585796079e
chore(deps): bump github.com/ProtonMail/go-crypto from 1.5.0 to 1.5.2 ( #32700 )
...
Bumps [github.com/ProtonMail/go-crypto](https://github.com/ProtonMail/go-crypto ) from 1.5.0 to 1.5.2.
- [Release notes](https://github.com/ProtonMail/go-crypto/releases )
- [Commits](https://github.com/ProtonMail/go-crypto/compare/v1.5.0...v1.5.2 )
---
updated-dependencies:
- dependency-name: github.com/ProtonMail/go-crypto
dependency-version: 1.5.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 days ago
7d485b7fac
chore(deps): bump the github-actions group across 1 directory with 4 updates ( #32702 )
...
Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.38.1 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](1c5b675653...2892aa5e19https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](1c5b675653...2892aa5e19https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](1c5b675653...2892aa5e19https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](1c5b675653...2892aa5e19
2 days ago
aca461e681
chore(deps): bump github.com/distribution/distribution/v3 ( #32697 )
...
Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution ) from 3.1.1 to 3.1.2.
- [Release notes](https://github.com/distribution/distribution/releases )
- [Commits](https://github.com/distribution/distribution/compare/v3.1.1...v3.1.2 )
---
updated-dependencies:
- dependency-name: github.com/distribution/distribution/v3
dependency-version: 3.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 days ago
de0c740778
chore(deps): bump github.com/ProtonMail/go-crypto from 1.4.1 to 1.5.0 ( #32689 )
...
Bumps [github.com/ProtonMail/go-crypto](https://github.com/ProtonMail/go-crypto ) from 1.4.1 to 1.5.0.
- [Release notes](https://github.com/ProtonMail/go-crypto/releases )
- [Commits](https://github.com/ProtonMail/go-crypto/compare/v1.4.1...v1.5.0 )
---
updated-dependencies:
- dependency-name: github.com/ProtonMail/go-crypto
dependency-version: 1.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
4 days ago
4113f36394
chore(deps): bump the github-actions group with 4 updates ( #32678 )
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.38.0 to 4.38.1
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](b96794f015...1c5b675653https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](b96794f015...1c5b675653https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](b96794f015...1c5b675653https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](b96794f015...1c5b675653
1 week ago
cddb9c4138
chore(deps): bump github.com/mattn/go-shellwords from 1.0.14 to 1.0.15 ( #32653 )
...
Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/mattn/go-shellwords/releases )
- [Commits](https://github.com/mattn/go-shellwords/compare/v1.0.14...v1.0.15 )
---
updated-dependencies:
- dependency-name: github.com/mattn/go-shellwords
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 week ago
7d63fd2ebd
[dev-v3 backport] deps: bump google.golang.org/grpc@v1.83.2 for GO-2026-6348 ( #32659 )
...
backport of #32614 and #32636
updated with:
```
go get google.golang.org/grpc@v1.83.2
go mod tidy
```
Closes #32655
Signed-off-by: abdouladieng <diengabdoulaziz110@gmail.com>
1 week ago
ae190fadb7
chore(deps): bump the github-actions group with 4 updates ( #32650 )
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](cdf488f595...b96794f015https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](cdf488f595...b96794f015https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](cdf488f595...b96794f015https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](cdf488f595...b96794f015
2 weeks ago
e148727ed1
chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 ( #32642 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.56.0 to 0.57.0.
- [Commits](https://github.com/golang/crypto/compare/v0.56.0...v0.57.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
4231d7c3f0
chore(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 ( #32640 )
...
Bumps [golang.org/x/text](https://github.com/golang/text ) from 0.41.0 to 0.42.0.
- [Release notes](https://github.com/golang/text/releases )
- [Commits](https://github.com/golang/text/compare/v0.41.0...v0.42.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/text
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
e83adef39e
chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 ( #32630 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.55.0 to 0.56.0.
- [Commits](https://github.com/golang/crypto/compare/v0.55.0...v0.56.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.56.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
59ce08e0e2
Merge pull request #32597 from helm/dependabot/go_modules/dev-v3/k8s-io-997deca8d0
...
chore(deps): bump the k8s-io group across 1 directory with 6 updates
4 weeks ago
488283bc9c
chore(deps): bump the k8s-io group across 1 directory with 6 updates
...
Bumps the k8s-io group with 3 updates in the / directory: [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver ), [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime ) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl ).
Updates `k8s.io/apiextensions-apiserver` from 0.36.4 to 0.37.0
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases )
- [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/apimachinery` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/apiserver` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/apiserver/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/cli-runtime` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/client-go` from 0.36.4 to 0.37.0
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/kubernetes/client-go/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/kubectl` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/kubectl/compare/v0.36.4...v0.37.0 )
---
updated-dependencies:
- dependency-name: k8s.io/apiextensions-apiserver
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/apimachinery
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/apiserver
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/cli-runtime
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/client-go
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/kubectl
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
...
Signed-off-by: dependabot[bot] <support@github.com>
4 weeks ago
9fa241e18d
chore(deps): bump the github-actions group across 1 directory with 4 updates ( #32604 )
...
Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595
1 month ago
5fe0645373
chore(deps): bump github.com/gofrs/flock from 0.13.0 to 0.13.1 ( #32600 )
...
Bumps [github.com/gofrs/flock](https://github.com/gofrs/flock ) from 0.13.0 to 0.13.1.
- [Release notes](https://github.com/gofrs/flock/releases )
- [Commits](https://github.com/gofrs/flock/compare/v0.13.0...v0.13.1 )
---
updated-dependencies:
- dependency-name: github.com/gofrs/flock
dependency-version: 0.13.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 month ago
eef239fefe
chore(deps): bump github.com/gobwas/glob from 0.2.3 to 1.0.0 ( #32599 )
...
Bumps [github.com/gobwas/glob](https://github.com/gobwas/glob ) from 0.2.3 to 1.0.0.
- [Release notes](https://github.com/gobwas/glob/releases )
- [Commits](https://github.com/gobwas/glob/compare/v0.2.3...v1.0.0 )
---
updated-dependencies:
- dependency-name: github.com/gobwas/glob
dependency-version: 1.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 month ago
b5de8bbe62
bump version to 3.22 ( #32606 )
...
Signed-off-by: Scott Rigby <scott@r6by.com>
1 month ago
9dbcb9f1ed
fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) ( #32362 )
...
* set [pull,push] scope when helm push
* add a validation for push scope setting, add some test code to check the scope when registry use token auth
* eliminate gin-gonic dependency in client_scope_test.go test code
* change the parameter order in suite.Equal in client_scope_test.go code
* add license header in client_scope_test.go file
* move variable location
* remove freeport dependency
Signed-off-by: kimsungmin1 <sm28.kim@samsung.com>
1 month ago
665ab55b05
chore(deps): bump the github-actions group across 1 directory with 4 updates ( #32575 )
...
Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.7 to 4.37.8
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3
1 month ago
0841093658
chore(deps): bump the k8s-io group with 7 updates ( #32573 )
...
Bumps the k8s-io group with 7 updates:
| Package | From | To |
| --- | --- | --- |
| [k8s.io/api](https://github.com/kubernetes/api ) | `0.36.3` | `0.36.4` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver ) | `0.36.3` | `0.36.4` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery ) | `0.36.3` | `0.36.4` |
| [k8s.io/apiserver](https://github.com/kubernetes/apiserver ) | `0.36.3` | `0.36.4` |
| [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime ) | `0.36.3` | `0.36.4` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go ) | `0.36.3` | `0.36.4` |
| [k8s.io/kubectl](https://github.com/kubernetes/kubectl ) | `0.36.3` | `0.36.4` |
Updates `k8s.io/api` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/api/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/apiextensions-apiserver` from 0.36.3 to 0.36.4
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases )
- [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/apimachinery` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/apiserver` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/apiserver/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/cli-runtime` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/client-go` from 0.36.3 to 0.36.4
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/kubernetes/client-go/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/kubectl` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/kubectl/compare/v0.36.3...v0.36.4 )
---
updated-dependencies:
- dependency-name: k8s.io/api
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apiextensions-apiserver
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apimachinery
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apiserver
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/cli-runtime
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/client-go
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/kubectl
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 month ago
d0569c7d62
chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 ( #32563 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-version: 1.12.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 month ago
bcbdb1e8ae
chore(deps): bump the github-actions group across 1 directory with 4 updates ( #32557 )
...
Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621bhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621bhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621bhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621b
1 month ago
6cdcc8f91d
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 ( #32554 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.11.1 to 1.12.0.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-version: 1.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 month ago
158719fb43
chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 ( #32542 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.54.0 to 0.55.0.
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.55.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 months ago
a442b8cf64
[dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 ( #32536 )
...
backport of https://github.com/helm/helm/pull/32450
updated with:
```
go get google.golang.org/grpc@v1.82.1
go mod tidy
```
example actions failure:
https://github.com/helm/helm/actions/runs/31733009013/job/94557780520
```
Vulnerability #1 : GO-2026-6061
Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2
transport server implementation in google.golang.org/grpc
More info: https://pkg.go.dev/vuln/GO-2026-6061
Module: google.golang.org/grpc
Found in: google.golang.org/grpc@v1.80.0
Fixed in: google.golang.org/grpc@v1.82.1
Example traces found:
Error: #1 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Close
Error: #2 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Header
Error: #3 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Read
Error: #4 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.RecvCompress
Error: #5 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.TrailersOnly
Error: #6 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Write
Error: #7 : pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.NewHTTP2Client
Error: #8 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.Stream.ReadMessageHeader
Error: #9 : pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.Close
Error: #10 : pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.GracefulClose
Error: #11 : pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.http2Client.NewStream
```
Signed-off-by: Scott Rigby <scott@r6by.com>
2 months ago
adab0ef15d
fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 ( #32535 )
...
backport of https://github.com/helm/helm/pull/32521
see https://pkg.go.dev/vuln/GO-2026-5158
Signed-off-by: Scott Rigby <scott@r6by.com>
2 months ago
c068b54325
chore(deps): bump the github-actions group with 4 updates ( #32524 )
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91
2 months ago
ae05c50302
Merge pull request #32513 from helm/dependabot/go_modules/dev-v3/github.com/santhosh-tekuri/jsonschema/v6-6.0.3
...
chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
2 months ago
08623addb3
Merge pull request #32515 from helm/dependabot/github_actions/dev-v3/github-actions-abda45ccb9
...
chore(deps): bump the github-actions group with 4 updates
2 months ago
74271c4258
chore(deps): bump the github-actions group with 4 updates
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13d
2 months ago
1c50d2f8bd
chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6
...
Bumps [github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema ) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/santhosh-tekuri/jsonschema/releases )
- [Commits](https://github.com/santhosh-tekuri/jsonschema/compare/v6.0.2...v6.0.3 )
---
updated-dependencies:
- dependency-name: github.com/santhosh-tekuri/jsonschema/v6
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
a560eab10d
Merge pull request #32463 from karan-vk/fix/dev-v3-openpgp-govulncheck
...
fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932
2 months ago
88215407a8
chore(deