @@ func filterLatestReleases(releases []*release.Release) []*release.Release {
 		latestReleases[key] = rls
 	}
 
-	var list = make([]*release.Release, 0, len(latestReleases))
+	list := make([]*release.Release, 0, len(latestReleases))
 	for _, rls := range latestReleases {
 		list = append(list, rls)
 	}
diff --git a/pkg/action/release_testing.go b/pkg/action/release_testing.go
index 5604e8cc4..6edb644c1 100644
--- a/pkg/action/release_testing.go
+++ b/pkg/action/release_testing.go
@@ -107,7 +107,6 @@ func (r *ReleaseTesting) Run(name string) (ri.Releaser, ExecuteShutdownFunc, err
 
 	serverSideApply := rel.ApplyMethod == string(release.ApplyMethodServerSideApply)
 	shutdown, err := r.cfg.execHookWithDelayedShutdown(rel, release.HookTest, kube.StatusWatcherStrategy, r.WaitOptions, r.Timeout, serverSideApply)
-
 	if err != nil {
 		rel.Hooks = append(skippedHooks, rel.Hooks...)
 		r.cfg.Releases.Update(reli)
diff --git a/pkg/action/rollback.go b/pkg/action/rollback.go
index 6fc449c30..f2cdaf177 100644
--- a/pkg/action/rollback.go
+++ b/pkg/action/rollback.go
@@ -232,7 +232,6 @@ func (r *Rollback) performRollback(currentRelease, targetRelease *release.Releas
 		kube.ClientUpdateOptionServerSideApply(serverSideApply, r.ForceConflicts),
 		kube.ClientUpdateOptionThreeWayMergeForUnstructured(false),
 		kube.ClientUpdateOptionUpgradeClientSideFieldManager(true))
-
 	if err != nil {
 		msg := fmt.Sprintf("Rollback %q failed: %s", targetRelease.Name, err)
 		r.cfg.Logger().Warn(msg)
diff --git a/pkg/action/uninstall.go b/pkg/action/uninstall.go
index 47b2e47de..4d2c728db 100644
--- a/pkg/action/uninstall.go
+++ b/pkg/action/uninstall.go
@@ -77,7 +77,6 @@ func (u *Uninstall) Run(name string) (*releasei.UninstallReleaseResponse, error)
 
 	if u.DryRun {
 		ri, err := u.cfg.releaseContent(name, 0)
-
 		if err != nil {
 			if u.IgnoreNotFound && errors.Is(err, driver.ErrReleaseNotFound) {
 				return nil, nil
diff --git a/pkg/action/uninstall_test.go b/pkg/action/uninstall_test.go
index f36fe7874..e306935c7 100644
--- a/pkg/action/uninstall_test.go
+++ b/pkg/action/uninstall_test.go
@@ -59,6 +59,7 @@ func TestUninstallRelease_ignoreNotFound(t *testing.T) {
 	is.Nil(res)
 	is.NoError(err)
 }
+
 func TestUninstallRelease_deleteRelease(t *testing.T) {
 	is := assert.New(t)
 	req := require.New(t)
diff --git a/pkg/chart/common.go b/pkg/chart/common.go
index cec2c7091..be68eeb42 100644
--- a/pkg/chart/common.go
+++ b/pkg/chart/common.go
@@ -85,7 +85,7 @@ func (r *v2Accessor) IsLibraryChart() bool {
 }
 
 func (r *v2Accessor) Dependencies() []Charter {
-	var deps = make([]Charter, len(r.chrt.Dependencies()))
+	deps := make([]Charter, len(r.chrt.Dependencies()))
 	for i, c := range r.chrt.Dependencies() {
 		deps[i] = c
 	}
@@ -93,7 +93,7 @@ func (r *v2Accessor) Dependencies() []Charter {
 }
 
 func (r *v2Accessor) MetaDependencies() []Dependency {
-	var deps = make([]Dependency, len(r.chrt.Metadata.Dependencies))
+	deps := make([]Dependency, len(r.chrt.Metadata.Dependencies))
 	for i, c := range r.chrt.Metadata.Dependencies {
 		deps[i] = c
 	}
@@ -154,7 +154,7 @@ func (r *v3Accessor) IsLibraryChart() bool {
 }
 
 func (r *v3Accessor) Dependencies() []Charter {
-	var deps = make([]Charter, len(r.chrt.Dependencies()))
+	deps := make([]Charter, len(r.chrt.Dependencies()))
 	for i, c := range r.chrt.Dependencies() {
 		deps[i] = c
 	}
@@ -162,7 +162,7 @@ func (r *v3Accessor) Dependencies() []Charter {
 }
 
 func (r *v3Accessor) MetaDependencies() []Dependency {
-	var deps = make([]Dependency, len(r.chrt.Dependencies()))
+	deps := make([]Dependency, len(r.chrt.Dependencies()))
 	for i, c := range r.chrt.Metadata.Dependencies {
 		deps[i] = c
 	}
diff --git a/pkg/chart/common/capabilities.go b/pkg/chart/common/capabilities.go
index 16910acaa..a9374a86f 100644
--- a/pkg/chart/common/capabilities.go
+++ b/pkg/chart/common/capabilities.go
@@ -47,7 +47,6 @@ var (
 			panic(fmt.Sprintf("failed to create default capabilities: %v", err))
 		}
 		return caps
-
 	}()
 )
 
diff --git a/pkg/chart/v2/lint/lint_test.go b/pkg/chart/v2/lint/lint_test.go
index c4705872d..8ff88b05c 100644
--- a/pkg/chart/v2/lint/lint_test.go
+++ b/pkg/chart/v2/lint/lint_test.go
@@ -30,14 +30,16 @@ import (
 
 const namespace = "testNamespace"
 
-const badChartDir = "rules/testdata/badchartfile"
-const badValuesFileDir = "rules/testdata/badvaluesfile"
-const badYamlFileDir = "rules/testdata/albatross"
-const badCrdFileDir = "rules/testdata/badcrdfile"
-const goodChartDir = "rules/testdata/goodone"
-const subChartValuesDir = "rules/testdata/withsubchart"
-const malformedTemplate = "rules/testdata/malformed-template"
-const invalidChartFileDir = "rules/testdata/invalidchartfile"
+const (
+	badChartDir         = "rules/testdata/badchartfile"
+	badValuesFileDir    = "rules/testdata/badvaluesfile"
+	badYamlFileDir      = "rules/testdata/albatross"
+	badCrdFileDir       = "rules/testdata/badcrdfile"
+	goodChartDir        = "rules/testdata/goodone"
+	subChartValuesDir   = "rules/testdata/withsubchart"
+	malformedTemplate   = "rules/testdata/malformed-template"
+	invalidChartFileDir = "rules/testdata/invalidchartfile"
+)
 
 func TestBadChart(t *testing.T) {
 	var values map[string]any
diff --git a/pkg/chart/v2/lint/rules/chartfile.go b/pkg/chart/v2/lint/rules/chartfile.go
index f867daa21..ec4083951 100644
--- a/pkg/chart/v2/lint/rules/chartfile.go
+++ b/pkg/chart/v2/lint/rules/chartfile.go
@@ -161,7 +161,6 @@ func validateChartVersion(cf *chart.Metadata) error {
 
 func validateChartVersionStrictSemVerV2(cf *chart.Metadata) error {
 	_, err := semver.StrictNewVersion(cf.Version)
-
 	if err != nil {
 		return fmt.Errorf("version '%s' is not a valid SemVerV2", cf.Version)
 	}
diff --git a/pkg/chart/v2/lint/rules/chartfile_test.go b/pkg/chart/v2/lint/rules/chartfile_test.go
index 1cc331a74..90f5edd5c 100644
--- a/pkg/chart/v2/lint/rules/chartfile_test.go
+++ b/pkg/chart/v2/lint/rules/chartfile_test.go
@@ -42,8 +42,10 @@ var (
 	nonExistingChartFilePath = filepath.Join(os.TempDir(), "Chart.yaml")
 )
 
-var badChart, _ = chartutil.LoadChartfile(badChartFilePath)
-var badChartName, _ = chartutil.LoadChartfile(badChartNamePath)
+var (
+	badChart, _     = chartutil.LoadChartfile(badChartFilePath)
+	badChartName, _ = chartutil.LoadChartfile(badChartNamePath)
+)
 
 // Validation functions Test
 func TestValidateChartYamlNotDirectory(t *testing.T) {
@@ -63,7 +65,7 @@ func TestValidateChartName(t *testing.T) {
 }
 
 func TestValidateChartVersion(t *testing.T) {
-	var failTest = []struct {
+	failTest := []struct {
 		Version  string
 		ErrorMsg string
 	}{
@@ -73,7 +75,7 @@ func TestValidateChartVersion(t *testing.T) {
 		{"-3", "'-3' is not a valid SemVer"},
 	}
 
-	var successTest = []string{"0.0.1", "0.0.1+build", "0.0.1-beta"}
+	successTest := []string{"0.0.1", "0.0.1+build", "0.0.1-beta"}
 
 	for _, test := range failTest {
 		badChart.Version = test.Version
@@ -87,7 +89,7 @@ func TestValidateChartVersion(t *testing.T) {
 }
 
 func TestValidateChartVersionStrictSemVerV2(t *testing.T) {
-	var failTest = []struct {
+	failTest := []struct {
 		Version  string
 		ErrorMsg string
 	}{
@@ -96,7 +98,7 @@ func TestValidateChartVersionStrictSemVerV2(t *testing.T) {
 		{"1.1", "version '1.1' is not a valid SemVerV2"},
 	}
 
-	var successTest = []string{"1.1.1", "0.0.1+build", "0.0.1-beta"}
+	successTest := []string{"1.1.1", "0.0.1+build", "0.0.1-beta"}
 
 	for _, test := range failTest {
 		badChart.Version = test.Version
@@ -110,7 +112,7 @@ func TestValidateChartVersionStrictSemVerV2(t *testing.T) {
 }
 
 func TestValidateChartMaintainer(t *testing.T) {
-	var failTest = []struct {
+	failTest := []struct {
 		Name     string
 		Email    string
 		ErrorMsg string
@@ -120,7 +122,7 @@ func TestValidateChartMaintainer(t *testing.T) {
 		{"John Snow", "wrongFormatEmail.com", "invalid email"},
 	}
 
-	var successTest = []struct {
+	successTest := []struct {
 		Name  string
 		Email string
 	}{
@@ -144,8 +146,8 @@ func TestValidateChartMaintainer(t *testing.T) {
 }
 
 func TestValidateChartSources(t *testing.T) {
-	var failTest = []string{"", "RiverRun", "john@winterfell", "riverrun.io"}
-	var successTest = []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish"}
+	failTest := []string{"", "RiverRun", "john@winterfell", "riverrun.io"}
+	successTest := []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish"}
 	for _, test := range failTest {
 		badChart.Sources = []string{test}
 		require.ErrorContainsf(t, validateChartSources(badChart), "invalid source URL", "validateChartSources(%s) to return \"invalid source URL\", got no error", test)
@@ -174,8 +176,8 @@ func TestValidateChartIconPresence(t *testing.T) {
 }
 
 func TestValidateChartIconURL(t *testing.T) {
-	var failTest = []string{"RiverRun", "john@winterfell", "riverrun.io"}
-	var successTest = []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish.png"}
+	failTest := []string{"RiverRun", "john@winterfell", "riverrun.io"}
+	successTest := []string{"http://riverrun.io", "https://riverrun.io", "https://riverrun.io/blackfish.png"}
 	for _, test := range failTest {
 		badChart.Icon = test
 		require.ErrorContainsf(t, validateChartIconURL(badChart), "invalid icon URL", "validateChartIconURL(%s) to return \"invalid icon URL\", got no error", test)
diff --git a/pkg/chart/v2/lint/rules/template_test.go b/pkg/chart/v2/lint/rules/template_test.go
index ab78450b9..3f350557b 100644
--- a/pkg/chart/v2/lint/rules/template_test.go
+++ b/pkg/chart/v2/lint/rules/template_test.go
@@ -35,11 +35,11 @@ import (
 const templateTestBasedir = "./testdata/albatross"
 
 func TestValidateAllowedExtension(t *testing.T) {
-	var failTest = []string{"/foo", "/test.toml"}
+	failTest := []string{"/foo", "/test.toml"}
 	for _, test := range failTest {
 		require.ErrorContainsf(t, validateAllowedExtension(test), "Valid extensions are .yaml, .yml, .tpl, or .txt", "validateAllowedExtension('%s') to return \"Valid extensions are .yaml, .yml, .tpl, or .txt\", got no error", test)
 	}
-	var successTest = []string{"/foo.yaml", "foo.yaml", "foo.tpl", "/foo/bar/baz.yaml", "NOTES.txt"}
+	successTest := []string{"/foo.yaml", "foo.yaml", "foo.tpl", "/foo/bar/baz.yaml", "NOTES.txt"}
 	for _, test := range successTest {
 		assert.NoError(t, validateAllowedExtension(test), "validateAllowedExtension('%s') to return no error", test)
 	}
@@ -62,8 +62,10 @@ func TestTemplateParsing(t *testing.T) {
 	assert.ErrorContains(t, res[0].Err, "deliberateSyntaxError")
 }
 
-var wrongTemplatePath = filepath.Join(templateTestBasedir, "templates", "fail.yaml")
-var ignoredTemplatePath = filepath.Join(templateTestBasedir, "fail.yaml.ignored")
+var (
+	wrongTemplatePath   = filepath.Join(templateTestBasedir, "templates", "fail.yaml")
+	ignoredTemplatePath = filepath.Join(templateTestBasedir, "fail.yaml.ignored")
+)
 
 // Test a template with all the existing features:
 // namespaces, partial templates
@@ -406,6 +408,7 @@ func TestEmptyWithCommentsManifests(t *testing.T) {
 	}
 	require.Empty(t, linter.Messages, "Expected 0 lint errors")
 }
+
 func TestValidateListAnnotations(t *testing.T) {
 	md := &k8sYamlStruct{
 		APIVersion: "v1",
diff --git a/pkg/chart/v2/lint/support/message_test.go b/pkg/chart/v2/lint/support/message_test.go
index 6d09df688..8a4783605 100644
--- a/pkg/chart/v2/lint/support/message_test.go
+++ b/pkg/chart/v2/lint/support/message_test.go
@@ -27,7 +27,7 @@ import (
 var errLint = errors.New("lint failed")
 
 func TestRunLinterRule(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		Severity                int
 		LintError               error
 		ExpectedMessages        int
diff --git a/pkg/chart/v2/loader/load_test.go b/pkg/chart/v2/loader/load_test.go
index 4d73cb0d6..8bf254321 100644
--- a/pkg/chart/v2/loader/load_test.go
+++ b/pkg/chart/v2/loader/load_test.go
@@ -182,7 +182,8 @@ func TestLoadFiles_BadCases(t *testing.T) {
 					Data:    []byte(""),
 				},
 			},
-			expectError: "validation: chart.metadata.apiVersion is required"},
+			expectError: "validation: chart.metadata.apiVersion is required",
+		},
 	} {
 		_, err := LoadFiles(tt.bufferedFiles)
 		require.Error(t, err, "expected error when load illegal files")
diff --git a/pkg/cmd/completion.go b/pkg/cmd/completion.go
index c02462d9d..5edac8f44 100644
--- a/pkg/cmd/completion.go
+++ b/pkg/cmd/completion.go
@@ -29,6 +29,7 @@ import (
 const completionDesc = `
 Generate autocompletion scripts for Helm for the specified shell.
 `
+
 const bashCompDesc = `
 Generate the autocompletion script for Helm for the bash shell.
 
diff --git a/pkg/cmd/dependency_build_test.go b/pkg/cmd/dependency_build_test.go
index 485ae18b3..1680c23a1 100644
--- a/pkg/cmd/dependency_build_test.go
+++ b/pkg/cmd/dependency_build_test.go
@@ -59,7 +59,6 @@ func TestDependencyBuildCmd(t *testing.T) {
 
 	cmd := fmt.Sprintf("dependency build '%s' --repository-config %s --repository-cache %s --plain-http", filepath.Join(rootDir, chartname), repoFile, rootDir)
 	_, out, err := executeActionCommand(cmd)
-
 	// In the first pass, we basically want the same results as an update.
 	if err != nil {
 		t.Logf("Output: %s", out)
@@ -105,7 +104,6 @@ func TestDependencyBuildCmd(t *testing.T) {
 
 	skipRefreshCmd := fmt.Sprintf("dependency build '%s' --skip-refresh --repository-config %s --repository-cache %s --plain-http", filepath.Join(rootDir, chartname), repoFile, rootDir)
 	_, out, err = executeActionCommand(skipRefreshCmd)
-
 	// In this pass, we check --skip-refresh option becomes effective.
 	if err != nil {
 		t.Logf("Output: %s", out)
@@ -136,7 +134,6 @@ func TestDependencyBuildCmdWithHelmV2Hash(t *testing.T) {
 
 	cmd := fmt.Sprintf("dependency build '%s'", chartName)
 	_, out, err := executeActionCommand(cmd)
-
 	// Want to make sure the build can verify Helm v2 hash
 	if err != nil {
 		t.Logf("Output: %s", out)
diff --git a/pkg/cmd/dependency_test.go b/pkg/cmd/dependency_test.go
index d6bcebf1b..48ab78183 100644
--- a/pkg/cmd/dependency_test.go
+++ b/pkg/cmd/dependency_test.go
@@ -39,16 +39,20 @@ func TestDependencyListCmd(t *testing.T) {
 		noDependencies.golden = "output/dependency-list-no-requirements-windows.txt"
 	}
 
-	tests := []cmdTestCase{noSuchChart,
-		noDependencies, {
+	tests := []cmdTestCase{
+		noSuchChart,
+		noDependencies,
+		{
 			name:   "Dependencies in chart dir",
 			cmd:    "dependency list testdata/testcharts/reqtest",
 			golden: "output/dependency-list.txt",
-		}, {
+		},
+		{
 			name:   "Dependencies in chart archive",
 			cmd:    "dependency list testdata/testcharts/reqtest-0.1.0.tgz",
 			golden: "output/dependency-list-archive.txt",
-		}}
+		},
+	}
 	runTestCmd(t, tests)
 }
 
diff --git a/pkg/cmd/dependency_update_test.go b/pkg/cmd/dependency_update_test.go
index 13eb74532..34575ad4d 100644
--- a/pkg/cmd/dependency_update_test.go
+++ b/pkg/cmd/dependency_update_test.go
@@ -209,7 +209,6 @@ func TestDependencyUpdateCmd_WithRepoThatWasNotAdded(t *testing.T) {
 		fmt.Sprintf("dependency update '%s' --repository-config %s --repository-cache %s --content-cache %s", dir(chartname),
 			dir("repositories.yaml"), dir(), contentCache),
 	)
-
 	if err != nil {
 		t.Logf("Output: %s", out)
 		t.Fatal(err)
diff --git a/pkg/cmd/flags.go b/pkg/cmd/flags.go
index e59487044..45da90d0e 100644
--- a/pkg/cmd/flags.go
+++ b/pkg/cmd/flags.go
@@ -152,7 +152,6 @@ func bindOutputFlag(cmd *cobra.Command, varRef *output.Format) {
 		sort.Strings(formatNames)
 		return formatNames, cobra.ShellCompDirectiveNoFileComp
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/get_hooks.go b/pkg/cmd/get_hooks.go
index d344307cb..4d174675f 100644
--- a/pkg/cmd/get_hooks.go
+++ b/pkg/cmd/get_hooks.go
@@ -75,7 +75,6 @@ func newGetHooksCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 		}
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/get_manifest.go b/pkg/cmd/get_manifest.go
index 253b011c1..a7873e587 100644
--- a/pkg/cmd/get_manifest.go
+++ b/pkg/cmd/get_manifest.go
@@ -71,7 +71,6 @@ func newGetManifestCmd(cfg *action.Configuration, out io.Writer) *cobra.Command
 		}
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/get_metadata.go b/pkg/cmd/get_metadata.go
index c26af646f..ffbe25f99 100644
--- a/pkg/cmd/get_metadata.go
+++ b/pkg/cmd/get_metadata.go
@@ -66,7 +66,6 @@ func newGetMetadataCmd(cfg *action.Configuration, out io.Writer) *cobra.Command
 		}
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/get_notes.go b/pkg/cmd/get_notes.go
index 7f8754f3c..b6172846f 100644
--- a/pkg/cmd/get_notes.go
+++ b/pkg/cmd/get_notes.go
@@ -70,7 +70,6 @@ func newGetNotesCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 		}
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/get_values.go b/pkg/cmd/get_values.go
index c6a89b00c..5db5dec3a 100644
--- a/pkg/cmd/get_values.go
+++ b/pkg/cmd/get_values.go
@@ -69,7 +69,6 @@ func newGetValuesCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 		}
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/load_plugins.go b/pkg/cmd/load_plugins.go
index dee42f750..0c74ba51d 100644
--- a/pkg/cmd/load_plugins.go
+++ b/pkg/cmd/load_plugins.go
@@ -221,7 +221,6 @@ type pluginCommand struct {
 func loadCompletionForPlugin(pluginCmd *cobra.Command, plug plugin.Plugin) {
 	// Parse the yaml file providing the plugin's sub-commands and flags
 	cmds, err := loadFile(plug.Dir() + string(filepath.Separator) + pluginStaticCompletionFile)
-
 	if err != nil {
 		// The file could be missing or invalid.  No static completion for this plugin.
 		slog.Debug("plugin completion file loading", slog.String("error", err.Error()))
diff --git a/pkg/cmd/pull.go b/pkg/cmd/pull.go
index d371db4ad..9f5af462b 100644
--- a/pkg/cmd/pull.go
+++ b/pkg/cmd/pull.go
@@ -97,7 +97,6 @@ func newPullCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 		}
 		return compVersionFlag(args[0], toComplete)
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/pull_test.go b/pkg/cmd/pull_test.go
index d0371710b..a62d6b1b4 100644
--- a/pkg/cmd/pull_test.go
+++ b/pkg/cmd/pull_test.go
@@ -268,7 +268,8 @@ func runPullTests(t *testing.T, tests []struct {
 	wantErrorMsg string
 	expectFile   string
 	expectDir    bool
-}, outdir string, additionalFlags string) {
+}, outdir string, additionalFlags string,
+) {
 	t.Helper()
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/pkg/cmd/push.go b/pkg/cmd/push.go
index f32ce92be..df0bad643 100644
--- a/pkg/cmd/push.go
+++ b/pkg/cmd/push.go
@@ -73,7 +73,6 @@ func newPushCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 			registryClient, err := newRegistryClient(
 				out, o.certFile, o.keyFile, o.caFile, o.insecureSkipTLSVerify, o.plainHTTP, o.username, o.password,
 			)
-
 			if err != nil {
 				return fmt.Errorf("missing registry client: %w", err)
 			}
diff --git a/pkg/cmd/repo_remove_test.go b/pkg/cmd/repo_remove_test.go
index 7d252c35d..f58bc91d9 100644
--- a/pkg/cmd/repo_remove_test.go
+++ b/pkg/cmd/repo_remove_test.go
@@ -76,7 +76,7 @@ func TestRepoRemove(t *testing.T) {
 	assert.Falsef(t, f.Has(testRepoName), "%s was not successfully removed from repositories list", testRepoName)
 
 	// Test removal of multiple repos in one go
-	var testRepoNames = []string{"foo", "bar", "baz"}
+	testRepoNames := []string{"foo", "bar", "baz"}
 	cacheFiles := make(map[string][]string, len(testRepoNames))
 
 	// Add test repos
@@ -151,7 +151,7 @@ func TestRepoRemoveCompletion(t *testing.T) {
 	repoFile := filepath.Join(rootDir, "repositories.yaml")
 	repoCache := filepath.Join(rootDir, "cache")
 
-	var testRepoNames = []string{"foo", "bar", "baz"}
+	testRepoNames := []string{"foo", "bar", "baz"}
 
 	// Add test repos
 	for _, repoName := range testRepoNames {
diff --git a/pkg/cmd/repo_update_test.go b/pkg/cmd/repo_update_test.go
index 70b6dfbef..e8d7ad64a 100644
--- a/pkg/cmd/repo_update_test.go
+++ b/pkg/cmd/repo_update_test.go
@@ -159,7 +159,7 @@ func TestUpdateChartsFailWithError(t *testing.T) {
 	)
 	defer ts.Stop()
 
-	var invalidURL = ts.URL() + "55"
+	invalidURL := ts.URL() + "55"
 	r1, err := repo.NewChartRepository(&repo.Entry{
 		Name: "charts",
 		URL:  invalidURL,
diff --git a/pkg/cmd/root.go b/pkg/cmd/root.go
index 410a9162c..dbedca026 100644
--- a/pkg/cmd/root.go
+++ b/pkg/cmd/root.go
@@ -229,7 +229,6 @@ func newRootCmdWithConfig(actionConfig *action.Configuration, out io.Writer, arg
 		}
 		return nil, cobra.ShellCompDirectiveDefault
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -253,7 +252,6 @@ func newRootCmdWithConfig(actionConfig *action.Configuration, out io.Writer, arg
 		}
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -446,7 +444,6 @@ func newRegistryClientWithTLS(
 		tlsutil.WithCertKeyPairFiles(certFile, keyFile),
 		tlsutil.WithCAFile(caFile),
 	)
-
 	if err != nil {
 		return nil, fmt.Errorf("can't create TLS config for client: %w", err)
 	}
diff --git a/pkg/cmd/search_hub_test.go b/pkg/cmd/search_hub_test.go
index a1612443a..8bc5e78af 100644
--- a/pkg/cmd/search_hub_test.go
+++ b/pkg/cmd/search_hub_test.go
@@ -28,7 +28,7 @@ import (
 
 func TestSearchHubCmd(t *testing.T) {
 	// Setup a mock search service
-	var searchResult = `{"data":[{"id":"stable/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"stable","url":"https://charts.helm.sh/stable"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/stable/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T17:57:31.38Z","digest":"119c499251bffd4b06ff0cd5ac98c2ce32231f84899fb4825be6c2d90971c742","urls":["https://charts.helm.sh/stable/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/stable/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/stable/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/stable/phpmyadmin/versions/3.0.0"}}}},{"id":"bitnami/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"bitnami","url":"https://charts.bitnami.com"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/bitnami/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T18:34:13.341Z","digest":"66d77cf6d8c2b52c488d0a294cd4996bd5bad8dc41d3829c394498fb401c008a","urls":["https://charts.bitnami.com/bitnami/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/bitnami/phpmyadmin/versions/3.0.0"}}}}]}`
+	searchResult := `{"data":[{"id":"stable/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"stable","url":"https://charts.helm.sh/stable"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/stable/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T17:57:31.38Z","digest":"119c499251bffd4b06ff0cd5ac98c2ce32231f84899fb4825be6c2d90971c742","urls":["https://charts.helm.sh/stable/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/stable/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/stable/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/stable/phpmyadmin/versions/3.0.0"}}}},{"id":"bitnami/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"bitnami","url":"https://charts.bitnami.com"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/bitnami/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T18:34:13.341Z","digest":"66d77cf6d8c2b52c488d0a294cd4996bd5bad8dc41d3829c394498fb401c008a","urls":["https://charts.bitnami.com/bitnami/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/bitnami/phpmyadmin/versions/3.0.0"}}}}]}`
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintln(w, searchResult)
 	}))
@@ -37,7 +37,7 @@ func TestSearchHubCmd(t *testing.T) {
 	// The expected output has the URL to the mocked search service in it
 	// Trailing spaces are necessary to preserve in "expected" as the uitable package adds
 	// them during printing.
-	var expected = fmt.Sprintf(`URL                                             	CHART VERSION	APP VERSION	DESCRIPTION                                   
+	expected := fmt.Sprintf(`URL                                             	CHART VERSION	APP VERSION	DESCRIPTION                                   
 %s/charts/stable/phpmyadmin 	3.0.0        	4.9.0-1    	phpMyAdmin is an mysql administration frontend
 %s/charts/bitnami/phpmyadmin	3.0.0        	4.9.0-1    	phpMyAdmin is an mysql administration frontend
 `, ts.URL, ts.URL)
@@ -51,7 +51,7 @@ func TestSearchHubCmd(t *testing.T) {
 
 func TestSearchHubListRepoCmd(t *testing.T) {
 	// Setup a mock search service
-	var searchResult = `{"data":[{"id":"stable/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"stable","url":"https://charts.helm.sh/stable"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/stable/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T17:57:31.38Z","digest":"119c499251bffd4b06ff0cd5ac98c2ce32231f84899fb4825be6c2d90971c742","urls":["https://charts.helm.sh/stable/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/stable/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/stable/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/stable/phpmyadmin/versions/3.0.0"}}}},{"id":"bitnami/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"bitnami","url":"https://charts.bitnami.com"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/bitnami/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T18:34:13.341Z","digest":"66d77cf6d8c2b52c488d0a294cd4996bd5bad8dc41d3829c394498fb401c008a","urls":["https://charts.bitnami.com/bitnami/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/bitnami/phpmyadmin/versions/3.0.0"}}}}]}`
+	searchResult := `{"data":[{"id":"stable/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"stable","url":"https://charts.helm.sh/stable"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/stable/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T17:57:31.38Z","digest":"119c499251bffd4b06ff0cd5ac98c2ce32231f84899fb4825be6c2d90971c742","urls":["https://charts.helm.sh/stable/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/stable/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/stable/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/stable/phpmyadmin/versions/3.0.0"}}}},{"id":"bitnami/phpmyadmin","type":"chart","attributes":{"name":"phpmyadmin","repo":{"name":"bitnami","url":"https://charts.bitnami.com"},"description":"phpMyAdmin is an mysql administration frontend","home":"https://www.phpmyadmin.net/","keywords":["mariadb","mysql","phpmyadmin"],"maintainers":[{"name":"Bitnami","email":"containers@bitnami.com"}],"sources":["https://github.com/bitnami/bitnami-docker-phpmyadmin"],"icon":""},"links":{"self":"/v1/charts/bitnami/phpmyadmin"},"relationships":{"latestChartVersion":{"data":{"version":"3.0.0","app_version":"4.9.0-1","created":"2019-08-08T18:34:13.341Z","digest":"66d77cf6d8c2b52c488d0a294cd4996bd5bad8dc41d3829c394498fb401c008a","urls":["https://charts.bitnami.com/bitnami/phpmyadmin-3.0.0.tgz"],"readme":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/README.md","values":"/v1/assets/bitnami/phpmyadmin/versions/3.0.0/values.yaml"},"links":{"self":"/v1/charts/bitnami/phpmyadmin/versions/3.0.0"}}}}]}`
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintln(w, searchResult)
 	}))
@@ -60,7 +60,7 @@ func TestSearchHubListRepoCmd(t *testing.T) {
 	// The expected output has the URL to the mocked search service in it
 	// Trailing spaces are necessary to preserve in "expected" as the uitable package adds
 	// them during printing.
-	var expected = fmt.Sprintf(`URL                                             	CHART VERSION	APP VERSION	DESCRIPTION                                   	REPO URL                     
+	expected := fmt.Sprintf(`URL                                             	CHART VERSION	APP VERSION	DESCRIPTION                                   	REPO URL                     
 %s/charts/stable/phpmyadmin 	3.0.0        	4.9.0-1    	phpMyAdmin is an mysql administration frontend	https://charts.helm.sh/stable
 %s/charts/bitnami/phpmyadmin	3.0.0        	4.9.0-1    	phpMyAdmin is an mysql administration frontend	https://charts.bitnami.com   
 `, ts.URL, ts.URL)
@@ -96,7 +96,7 @@ func TestSearchHubCmd_FailOnNoResponseTests(t *testing.T) {
 		wantErr  bool
 	}
 
-	var tests = []testCase{
+	tests := []testCase{
 		{
 			name:     "Search hub with no results in response",
 			cmd:      `search hub maria`,
diff --git a/pkg/cmd/search_repo_test.go b/pkg/cmd/search_repo_test.go
index e7f104e05..e28984fd8 100644
--- a/pkg/cmd/search_repo_test.go
+++ b/pkg/cmd/search_repo_test.go
@@ -61,7 +61,8 @@ func TestSearchRepositoriesCmd(t *testing.T) {
 		cmd:       "search repo syzygy --fail-on-no-result",
 		golden:    "output/search-not-found-error.txt",
 		wantError: true,
-	}, {name: "search for 'syzygy' with json output and --fail-on-no-result, expect failure for no results",
+	}, {
+		name:      "search for 'syzygy' with json output and --fail-on-no-result, expect failure for no results",
 		cmd:       "search repo syzygy --output json --fail-on-no-result",
 		golden:    "output/search-not-found-error.txt",
 		wantError: true,
diff --git a/pkg/cmd/show.go b/pkg/cmd/show.go
index a92ca75b4..8252d933e 100644
--- a/pkg/cmd/show.go
+++ b/pkg/cmd/show.go
@@ -205,7 +205,6 @@ func addShowFlags(subCmd *cobra.Command, client *action.Show) {
 		}
 		return compVersionFlag(args[0], toComplete)
 	})
-
 	if err != nil {
 		log.Fatal(err)
 	}
diff --git a/pkg/cmd/status_test.go b/pkg/cmd/status_test.go
index b96a0d19a..2e1a5579e 100644
--- a/pkg/cmd/status_test.go
+++ b/pkg/cmd/status_test.go
@@ -185,7 +185,8 @@ func TestStatusCompletion(t *testing.T) {
 					Version: "1.2.3-prerelease",
 				},
 			},
-		}}
+		},
+	}
 
 	tests := []cmdTestCase{{
 		name:   "completion for status",
diff --git a/pkg/cmd/template.go b/pkg/cmd/template.go
index ccc1db719..29839b871 100644
--- a/pkg/cmd/template.go
+++ b/pkg/cmd/template.go
@@ -254,7 +254,6 @@ func writeToFile(outputDir string, name string, data string, appendData bool) er
 	defer f.Close()
 
 	_, err = fmt.Fprintf(f, "---\n# Source: %s\n%s\n", name, data)
-
 	if err != nil {
 		return err
 	}
diff --git a/pkg/engine/engine.go b/pkg/engine/engine.go
index 1d0affd93..67b1cf47b 100644
--- a/pkg/engine/engine.go
+++ b/pkg/engine/engine.go
@@ -143,9 +143,11 @@ type renderable struct {
 	basePath string
 }
 
-const warnStartDelim = "HELM_ERR_START"
-const warnEndDelim = "HELM_ERR_END"
-const recursionMaxNums = 1000
+const (
+	warnStartDelim   = "HELM_ERR_START"
+	warnEndDelim     = "HELM_ERR_END"
+	recursionMaxNums = 1000
+)
 
 var warnRegex = regexp.MustCompile(warnStartDelim + `((?s).*)` + warnEndDelim)
 
diff --git a/pkg/engine/engine_test.go b/pkg/engine/engine_test.go
index 1f3096366..14faeeb63 100644
--- a/pkg/engine/engine_test.go
+++ b/pkg/engine/engine_test.go
@@ -1278,6 +1278,7 @@ func TestTraceableError_SimpleForm(t *testing.T) {
 		assert.Equal(t, "error calling include", trace.message, "Expected %q, got %q", errString, trace.message)
 	}
 }
+
 func TestTraceableError_ExecutingForm(t *testing.T) {
 	testStrings := [][]string{
 		{"function_not_found/templates/secret.yaml:6:11: executing \"function_not_found/templates/secret.yaml\" at <include \"name\" .>: ", "function_not_found/templates/secret.yaml:6:11"},
diff --git a/pkg/engine/funcs.go b/pkg/engine/funcs.go
index 431f82f63..04a48cad3 100644
--- a/pkg/engine/funcs.go
+++ b/pkg/engine/funcs.go
@@ -130,7 +130,6 @@ func toYAMLPretty(v any) string {
 	encoder := goYaml.NewEncoder(&data)
 	encoder.SetIndent(2)
 	err := encoder.Encode(v)
-
 	if err != nil {
 		// Swallow errors inside of a template.
 		return ""
diff --git a/pkg/engine/funcs_test.go b/pkg/engine/funcs_test.go
index beb87b429..03ed64153 100644
--- a/pkg/engine/funcs_test.go
+++ b/pkg/engine/funcs_test.go
@@ -147,39 +147,40 @@ keyInElement1 = "valueInElement1"`,
 		tpl    string
 		expect any
 		vars   any
-	}{{
-		tpl:  `{{ mustToYaml . }}`,
-		vars: loopMap,
-	}, {
-		tpl:  `{{ mustToJson . }}`,
-		vars: loopMap,
-	}, {
-		tpl:    `{{ mustToDuration 30 }}`,
-		expect: `30s`,
-		vars:   nil,
-	}, {
-		tpl:    `{{ mustToDuration "1m30s" }}`,
-		expect: `1m30s`,
-		vars:   nil,
-	}, {
-		tpl:  `{{ mustToDuration "foo" }}`,
-		vars: nil,
-	}, {
-		tpl:    `{{ toYaml . }}`,
-		expect: "", // should return empty string and swallow error
-		vars:   loopMap,
-	}, {
-		tpl:    `{{ toJson . }}`,
-		expect: "", // should return empty string and swallow error
-		vars:   loopMap,
-	}, {
-		tpl:  `{{ mustToToml . }}`,
-		vars: map[int]string{1: "one"}, // non-string key is invalid in TOML
-	}, {
-		tpl:    `{{ mustToToml . }}`,
-		expect: "foo = \"bar\"\n", // should succeed and return TOML string
-		vars:   map[string]string{"foo": "bar"},
-	},
+	}{
+		{
+			tpl:  `{{ mustToYaml . }}`,
+			vars: loopMap,
+		}, {
+			tpl:  `{{ mustToJson . }}`,
+			vars: loopMap,
+		}, {
+			tpl:    `{{ mustToDuration 30 }}`,
+			expect: `30s`,
+			vars:   nil,
+		}, {
+			tpl:    `{{ mustToDuration "1m30s" }}`,
+			expect: `1m30s`,
+			vars:   nil,
+		}, {
+			tpl:  `{{ mustToDuration "foo" }}`,
+			vars: nil,
+		}, {
+			tpl:    `{{ toYaml . }}`,
+			expect: "", // should return empty string and swallow error
+			vars:   loopMap,
+		}, {
+			tpl:    `{{ toJson . }}`,
+			expect: "", // should return empty string and swallow error
+			vars:   loopMap,
+		}, {
+			tpl:  `{{ mustToToml . }}`,
+			vars: map[int]string{1: "one"}, // non-string key is invalid in TOML
+		}, {
+			tpl:    `{{ mustToToml . }}`,
+			expect: "foo = \"bar\"\n", // should succeed and return TOML string
+			vars:   map[string]string{"foo": "bar"},
+		},
 	}
 
 	for _, tt := range mustFuncsTests {
@@ -368,48 +369,49 @@ func TestDurationHelpers(t *testing.T) {
 		name string
 		tpl  string
 		vars any
-	}{{
-		name: "mustToDuration invalid string",
-		tpl:  `{{ mustToDuration "nope" }}`,
-	}, {
-		name: "mustToDuration empty string",
-		tpl:  `{{ mustToDuration "" }}`,
-	}, {
-		name: "mustToDuration whitespace string",
-		tpl:  `{{ mustToDuration "   " }}`,
-	}, {
-		name: "mustToDuration unsupported type",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: []int{1, 2, 3},
-	}, {
-		name: "mustToDuration uint overflow",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: uint64(math.MaxInt64) + 1,
-	}, {
-		name: "mustToDuration int overflow",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: maxDurationSeconds + 1,
-	}, {
-		name: "mustToDuration int underflow",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: minDurationSeconds - 1,
-	}, {
-		name: "mustToDuration float overflow",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: maxDurationSecondsFloat + 0.5,
-	}, {
-		name: "mustToDuration float underflow",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: minDurationSecondsFloat - 0.5,
-	}, {
-		name: "mustToDuration NaN",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: math.NaN(),
-	}, {
-		name: "mustToDuration Inf",
-		tpl:  `{{ mustToDuration . }}`,
-		vars: math.Inf(-1),
-	},
+	}{
+		{
+			name: "mustToDuration invalid string",
+			tpl:  `{{ mustToDuration "nope" }}`,
+		}, {
+			name: "mustToDuration empty string",
+			tpl:  `{{ mustToDuration "" }}`,
+		}, {
+			name: "mustToDuration whitespace string",
+			tpl:  `{{ mustToDuration "   " }}`,
+		}, {
+			name: "mustToDuration unsupported type",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: []int{1, 2, 3},
+		}, {
+			name: "mustToDuration uint overflow",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: uint64(math.MaxInt64) + 1,
+		}, {
+			name: "mustToDuration int overflow",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: maxDurationSeconds + 1,
+		}, {
+			name: "mustToDuration int underflow",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: minDurationSeconds - 1,
+		}, {
+			name: "mustToDuration float overflow",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: maxDurationSecondsFloat + 0.5,
+		}, {
+			name: "mustToDuration float underflow",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: minDurationSecondsFloat - 0.5,
+		}, {
+			name: "mustToDuration NaN",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: math.NaN(),
+		}, {
+			name: "mustToDuration Inf",
+			tpl:  `{{ mustToDuration . }}`,
+			vars: math.Inf(-1),
+		},
 	}
 
 	for _, tt := range mustErrTests {
diff --git a/pkg/getter/ocigetter.go b/pkg/getter/ocigetter.go
index de8643bcd..b890d05d7 100644
--- a/pkg/getter/ocigetter.go
+++ b/pkg/getter/ocigetter.go
@@ -165,7 +165,6 @@ func (g *OCIGetter) newRegistryClient() (*registry.Client, error) {
 	}
 
 	client, err := registry.NewClient(opts...)
-
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/getter/plugingetter.go b/pkg/getter/plugingetter.go
index c683a1090..0e048ccb3 100644
--- a/pkg/getter/plugingetter.go
+++ b/pkg/getter/plugingetter.go
@@ -19,7 +19,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-
 	"net/url"
 
 	"helm.sh/helm/v4/internal/plugin"
diff --git a/pkg/getter/plugingetter_test.go b/pkg/getter/plugingetter_test.go
index c9ed9f779..f36f48d00 100644
--- a/pkg/getter/plugingetter_test.go
+++ b/pkg/getter/plugingetter_test.go
@@ -17,7 +17,6 @@ package getter
 
 import (
 	"context"
-
 	"testing"
 	"time"
 
diff --git a/pkg/kube/client.go b/pkg/kube/client.go
index bb26fbcc9..ba881c560 100644
--- a/pkg/kube/client.go
+++ b/pkg/kube/client.go
@@ -127,8 +127,10 @@ const (
 	FieldValidationDirectiveStrict FieldValidationDirective = "Strict"
 )
 
-type CreateApplyFunc func(target *resource.Info) error
-type UpdateApplyFunc func(original, target *resource.Info) error
+type (
+	CreateApplyFunc func(target *resource.Info) error
+	UpdateApplyFunc func(original, target *resource.Info) error
+)
 
 func init() {
 	// Add CRDs to the scheme. They are missing by default.
diff --git a/pkg/kube/client_test.go b/pkg/kube/client_test.go
index 405925a30..86574a3e5 100644
--- a/pkg/kube/client_test.go
+++ b/pkg/kube/client_test.go
@@ -2260,7 +2260,8 @@ metadata:
 }
 
 func createManifest(t *testing.T, manifest string,
-	fakeMapper meta.RESTMapper, fakeClient *dynamicfake.FakeDynamicClient) {
+	fakeMapper meta.RESTMapper, fakeClient *dynamicfake.FakeDynamicClient,
+) {
 	t.Helper()
 
 	m := make(map[string]any)
diff --git a/pkg/kube/converter.go b/pkg/kube/converter.go
index 7300a708c..7bdc143ac 100644
--- a/pkg/kube/converter.go
+++ b/pkg/kube/converter.go
@@ -28,8 +28,10 @@ import (
 	"k8s.io/client-go/kubernetes/scheme"
 )
 
-var k8sNativeScheme *runtime.Scheme
-var k8sNativeSchemeOnce sync.Once
+var (
+	k8sNativeScheme     *runtime.Scheme
+	k8sNativeSchemeOnce sync.Once
+)
 
 // AsVersioned converts the given info into a runtime.Object with the correct
 // group and version set
@@ -41,7 +43,7 @@ func AsVersioned(info *resource.Info) runtime.Object {
 // RESTMapping. If no mapping is provided, the default schema versioner is used
 func convertWithMapper(obj runtime.Object, mapping *meta.RESTMapping) runtime.Object {
 	s := kubernetesNativeScheme()
-	var gv = runtime.GroupVersioner(schema.GroupVersions(s.PrioritizedVersionsAllGroups()))
+	gv := runtime.GroupVersioner(schema.GroupVersions(s.PrioritizedVersionsAllGroups()))
 	if mapping != nil {
 		gv = mapping.GroupVersionKind.GroupVersion()
 	}
diff --git a/pkg/provenance/sign.go b/pkg/provenance/sign.go
index 9b3e774cb..90b7559e5 100644
--- a/pkg/provenance/sign.go
+++ b/pkg/provenance/sign.go
@@ -218,7 +218,6 @@ func (s *Signatory) ClearSign(archiveData []byte, filename string, metadataBytes
 	}
 
 	_, err = io.Copy(w, b)
-
 	if err != nil {
 		// NB: We intentionally don't call `w.Close()` here! `w.Close()` is the method which
 		// actually does the PGP signing, and therefore is the part which uses the private key.
diff --git a/pkg/registry/client.go b/pkg/registry/client.go
index d1a744f4b..4c7b9a6c8 100644
--- a/pkg/registry/client.go
+++ b/pkg/registry/client.go
@@ -329,7 +329,6 @@ func ensureTLSConfig(client *auth.Client, setConfig *tls.Config) (*tls.Config, e
 func LoginOptInsecure(insecure bool) LoginOption {
 	return func(o *loginOperation) {
 		tlsConfig, err := ensureTLSConfig(o.client.authorizer, nil)
-
 		if err != nil {
 			panic(err)
 		}
@@ -909,7 +908,8 @@ func (c *Client) ValidateReference(ref, version string, u *url.URL) (string, *ur
 // tagManifest prepares and tags a manifest in memory storage
 func (c *Client) tagManifest(ctx context.Context, memoryStore *memory.Store,
 	configDescriptor ocispec.Descriptor, layers []ocispec.Descriptor,
-	ociAnnotations map[string]string, parsedRef reference) (ocispec.Descriptor, error) {
+	ociAnnotations map[string]string, parsedRef reference,
+) (ocispec.Descriptor, error) {
 	manifest := ocispec.Manifest{
 		Versioned:   specs.Versioned{SchemaVersion: 2},
 		Config:      configDescriptor,
diff --git a/pkg/registry/client_scope_test.go b/pkg/registry/client_scope_test.go
index a790c27a7..733ce980d 100644
--- a/pkg/registry/client_scope_test.go
+++ b/pkg/registry/client_scope_test.go
@@ -40,6 +40,7 @@ func (suite *RegistryScopeTestSuite) SetupSuite() {
 	// when the registry itself was reached over https.
 	setup(&suite.TestRegistry, false, false, "token")
 }
+
 func (suite *RegistryScopeTestSuite) TearDownSuite() {
 	teardown(&suite.TestRegistry)
 	os.RemoveAll(suite.WorkspaceDir)
diff --git a/pkg/release/common.go b/pkg/release/common.go
index 7d40effdc..eef48f099 100644
--- a/pkg/release/common.go
+++ b/pkg/release/common.go
@@ -77,7 +77,7 @@ func (a *v1Accessor) Version() int {
 }
 
 func (a *v1Accessor) Hooks() []Hook {
-	var hooks = make([]Hook, len(a.rel.Hooks))
+	hooks := make([]Hook, len(a.rel.Hooks))
 	for i, h := range a.rel.Hooks {
 		hooks[i] = h
 	}
@@ -141,7 +141,7 @@ func (a *v2Accessor) Version() int {
 }
 
 func (a *v2Accessor) Hooks() []Hook {
-	var hooks = make([]Hook, len(a.rel.Hooks))
+	hooks := make([]Hook, len(a.rel.Hooks))
 	for i, h := range a.rel.Hooks {
 		hooks[i] = h
 	}
diff --git a/pkg/release/v1/release.go b/pkg/release/v1/release.go
index 3bbc0e4ce..bb99ec733 100644
--- a/pkg/release/v1/release.go
+++ b/pkg/release/v1/release.go
@@ -22,8 +22,10 @@ import (
 
 type ApplyMethod string
 
-const ApplyMethodClientSideApply ApplyMethod = "csa"
-const ApplyMethodServerSideApply ApplyMethod = "ssa"
+const (
+	ApplyMethodClientSideApply ApplyMethod = "csa"
+	ApplyMethodServerSideApply ApplyMethod = "ssa"
+)
 
 // Release describes a deployment of a chart, together with the chart
 // and the variables used to deploy that chart.
diff --git a/pkg/release/v1/util/manifest_sorter_test.go b/pkg/release/v1/util/manifest_sorter_test.go
index da08ab169..bdb36786f 100644
--- a/pkg/release/v1/util/manifest_sorter_test.go
+++ b/pkg/release/v1/util/manifest_sorter_test.go
@@ -61,7 +61,8 @@ metadata:
   annotations:
     "helm.sh/hook": post-install
 `,
-		}, {
+		},
+		{
 			name:  []string{"third"},
 			path:  "three",
 			kind:  []string{"ReplicaSet"},
@@ -73,7 +74,8 @@ metadata:
   annotations:
     "helm.sh/hook": no-such-hook
 `,
-		}, {
+		},
+		{
 			name:  []string{"fourth"},
 			path:  "four",
 			kind:  []string{"Pod"},
@@ -84,7 +86,8 @@ metadata:
   name: fourth
   annotations:
     nothing: here`,
-		}, {
+		},
+		{
 			name:  []string{"fifth"},
 			path:  "five",
 			kind:  []string{"ReplicaSet"},
@@ -96,14 +99,16 @@ metadata:
   annotations:
     "helm.sh/hook": post-delete, post-install
 `,
-		}, {
+		},
+		{
 			// Regression test: files with an underscore in the base name should be skipped.
 			name:     []string{"sixth"},
 			path:     "six/_six",
 			kind:     []string{"ReplicaSet"},
 			hooks:    map[string][]release.HookEvent{"sixth": nil},
 			manifest: `invalid manifest`, // This will fail if partial is not skipped.
-		}, {
+		},
+		{
 			// Regression test: files with no content should be skipped.
 			name:     []string{"seventh"},
 			path:     "seven",
diff --git a/pkg/repo/v1/index_test.go b/pkg/repo/v1/index_test.go
index 09fc7de8a..9b46065a8 100644
--- a/pkg/repo/v1/index_test.go
+++ b/pkg/repo/v1/index_test.go
@@ -424,7 +424,6 @@ func TestIndexAdd(t *testing.T) {
 		baseURL  string
 		digest   string
 	}{
-
 		{&chart.Metadata{APIVersion: "v2", Name: "clipper", Version: "0.1.0"}, "clipper-0.1.0.tgz", "http://example.com/charts", "sha256:1234567890"},
 		{&chart.Metadata{APIVersion: "v2", Name: "alpine", Version: "0.1.0"}, "/home/charts/alpine-0.1.0.tgz", "http://example.com/charts", "sha256:1234567890"},
 		{&chart.Metadata{APIVersion: "v2", Name: "deis", Version: "0.1.0"}, "/home/charts/deis-0.1.0.tgz", "http://example.com/charts/", "sha256:1234567890"},
@@ -536,6 +535,7 @@ entries:
       home: https://github.com/something/else
       digest: "sha256:1234567890abcdef"
 `
+
 var indexWithDuplicatesInLastChartDeps = `
 apiVersion: v1
 entries:
diff --git a/pkg/repo/v1/repo_test.go b/pkg/repo/v1/repo_test.go
index f7f5df9be..2fe780ce3 100644
--- a/pkg/repo/v1/repo_test.go
+++ b/pkg/repo/v1/repo_test.go
@@ -137,15 +137,17 @@ func TestUpdateRepository(t *testing.T) {
 		},
 	)
 	newRepoName := "sample"
-	sampleRepository.Update(&Entry{Name: newRepoName,
-		URL: "https://example.com/sample",
+	sampleRepository.Update(&Entry{
+		Name: newRepoName,
+		URL:  "https://example.com/sample",
 	})
 
 	assert.Truef(t, sampleRepository.Has(newRepoName), "expected repository %s not found", newRepoName)
 	repoCount := len(sampleRepository.Repositories)
 
-	sampleRepository.Update(&Entry{Name: newRepoName,
-		URL: "https://example.com/sample",
+	sampleRepository.Update(&Entry{
+		Name: newRepoName,
+		URL:  "https://example.com/sample",
 	})
 
 	assert.Lenf(t, sampleRepository.Repositories, repoCount, "invalid number of repositories found %d, expected number of repositories %d", len(sampleRepository.Repositories), repoCount)
diff --git a/pkg/storage/driver/labels_test.go b/pkg/storage/driver/labels_test.go
index 34f01be79..81c2c5149 100644
--- a/pkg/storage/driver/labels_test.go
+++ b/pkg/storage/driver/labels_test.go
@@ -23,7 +23,7 @@ import (
 )
 
 func TestLabelsMatch(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		desc   string
 		set1   labels
 		set2   labels
diff --git a/pkg/storage/driver/memory_test.go b/pkg/storage/driver/memory_test.go
index c0eff3cf9..745b12345 100644
--- a/pkg/storage/driver/memory_test.go
+++ b/pkg/storage/driver/memory_test.go
@@ -34,7 +34,7 @@ func TestMemoryName(t *testing.T) {
 }
 
 func TestMemoryCreate(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		desc string
 		rls  *rspb.Release
 		err  bool
@@ -76,7 +76,7 @@ func TestMemoryCreate(t *testing.T) {
 }
 
 func TestMemoryGet(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		desc      string
 		key       string
 		namespace string
@@ -133,7 +133,7 @@ func TestMemoryList(t *testing.T) {
 }
 
 func TestMemoryQuery(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		desc      string
 		xlen      int
 		namespace string
@@ -164,7 +164,7 @@ func TestMemoryQuery(t *testing.T) {
 }
 
 func TestMemoryUpdate(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		desc string
 		key  string
 		rls  *rspb.Release
@@ -215,7 +215,7 @@ func TestMemoryUpdate(t *testing.T) {
 }
 
 func TestMemoryDelete(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		desc      string
 		key       string
 		namespace string
diff --git a/pkg/storage/driver/records_test.go b/pkg/storage/driver/records_test.go
index 22d54e6cc..049536971 100644
--- a/pkg/storage/driver/records_test.go
+++ b/pkg/storage/driver/records_test.go
@@ -31,7 +31,7 @@ func TestRecordsAdd(t *testing.T) {
 		newRecord("rls-a.v2", releaseStub("rls-a", 2, "default", common.StatusDeployed)),
 	})
 
-	var tests = []struct {
+	tests := []struct {
 		desc string
 		key  string
 		ok   bool
@@ -62,7 +62,7 @@ func TestRecordsAdd(t *testing.T) {
 }
 
 func TestRecordsRemove(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		desc string
 		key  string
 		ok   bool
@@ -112,7 +112,7 @@ func TestRecordsGet(t *testing.T) {
 		newRecord("rls-a.v2", releaseStub("rls-a", 2, "default", common.StatusDeployed)),
 	})
 
-	var tests = []struct {
+	tests := []struct {
 		desc string
 		key  string
 		rec  *record
@@ -141,7 +141,7 @@ func TestRecordsIndex(t *testing.T) {
 		newRecord("rls-a.v2", releaseStub("rls-a", 2, "default", common.StatusDeployed)),
 	})
 
-	var tests = []struct {
+	tests := []struct {
 		desc string
 		key  string
 		sort int
@@ -170,7 +170,7 @@ func TestRecordsExists(t *testing.T) {
 		newRecord("rls-a.v2", releaseStub("rls-a", 2, "default", common.StatusDeployed)),
 	})
 
-	var tests = []struct {
+	tests := []struct {
 		desc string
 		key  string
 		ok   bool
@@ -199,7 +199,7 @@ func TestRecordsReplace(t *testing.T) {
 		newRecord("rls-a.v2", releaseStub("rls-a", 2, "default", common.StatusDeployed)),
 	})
 
-	var tests = []struct {
+	tests := []struct {
 		desc     string
 		key      string
 		rec      *record
diff --git a/pkg/storage/driver/sql.go b/pkg/storage/driver/sql.go
index 85e6cbd3f..db076da98 100644
--- a/pkg/storage/driver/sql.go
+++ b/pkg/storage/driver/sql.go
@@ -53,8 +53,10 @@ const postgreSQLDialect = "postgres"
 // SQLDriverName is the string name of this driver.
 const SQLDriverName = "SQL"
 
-const sqlReleaseTableName = "releases_v1"
-const sqlCustomLabelsTableName = "custom_labels_v1"
+const (
+	sqlReleaseTableName      = "releases_v1"
+	sqlCustomLabelsTableName = "custom_labels_v1"
+)
 
 const (
 	sqlReleaseTableKeyColumn        = "key"
@@ -359,7 +361,7 @@ func (s *SQL) List(filter func(release.Releaser) bool) ([]release.Releaser, erro
 		return nil, err
 	}
 
-	var records = []SQLReleaseWrapper{}
+	records := []SQLReleaseWrapper{}
 	if err := s.db.Select(&records, query, args...); err != nil {
 		s.Logger().Debug("failed to list", slog.Any("error", err))
 		return nil, err
@@ -424,7 +426,7 @@ func (s *SQL) Query(labels map[string]string) ([]release.Releaser, error) {
 		return nil, err
 	}
 
-	var records = []SQLReleaseWrapper{}
+	records := []SQLReleaseWrapper{}
 	if err := s.db.Select(&records, query, args...); err != nil {
 		s.Logger().Debug("failed to query with labels", slog.Any("error", err))
 		return nil, err
@@ -556,7 +558,6 @@ func (s *SQL) Create(key string, rel release.Releaser) error {
 				k,
 				v,
 			).ToSql()
-
 		if err != nil {
 			defer transaction.Rollback()
 			s.Logger().Debug("failed to build insert query", slog.Any("error", err))
@@ -603,7 +604,6 @@ func (s *SQL) Update(key string, rel release.Releaser) error {
 		Where(sq.Eq{sqlReleaseTableKeyColumn: key}).
 		Where(sq.Eq{sqlReleaseTableNamespaceColumn: namespace}).
 		ToSql()
-
 	if err != nil {
 		s.Logger().Debug("failed to build update query", slog.Any("error", err))
 		return err
@@ -681,7 +681,6 @@ func (s *SQL) Delete(key string) (release.Releaser, error) {
 		Where(sq.Eq{sqlCustomLabelsTableReleaseKeyColumn: key}).
 		Where(sq.Eq{sqlCustomLabelsTableReleaseNamespaceColumn: s.namespace}).
 		ToSql()
-
 	if err != nil {
 		s.Logger().Debug("failed to build delete Labels query", slog.Any("error", err))
 		return nil, err
@@ -695,14 +694,16 @@ func (s *SQL) getReleaseCustomLabels(key string, _ string) (map[string]string, e
 	query, args, err := s.statementBuilder.
 		Select(sqlCustomLabelsTableKeyColumn, sqlCustomLabelsTableValueColumn).
 		From(sqlCustomLabelsTableName).
-		Where(sq.Eq{sqlCustomLabelsTableReleaseKeyColumn: key,
-			sqlCustomLabelsTableReleaseNamespaceColumn: s.namespace}).
+		Where(sq.Eq{
+			sqlCustomLabelsTableReleaseKeyColumn:       key,
+			sqlCustomLabelsTableReleaseNamespaceColumn: s.namespace,
+		}).
 		ToSql()
 	if err != nil {
 		return nil, err
 	}
 
-	var labelsList = []SQLReleaseCustomLabelWrapper{}
+	labelsList := []SQLReleaseCustomLabelWrapper{}
 	if err := s.db.Select(&labelsList, query, args...); err != nil {
 		return nil, err
 	}
diff --git a/pkg/storage/driver/util_test.go b/pkg/storage/driver/util_test.go
index 5dda3cd1f..f84f6a67a 100644
--- a/pkg/storage/driver/util_test.go
+++ b/pkg/storage/driver/util_test.go
@@ -38,7 +38,7 @@ func TestIsSystemLabel(t *testing.T) {
 }
 
 func TestFilterSystemLabels(t *testing.T) {
-	var tests = [][2]map[string]string{
+	tests := [][2]map[string]string{
 		{nil, map[string]string{}},
 		{map[string]string{}, map[string]string{}},
 		{map[string]string{
@@ -73,7 +73,7 @@ func TestFilterSystemLabels(t *testing.T) {
 }
 
 func TestContainsSystemLabels(t *testing.T) {
-	var tests = []struct {
+	tests := []struct {
 		input  map[string]string
 		output bool
 	}{
diff --git a/pkg/storage/storage_test.go b/pkg/storage/storage_test.go
index 58cb56776..ae8513cca 100644
--- a/pkg/storage/storage_test.go
+++ b/pkg/storage/storage_test.go
@@ -137,7 +137,7 @@ func TestStorageList(t *testing.T) {
 		require.NoError(t, storage.Create(rls6), "Storing release 'rls6'")
 	}
 
-	var listTests = []struct {
+	listTests := []struct {
 		Description string
 		NumExpected int
 		ListFunc    func() ([]release.Releaser, error)
@@ -263,24 +263,31 @@ type MaxHistoryMockDriver struct {
 func NewMaxHistoryMockDriver(d driver.Driver) *MaxHistoryMockDriver {
 	return &MaxHistoryMockDriver{Driver: d}
 }
+
 func (d *MaxHistoryMockDriver) Create(key string, rls release.Releaser) error {
 	return d.Driver.Create(key, rls)
 }
+
 func (d *MaxHistoryMockDriver) Update(key string, rls release.Releaser) error {
 	return d.Driver.Update(key, rls)
 }
+
 func (d *MaxHistoryMockDriver) Delete(_ string) (release.Releaser, error) {
 	return nil, errMaxHistoryMockDriverSomethingHappened
 }
+
 func (d *MaxHistoryMockDriver) Get(key string) (release.Releaser, error) {
 	return d.Driver.Get(key)
 }
+
 func (d *MaxHistoryMockDriver) List(filter func(release.Releaser) bool) ([]release.Releaser, error) {
 	return d.Driver.List(filter)
 }
+
 func (d *MaxHistoryMockDriver) Query(labels map[string]string) ([]release.Releaser, error) {
 	return d.Driver.Query(labels)
 }
+
 func (d *MaxHistoryMockDriver) Name() string {
 	return d.Driver.Name()
 }
diff --git a/pkg/strvals/literal_parser_test.go b/pkg/strvals/literal_parser_test.go
index 94e0c6050..74ab775af 100644
--- a/pkg/strvals/literal_parser_test.go
+++ b/pkg/strvals/literal_parser_test.go
@@ -316,7 +316,8 @@ func TestParseLiteralInto(t *testing.T) {
 				"outer": map[string]any{
 					"inner1": "value1,outer.inner3=value3,outer.inner4=4",
 					"inner2": "value2",
-				}},
+				},
+			},
 			err: false,
 		},
 		{
diff --git a/pkg/strvals/parser_test.go b/pkg/strvals/parser_test.go
index c6c866711..73fc3f206 100644
--- a/pkg/strvals/parser_test.go
+++ b/pkg/strvals/parser_test.go
@@ -439,7 +439,8 @@ func TestParseInto(t *testing.T) {
 					"inner2": "value2",
 					"inner3": "value3",
 					"inner4": 4,
-				}},
+				},
+			},
 			err: false,
 		},
 		{

From bc0114c70841e2a05c95e53e20358fb761dbfb2e Mon Sep 17 00:00:00 2001
From: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Date: Mon, 27 Jul 2026 13:55:05 -0500
Subject: [PATCH 18/35] fix(scripts): clarify cache-busting behavior

Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
---
 scripts/get-helm-3 | 3 ++-
 scripts/get-helm-4 | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/get-helm-3 b/scripts/get-helm-3
index 117ae3e03..a73b3da2a 100755
--- a/scripts/get-helm-3
+++ b/scripts/get-helm-3
@@ -114,12 +114,13 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
+    # Cache behavior is provider-specific, so this mitigation is best effort.
     # The current CDN does not revalidate on the request no-cache directive,
     # so use a unique query while retaining no-cache for compliant intermediaries.
     local latest_release_url="https://get.helm.sh/helm3-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail --header "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
       latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
diff --git a/scripts/get-helm-4 b/scripts/get-helm-4
index 0ff312a7f..3d232cca9 100644
--- a/scripts/get-helm-4
+++ b/scripts/get-helm-4
@@ -114,12 +114,13 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
+    # Cache behavior is provider-specific, so this mitigation is best effort.
     # The current CDN does not revalidate on the request no-cache directive,
     # so use a unique query while retaining no-cache for compliant intermediaries.
     local latest_release_url="https://get.helm.sh/helm4-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail -H "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail --header "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
       latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi

From ce27485634fcbd54be8fc8d99a5e4799456420c9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 21:33:45 +0000
Subject: [PATCH 19/35] chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to
 3.0.5

Bumps [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml) from 3.0.4 to 3.0.5.
- [Commits](https://github.com/yaml/go-yaml/compare/v3.0.4...v3.0.5)

---
updated-dependencies:
- dependency-name: go.yaml.in/yaml/v3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/go.mod b/go.mod
index 6b9878bb2..13434162f 100644
--- a/go.mod
+++ b/go.mod
@@ -34,7 +34,7 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	github.com/tetratelabs/wazero v1.12.0
-	go.yaml.in/yaml/v3 v3.0.4
+	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/crypto v0.54.0
 	golang.org/x/term v0.45.0
 	golang.org/x/text v0.40.0
diff --git a/go.sum b/go.sum
index e5933d99a..9afe18b88 100644
--- a/go.sum
+++ b/go.sum
@@ -376,8 +376,9 @@ go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
 go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=

From 3c3be926aaea573cf94931877e8072aefb231b60 Mon Sep 17 00:00:00 2001
From: Ilya Kiselev <kis-ilya-a@yandex.ru>
Date: Tue, 28 Jul 2026 18:45:24 +0300
Subject: [PATCH 20/35] fix(chart): normalize StampModTimes timestamp +
 Chart.lock test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #32396.

StampModTimes now normalizes the supplied time to UTC and truncates to
whole seconds before stamping. Without this, an SDK caller passing a
local-timezone or sub-second time.Time would produce a Chart.lock
generated: field with a timezone offset or fractional seconds, making
the lock file content non-reproducible across machines even when the
same SOURCE_DATE_EPOCH value is used — defeating the purpose of the
feature.

Also add:
- testdata/charts/chart-with-lock fixture: a minimal chart with a
  Chart.lock whose generated: timestamp predates SOURCE_DATE_EPOCH.
- TestRunWithSourceDateEpochStampsLockGenerated: packages the fixture
  with SourceDateEpoch set to a non-UTC, sub-second time.Time and
  asserts that the resulting archive's Chart.lock entry has both the
  correct tar modtime and the correct (normalized) generated: value in
  the marshaled YAML.

Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
---
 pkg/action/package_test.go                    | 59 +++++++++++++++++++
 .../charts/chart-with-lock/Chart.lock         |  3 +
 .../charts/chart-with-lock/Chart.yaml         |  4 ++
 pkg/chart/v2/chart.go                         | 27 +++++----
 4 files changed, 83 insertions(+), 10 deletions(-)
 create mode 100644 pkg/action/testdata/charts/chart-with-lock/Chart.lock
 create mode 100644 pkg/action/testdata/charts/chart-with-lock/Chart.yaml

diff --git a/pkg/action/package_test.go b/pkg/action/package_test.go
index 421f34b33..d216d8341 100644
--- a/pkg/action/package_test.go
+++ b/pkg/action/package_test.go
@@ -17,9 +17,13 @@ limitations under the License.
 package action
 
 import (
+	"archive/tar"
+	"compress/gzip"
+	"io"
 	"os"
 	"path"
 	"testing"
+	"time"
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/stretchr/testify/assert"
@@ -144,3 +148,58 @@ func TestRun(t *testing.T) {
 	require.Equal(t, "empty-0.1.0.tgz", filename)
 	require.NoError(t, os.Remove(filename))
 }
+
+// TestRunWithSourceDateEpochStampsLockGenerated verifies that packaging a chart
+// that has a Chart.lock stamps both the tar entry modtime and the marshaled
+// generated: field in Chart.lock to the given epoch.
+//
+// This guards against the normalization regression where a caller supplying a
+// local-timezone or sub-second time.Time would produce a non-reproducible
+// generated: value even when the same SOURCE_DATE_EPOCH is used on different
+// machines.
+func TestRunWithSourceDateEpochStampsLockGenerated(t *testing.T) {
+	// Use a non-local, non-UTC timezone and sub-second precision to confirm
+	// normalization: without UTC().Truncate(time.Second) the generated: field
+	// would contain a timezone offset or fractional seconds.
+	loc := time.FixedZone("UTC+3", 3*60*60)
+	rawEpoch := time.Unix(1700000000, 123456789).In(loc)
+	epoch := rawEpoch.UTC().Truncate(time.Second)
+
+	client := NewPackage()
+	client.SourceDateEpoch = &rawEpoch
+
+	filename, err := client.Run("testdata/charts/chart-with-lock", nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { os.Remove(filename) })
+
+	f, err := os.Open(filename)
+	require.NoError(t, err)
+	defer f.Close()
+
+	gr, err := gzip.NewReader(f)
+	require.NoError(t, err)
+	defer gr.Close()
+
+	found := false
+	tr := tar.NewReader(gr)
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		require.NoError(t, err)
+		if path.Base(hdr.Name) != "Chart.lock" {
+			continue
+		}
+		found = true
+		require.True(t, epoch.Equal(hdr.ModTime),
+			"Chart.lock tar modtime: got %v, want %v", hdr.ModTime, epoch)
+
+		raw, err := io.ReadAll(tr)
+		require.NoError(t, err)
+		wantGenerated := epoch.Format(time.RFC3339)
+		require.Contains(t, string(raw), wantGenerated,
+			"Chart.lock generated: field should contain normalized UTC timestamp")
+	}
+	require.True(t, found, "expected archive to contain a Chart.lock entry")
+}
diff --git a/pkg/action/testdata/charts/chart-with-lock/Chart.lock b/pkg/action/testdata/charts/chart-with-lock/Chart.lock
new file mode 100644
index 000000000..824df0a40
--- /dev/null
+++ b/pkg/action/testdata/charts/chart-with-lock/Chart.lock
@@ -0,0 +1,3 @@
+dependencies: []
+digest: sha256:0000000000000000000000000000000000000000000000000000000000000
+generated: "2016-01-01T00:00:00Z"
diff --git a/pkg/action/testdata/charts/chart-with-lock/Chart.yaml b/pkg/action/testdata/charts/chart-with-lock/Chart.yaml
new file mode 100644
index 000000000..2cb1b3557
--- /dev/null
+++ b/pkg/action/testdata/charts/chart-with-lock/Chart.yaml
@@ -0,0 +1,4 @@
+apiVersion: v2
+name: chart-with-lock
+version: 0.1.0
+description: Test chart with a Chart.lock, used to verify SourceDateEpoch stamping
diff --git a/pkg/chart/v2/chart.go b/pkg/chart/v2/chart.go
index 9772754ce..ccfe84f51 100644
--- a/pkg/chart/v2/chart.go
+++ b/pkg/chart/v2/chart.go
@@ -177,34 +177,41 @@ func (ch *Chart) CRDObjects() []CRD {
 	return crds
 }
 
-// StampModTimes sets timestamps on the chart (and dependencies) to epoch.
-// This is used for reproducible builds via SOURCE_DATE_EPOCH.
-func (ch *Chart) StampModTimes(epoch time.Time) {
-	ch.ModTime = epoch
+// StampModTimes sets timestamps on the chart (and dependencies) to t,
+// normalized to UTC and truncated to whole seconds.
+//
+// Normalization is required because Chart.lock's generated: field is written
+// by yaml.Marshal from Lock.Generated. Without UTC/truncate, a caller
+// supplying a local-zone or sub-second time.Time produces a generated: value
+// with a timezone offset or fractional seconds, making the lock file content
+// non-reproducible across machines even when the same SOURCE_DATE_EPOCH is used.
+func (ch *Chart) StampModTimes(t time.Time) {
+	t = t.UTC().Truncate(time.Second)
+	ch.ModTime = t
 	if len(ch.Schema) > 0 {
-		ch.SchemaModTime = epoch
+		ch.SchemaModTime = t
 	}
 	if ch.Lock != nil {
-		ch.Lock.Generated = epoch
+		ch.Lock.Generated = t
 	}
 
 	for _, f := range ch.Raw {
 		if f != nil {
-			f.ModTime = epoch
+			f.ModTime = t
 		}
 	}
 	for _, f := range ch.Templates {
 		if f != nil {
-			f.ModTime = epoch
+			f.ModTime = t
 		}
 	}
 	for _, f := range ch.Files {
 		if f != nil {
-			f.ModTime = epoch
+			f.ModTime = t
 		}
 	}
 	for _, dep := range ch.Dependencies() {
-		dep.StampModTimes(epoch)
+		dep.StampModTimes(t)
 	}
 }
 

From e92316751375bafd4621232bb39a1238a22e91c4 Mon Sep 17 00:00:00 2001
From: Ilya Kiselev <kis-ilya-a@yandex.ru>
Date: Tue, 28 Jul 2026 19:05:56 +0300
Subject: [PATCH 21/35] test(package): fix errorlint + exact path match in lock
 test

- Replace `err == io.EOF` with `errors.Is(err, io.EOF)` (errorlint).
- Match Chart.lock by full tar path ("chart-with-lock/Chart.lock")
  instead of path.Base to avoid false positives from subchart lock files.
- Break out of the loop after finding the entry (early exit).

Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
---
 pkg/action/package_test.go | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkg/action/package_test.go b/pkg/action/package_test.go
index d216d8341..2b359fa52 100644
--- a/pkg/action/package_test.go
+++ b/pkg/action/package_test.go
@@ -19,6 +19,7 @@ package action
 import (
 	"archive/tar"
 	"compress/gzip"
+	"errors"
 	"io"
 	"os"
 	"path"
@@ -180,15 +181,16 @@ func TestRunWithSourceDateEpochStampsLockGenerated(t *testing.T) {
 	require.NoError(t, err)
 	defer gr.Close()
 
+	const wantPath = "chart-with-lock/Chart.lock"
 	found := false
 	tr := tar.NewReader(gr)
 	for {
 		hdr, err := tr.Next()
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
 		require.NoError(t, err)
-		if path.Base(hdr.Name) != "Chart.lock" {
+		if hdr.Name != wantPath {
 			continue
 		}
 		found = true
@@ -200,6 +202,7 @@ func TestRunWithSourceDateEpochStampsLockGenerated(t *testing.T) {
 		wantGenerated := epoch.Format(time.RFC3339)
 		require.Contains(t, string(raw), wantGenerated,
 			"Chart.lock generated: field should contain normalized UTC timestamp")
+		break
 	}
-	require.True(t, found, "expected archive to contain a Chart.lock entry")
+	require.True(t, found, "expected archive to contain %q entry", wantPath)
 }

From ac1c68746f72e5bbbe5b7e5a052629aab7e5ab61 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 15:39:05 -0600
Subject: [PATCH 22/35] chore(deps): bump actions/stale in the github-actions
 group (#32487)

Bumps the github-actions group with 1 update: [actions/stale](https://github.com/actions/stale).


Updates `actions/stale` from 10.4.0 to 11.0.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/1e223db275d687790206a7acac4d1a11bd6fe629...4391f3da665fdf50b6810c1a66712fb9ba21aa93)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/stale.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 678952b03..e95a4b8c3 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -12,7 +12,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+    - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'This issue has been marked as stale because it has been open for 90 days with no activity. This thread will be automatically closed in 30 days if no further activity occurs.'

From a8ab76e86f11e2ece5a3d0262313140e21db249b Mon Sep 17 00:00:00 2001
From: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
Date: Tue, 28 Jul 2026 17:59:38 -0700
Subject: [PATCH 23/35] test(action): poll for the interrupted install
 goroutine instead of a zero-margin sleep (#32328)

TestInstallRelease_Wait_Interrupted and
TestInstallRelease_RollbackOnFailure_Interrupted assert that the detached
installation goroutine has exited by sleeping a fixed 10s -- exactly the
FailingKubeClient WaitDuration the goroutine blocks on. Sleeping the same
duration the goroutine takes is a zero-margin race: if the goroutine
finishes a hair after the fixed sleep elapses (scheduler jitter under load),
getGoroutineCount() has not decremented yet and the assertion flakes.

Replace the fixed sleep + point-in-time assert with is.Eventually polling
getGoroutineCount() (30s ceiling, 10ms tick). It returns as soon as the
goroutine has actually finished and no longer races the exact wait
duration. Test-only; no change to install behavior.

Signed-off-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
---
 pkg/action/install_test.go | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkg/action/install_test.go b/pkg/action/install_test.go
index 80f3bd724..2d83abe27 100644
--- a/pkg/action/install_test.go
+++ b/pkg/action/install_test.go
@@ -653,8 +653,10 @@ func TestInstallRelease_Wait_Interrupted(t *testing.T) {
 	req.ErrorContains(err, "context canceled")
 
 	is.Equal(goroutines+1, instAction.getGoroutineCount()) // installation goroutine still is in background
-	time.Sleep(10 * time.Second)                           // wait for goroutine to finish
-	is.Equal(goroutines, instAction.getGoroutineCount())
+	// Poll until the background installation goroutine has finished.
+	is.Eventually(func() bool {
+		return instAction.getGoroutineCount() == goroutines
+	}, 30*time.Second, 10*time.Millisecond)
 }
 
 func TestInstallRelease_WaitForJobs(t *testing.T) {
@@ -754,8 +756,10 @@ func TestInstallRelease_RollbackOnFailure_Interrupted(t *testing.T) {
 	req.Error(err)
 	is.Equal(err, driver.ErrReleaseNotFound)
 	is.Equal(goroutines+1, instAction.getGoroutineCount()) // installation goroutine still is in background
-	time.Sleep(10 * time.Second)                           // wait for goroutine to finish
-	is.Equal(goroutines, instAction.getGoroutineCount())
+	// Poll until the background installation goroutine has finished.
+	is.Eventually(func() bool {
+		return instAction.getGoroutineCount() == goroutines
+	}, 30*time.Second, 10*time.Millisecond)
 }
 
 func TestNameTemplate(t *testing.T) {

From ae877c8bfb943d2cc1aa10b34f0c4fada55e6f56 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:54:38 -0600
Subject: [PATCH 24/35] chore(deps): bump the github-actions group with 4
 updates (#32508)

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/autobuild` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 .github/workflows/scorecards.yml      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d8c1a9d12..1c541c2bf 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # pinv4.37.3
+      uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # pinv4.37.4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # pinv4.37.3
+      uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # pinv4.37.4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # pinv4.37.3
+      uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # pinv4.37.4
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 6c142b511..d631fa5ea 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif

From 47eb219a71bac4638a9b9db916a5d8c415c553bc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 22:06:50 +0000
Subject: [PATCH 25/35] chore(deps): bump the github-actions group with 4
 updates

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43)

Updates `github/codeql-action/autobuild` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43)

Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43)

Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 .github/workflows/scorecards.yml      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1c541c2bf..775299964 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # pinv4.37.4
+      uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # pinv4.37.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # pinv4.37.4
+      uses: github/codeql-action/autobuild@d1ba80a13dd99fba24a470575428917156a28b43 # pinv4.37.5
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # pinv4.37.4
+      uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # pinv4.37.5
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index d631fa5ea..926b0c3f6 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           sarif_file: results.sarif

From f8a308cd470bc1f087b3f4915ba775af18c5ffab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 05:31:22 -0600
Subject: [PATCH 26/35] chore(deps): bump
 github.com/santhosh-tekuri/jsonschema/v6 (#32514)

Bumps [github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/santhosh-tekuri/jsonschema/releases)
- [Commits](https://github.com/santhosh-tekuri/jsonschema/compare/v6.0.2...v6.0.3)

---
updated-dependencies:
- dependency-name: github.com/santhosh-tekuri/jsonschema/v6
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 13434162f..3843e17aa 100644
--- a/go.mod
+++ b/go.mod
@@ -29,7 +29,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/rubenv/sql-migrate v1.8.1
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
diff --git a/go.sum b/go.sum
index 9afe18b88..46bc13845 100644
--- a/go.sum
+++ b/go.sum
@@ -282,8 +282,8 @@ github.com/rubenv/sql-migrate v1.8.1 h1:EPNwCvjAowHI3TnZ+4fQu3a915OpnQoPAjTXCGOy
 github.com/rubenv/sql-migrate v1.8.1/go.mod h1:BTIKBORjzyxZDS6dzoiw6eAFYJ1iNlGAtjn4LGeVjS8=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=

From a0c2f6dade5180fdb08bcc5debef56357cd586ab Mon Sep 17 00:00:00 2001
From: Terry Howe <terrylhowe@gmail.com>
Date: Fri, 7 Aug 2026 08:12:24 -0600
Subject: [PATCH 27/35] fix: bump go.opentelemetry.io/otel to v1.44.0 for
 GO-2026-5158 (#32521)

* fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158

govulncheck on main flags GO-2026-5158 in go.opentelemetry.io/otel@v1.43.0
(fixed in v1.44.0). Bump the transitive otel dependency to clear the
vulnerability.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>

* fix: bump otel/sdk and otel/sdk/metric to v1.44.0 for version parity

Keep the lockstep-versioned OpenTelemetry core and SDK modules aligned at
v1.44.0 to avoid version skew.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>

---------

Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 go.mod | 10 +++++-----
 go.sum | 22 ++++++++++++----------
 2 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/go.mod b/go.mod
index 3843e17aa..6203377b7 100644
--- a/go.mod
+++ b/go.mod
@@ -138,7 +138,7 @@ require (
 	go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 // indirect
 	go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
@@ -151,11 +151,11 @@ require (
 	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 // indirect
 	go.opentelemetry.io/otel/log v0.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
 	go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/mod v0.37.0 // indirect
diff --git a/go.sum b/go.sum
index 46bc13845..1b7a58218 100644
--- a/go.sum
+++ b/go.sum
@@ -328,8 +328,8 @@ go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 h1:4fnRcNpc6YFtG3zsFw9a
 go.opentelemetry.io/contrib/exporters/autoexport v0.67.0/go.mod h1:qTvIHMFKoxW7HXg02gm6/Wofhq5p3Ib/A/NNt1EoBSQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 h1:deI9UQMoGFgrg5iLPgzueqFPHevDl+28YKfSpPTI6rY=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0/go.mod h1:PFx9NgpNUKXdf7J4Q3agRxMs3Y07QhTCVipKmLsMKnU=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag=
@@ -354,18 +354,20 @@ go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1J
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs=
 go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4=
 go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
+go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
 go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko=
 go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg=
 go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk=
 go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

From f3d68cdbea3076a0283cbd1e3ec44a409ad48a43 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:53:05 -0600
Subject: [PATCH 28/35] chore(deps): bump the github-actions group with 4
 updates (#32523)

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/d1ba80a13dd99fba24a470575428917156a28b43...5595ccaf912efad79be6eef63a5619ff05969be3)

Updates `github/codeql-action/autobuild` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/d1ba80a13dd99fba24a470575428917156a28b43...5595ccaf912efad79be6eef63a5619ff05969be3)

Updates `github/codeql-action/analyze` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/d1ba80a13dd99fba24a470575428917156a28b43...5595ccaf912efad79be6eef63a5619ff05969be3)

Updates `github/codeql-action/upload-sarif` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/d1ba80a13dd99fba24a470575428917156a28b43...5595ccaf912efad79be6eef63a5619ff05969be3)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 .github/workflows/scorecards.yml      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 775299964..5e392cc2c 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # pinv4.37.5
+      uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # pinv4.37.6
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@d1ba80a13dd99fba24a470575428917156a28b43 # pinv4.37.5
+      uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # pinv4.37.6
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # pinv4.37.5
+      uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # pinv4.37.6
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 926b0c3f6..553a6b3da 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif

From 601445e88cf1fe66b2885c793d564030aad1d707 Mon Sep 17 00:00:00 2001
From: Dean Chen <862469039@qq.com>
Date: Sat, 8 Aug 2026 11:46:06 +0500
Subject: [PATCH 29/35] fix(loader): do not drop values files ending at a
 4096-byte boundary

YAMLReader can return EOF without yielding the last line when that line
has no trailing newline and its length is a multiple of bufio's default
buffer. Read the file fully and ensure a trailing newline before parsing
so compact JSON values files are not silently ignored.

Fixes #32506

Signed-off-by: Dean Chen <862469039@qq.com>
---
 internal/chart/v3/loader/load.go      | 14 +++++++++++++-
 internal/chart/v3/loader/load_test.go | 23 +++++++++++++++++++++++
 pkg/chart/v2/loader/load.go           | 14 +++++++++++++-
 pkg/chart/v2/loader/load_test.go      | 23 +++++++++++++++++++++++
 4 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/internal/chart/v3/loader/load.go b/internal/chart/v3/loader/load.go
index 48f346ccf..0ff040eae 100644
--- a/internal/chart/v3/loader/load.go
+++ b/internal/chart/v3/loader/load.go
@@ -183,8 +183,20 @@ func LoadFiles(files []*archive.BufferedFile) (*chart.Chart, error) {
 // The reader is expected to contain one or more YAML documents, the values of which are merged.
 // And the values can be either a chart's default values or user-supplied values.
 func LoadValues(data io.Reader) (map[string]any, error) {
+	// Read fully first. YAMLReader/LineReader can drop a final unterminated
+	// line when its length is an exact multiple of bufio.Reader's default
+	// buffer (4096). Appending a trailing newline avoids that case.
+	// See https://github.com/helm/helm/issues/32506
+	b, err := io.ReadAll(data)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) > 0 && b[len(b)-1] != '\n' {
+		b = append(b, '\n')
+	}
+
 	values := map[string]any{}
-	reader := utilyaml.NewYAMLReader(bufio.NewReader(data))
+	reader := utilyaml.NewYAMLReader(bufio.NewReader(bytes.NewReader(b)))
 	for {
 		currentMap := map[string]any{}
 		raw, err := reader.Read()
diff --git a/internal/chart/v3/loader/load_test.go b/internal/chart/v3/loader/load_test.go
index dd5fdc8db..f105b248f 100644
--- a/internal/chart/v3/loader/load_test.go
+++ b/internal/chart/v3/loader/load_test.go
@@ -419,6 +419,29 @@ foo:
 	}
 }
 
+
+func TestLoadValuesEOFBoundary(t *testing.T) {
+	// Reproduces #32506: a single logical line whose length is a multiple of
+	// bufio's default buffer (4096) and has no trailing newline used to be
+	// dropped entirely by YAMLReader, yielding empty values.
+	prefix := []byte(`{"foo":"`)
+	suffix := []byte(`"}`)
+	pad := 4096 - len(prefix) - len(suffix)
+	data := make([]byte, 0, 4096)
+	data = append(data, prefix...)
+	data = append(data, bytes.Repeat([]byte("x"), pad)...)
+	data = append(data, suffix...)
+	if len(data) != 4096 {
+		t.Fatalf("test setup: want data length 4096, got %d", len(data))
+	}
+
+	values, err := LoadValues(bytes.NewReader(data))
+	require.NoError(t, err)
+	assert.Equal(t, map[string]any{
+		"foo": string(bytes.Repeat([]byte("x"), pad)),
+	}, values)
+}
+
 func TestMergeValuesV3(t *testing.T) {
 	nestedMap := map[string]any{
 		"foo": "bar",
diff --git a/pkg/chart/v2/loader/load.go b/pkg/chart/v2/loader/load.go
index 28115d062..d7b125b9b 100644
--- a/pkg/chart/v2/loader/load.go
+++ b/pkg/chart/v2/loader/load.go
@@ -210,8 +210,20 @@ func LoadFiles(files []*archive.BufferedFile) (*chart.Chart, error) {
 // The reader is expected to contain one or more YAML documents, the values of which are merged.
 // And the values can be either a chart's default values or user-supplied values.
 func LoadValues(data io.Reader) (map[string]any, error) {
+	// Read fully first. YAMLReader/LineReader can drop a final unterminated
+	// line when its length is an exact multiple of bufio.Reader's default
+	// buffer (4096). Appending a trailing newline avoids that case.
+	// See https://github.com/helm/helm/issues/32506
+	b, err := io.ReadAll(data)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) > 0 && b[len(b)-1] != '\n' {
+		b = append(b, '\n')
+	}
+
 	values := map[string]any{}
-	reader := utilyaml.NewYAMLReader(bufio.NewReader(data))
+	reader := utilyaml.NewYAMLReader(bufio.NewReader(bytes.NewReader(b)))
 	for {
 		currentMap := map[string]any{}
 		raw, err := reader.Read()
diff --git a/pkg/chart/v2/loader/load_test.go b/pkg/chart/v2/loader/load_test.go
index 8bf254321..b4836ee95 100644
--- a/pkg/chart/v2/loader/load_test.go
+++ b/pkg/chart/v2/loader/load_test.go
@@ -463,6 +463,29 @@ foo:
 	}
 }
 
+
+func TestLoadValuesEOFBoundary(t *testing.T) {
+	// Reproduces #32506: a single logical line whose length is a multiple of
+	// bufio's default buffer (4096) and has no trailing newline used to be
+	// dropped entirely by YAMLReader, yielding empty values.
+	prefix := []byte(`{"foo":"`)
+	suffix := []byte(`"}`)
+	pad := 4096 - len(prefix) - len(suffix)
+	data := make([]byte, 0, 4096)
+	data = append(data, prefix...)
+	data = append(data, bytes.Repeat([]byte("x"), pad)...)
+	data = append(data, suffix...)
+	if len(data) != 4096 {
+		t.Fatalf("test setup: want data length 4096, got %d", len(data))
+	}
+
+	values, err := LoadValues(bytes.NewReader(data))
+	require.NoError(t, err)
+	assert.Equal(t, map[string]any{
+		"foo": string(bytes.Repeat([]byte("x"), pad)),
+	}, values)
+}
+
 func TestMergeValuesV2(t *testing.T) {
 	nestedMap := map[string]any{
 		"foo": "bar",

From fd4ed4952b5f9f54344a0c014f7acd7885bd60c6 Mon Sep 17 00:00:00 2001
From: Dean Chen <862469039@qq.com>
Date: Sat, 8 Aug 2026 19:45:24 +0500
Subject: [PATCH 30/35] test(loader): cover 8192-byte EOF boundary for
 LoadValues

Also drop the extra blank line before the test. Addresses review on
#32525.

Signed-off-by: Dean Chen <862469039@qq.com>
---
 internal/chart/v3/loader/load_test.go | 37 +++++++++++++++------------
 pkg/chart/v2/loader/load_test.go      | 37 +++++++++++++++------------
 2 files changed, 42 insertions(+), 32 deletions(-)

diff --git a/internal/chart/v3/loader/load_test.go b/internal/chart/v3/loader/load_test.go
index f105b248f..e34364f39 100644
--- a/internal/chart/v3/loader/load_test.go
+++ b/internal/chart/v3/loader/load_test.go
@@ -21,6 +21,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"errors"
+	"fmt"
 	"io"
 	"log"
 	"os"
@@ -419,27 +420,31 @@ foo:
 	}
 }
 
-
 func TestLoadValuesEOFBoundary(t *testing.T) {
 	// Reproduces #32506: a single logical line whose length is a multiple of
 	// bufio's default buffer (4096) and has no trailing newline used to be
 	// dropped entirely by YAMLReader, yielding empty values.
-	prefix := []byte(`{"foo":"`)
-	suffix := []byte(`"}`)
-	pad := 4096 - len(prefix) - len(suffix)
-	data := make([]byte, 0, 4096)
-	data = append(data, prefix...)
-	data = append(data, bytes.Repeat([]byte("x"), pad)...)
-	data = append(data, suffix...)
-	if len(data) != 4096 {
-		t.Fatalf("test setup: want data length 4096, got %d", len(data))
-	}
+	// Also cover 8192 (2x buffer) so we do not only hit the single-buffer case.
+	for _, size := range []int{4096, 8192} {
+		t.Run(fmt.Sprintf("size_%d", size), func(t *testing.T) {
+			prefix := []byte(`{"foo":"`)
+			suffix := []byte(`"}`)
+			pad := size - len(prefix) - len(suffix)
+			data := make([]byte, 0, size)
+			data = append(data, prefix...)
+			data = append(data, bytes.Repeat([]byte("x"), pad)...)
+			data = append(data, suffix...)
+			if len(data) != size {
+				t.Fatalf("test setup: want data length %d, got %d", size, len(data))
+			}
 
-	values, err := LoadValues(bytes.NewReader(data))
-	require.NoError(t, err)
-	assert.Equal(t, map[string]any{
-		"foo": string(bytes.Repeat([]byte("x"), pad)),
-	}, values)
+			values, err := LoadValues(bytes.NewReader(data))
+			require.NoError(t, err)
+			assert.Equal(t, map[string]any{
+				"foo": string(bytes.Repeat([]byte("x"), pad)),
+			}, values)
+		})
+	}
 }
 
 func TestMergeValuesV3(t *testing.T) {
diff --git a/pkg/chart/v2/loader/load_test.go b/pkg/chart/v2/loader/load_test.go
index b4836ee95..ae1da1130 100644
--- a/pkg/chart/v2/loader/load_test.go
+++ b/pkg/chart/v2/loader/load_test.go
@@ -21,6 +21,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"errors"
+	"fmt"
 	"io"
 	"log"
 	"os"
@@ -463,27 +464,31 @@ foo:
 	}
 }
 
-
 func TestLoadValuesEOFBoundary(t *testing.T) {
 	// Reproduces #32506: a single logical line whose length is a multiple of
 	// bufio's default buffer (4096) and has no trailing newline used to be
 	// dropped entirely by YAMLReader, yielding empty values.
-	prefix := []byte(`{"foo":"`)
-	suffix := []byte(`"}`)
-	pad := 4096 - len(prefix) - len(suffix)
-	data := make([]byte, 0, 4096)
-	data = append(data, prefix...)
-	data = append(data, bytes.Repeat([]byte("x"), pad)...)
-	data = append(data, suffix...)
-	if len(data) != 4096 {
-		t.Fatalf("test setup: want data length 4096, got %d", len(data))
-	}
+	// Also cover 8192 (2x buffer) so we do not only hit the single-buffer case.
+	for _, size := range []int{4096, 8192} {
+		t.Run(fmt.Sprintf("size_%d", size), func(t *testing.T) {
+			prefix := []byte(`{"foo":"`)
+			suffix := []byte(`"}`)
+			pad := size - len(prefix) - len(suffix)
+			data := make([]byte, 0, size)
+			data = append(data, prefix...)
+			data = append(data, bytes.Repeat([]byte("x"), pad)...)
+			data = append(data, suffix...)
+			if len(data) != size {
+				t.Fatalf("test setup: want data length %d, got %d", size, len(data))
+			}
 
-	values, err := LoadValues(bytes.NewReader(data))
-	require.NoError(t, err)
-	assert.Equal(t, map[string]any{
-		"foo": string(bytes.Repeat([]byte("x"), pad)),
-	}, values)
+			values, err := LoadValues(bytes.NewReader(data))
+			require.NoError(t, err)
+			assert.Equal(t, map[string]any{
+				"foo": string(bytes.Repeat([]byte("x"), pad)),
+			}, values)
+		})
+	}
 }
 
 func TestMergeValuesV2(t *testing.T) {

From edb94f897d1e0ec3335fb7268f07e0fd2666fbb8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:43:12 -0600
Subject: [PATCH 31/35] chore(deps): bump golang.org/x/text from 0.40.0 to
 0.41.0 (#32543)

Bumps [golang.org/x/text](https://github.com/golang/text) from 0.40.0 to 0.41.0.
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.40.0...v0.41.0)

---
updated-dependencies:
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod |  8 ++++----
 go.sum | 16 ++++++++--------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/go.mod b/go.mod
index 6203377b7..a2f06e39f 100644
--- a/go.mod
+++ b/go.mod
@@ -37,7 +37,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/crypto v0.54.0
 	golang.org/x/term v0.45.0
-	golang.org/x/text v0.40.0
+	golang.org/x/text v0.41.0
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.36.3
 	k8s.io/apiextensions-apiserver v0.36.3
@@ -158,13 +158,13 @@ require (
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.48.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	google.golang.org/grpc v1.82.1 // indirect
diff --git a/go.sum b/go.sum
index 1b7a58218..75ac7bb0e 100644
--- a/go.sum
+++ b/go.sum
@@ -393,8 +393,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -405,8 +405,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -453,8 +453,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -463,8 +463,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=

From 2a29f1770b62844b27197d2507377361d45ad7c0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:50:55 -0600
Subject: [PATCH 32/35] chore(deps): bump golang.org/x/crypto from 0.54.0 to
 0.55.0 (#32545)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.54.0 to 0.55.0.
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index a2f06e39f..4c0468708 100644
--- a/go.mod
+++ b/go.mod
@@ -35,7 +35,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/tetratelabs/wazero v1.12.0
 	go.yaml.in/yaml/v3 v3.0.5
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.55.0
 	golang.org/x/term v0.45.0
 	golang.org/x/text v0.41.0
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 75ac7bb0e..35d9e4465 100644
--- a/go.sum
+++ b/go.sum
@@ -387,8 +387,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=

From bafdcde8ecd83119afd7f98363b364138d3b35dc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 15:44:55 -0600
Subject: [PATCH 33/35] chore(deps): bump github.com/stretchr/testify from
 1.11.1 to 1.12.0 (#32555)

Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/go.mod b/go.mod
index 4c0468708..6a691efac 100644
--- a/go.mod
+++ b/go.mod
@@ -32,7 +32,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.0
 	github.com/tetratelabs/wazero v1.12.0
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/crypto v0.55.0
diff --git a/go.sum b/go.sum
index 35d9e4465..54d14492a 100644
--- a/go.sum
+++ b/go.sum
@@ -301,14 +301,14 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=
+github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=
 github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 h1:ZF+QBjOI+tILZjBaFj3HgFonKXUcwgJ4djLb6i42S3Q=
 github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834/go.mod h1:m9ymHTgNSEjuxvw8E7WWe4Pl4hZQHXONY8wE6dMLaRk=
 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=

From c000a408b81266d328db64aea2ff9e2e70844790 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 15:58:11 -0600
Subject: [PATCH 34/35] chore(deps): bump the github-actions group across 1
 directory with 4 updates (#32556)

Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `github/codeql-action/autobuild` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql-analysis.yml | 6 +++---
 .github/workflows/scorecards.yml      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5e392cc2c..6bfec7108 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # pinv4.37.6
+      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # pinv4.37.7
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # pinv4.37.6
+      uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # pinv4.37.7
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # pinv4.37.6
+      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # pinv4.37.7
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 553a6b3da..0a12abf49 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: results.sarif

From e9b85e4de16ad45805843fb121748018cf89094b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 15:58:20 -0600
Subject: [PATCH 35/35] chore(deps): bump github.com/stretchr/testify from
 1.12.0 to 1.12.1 (#32562)

Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 6a691efac..c34a80649 100644
--- a/go.mod
+++ b/go.mod
@@ -32,7 +32,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/stretchr/testify v1.12.0
+	github.com/stretchr/testify v1.12.1
 	github.com/tetratelabs/wazero v1.12.0
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/crypto v0.55.0
diff --git a/go.sum b/go.sum
index 54d14492a..bfac195f1 100644
--- a/go.sum
+++ b/go.sum
@@ -307,8 +307,8 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=
-github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 h1:ZF+QBjOI+tILZjBaFj3HgFonKXUcwgJ4djLb6i42S3Q=
 github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834/go.mod h1:m9ymHTgNSEjuxvw8E7WWe4Pl4hZQHXONY8wE6dMLaRk=
 github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU=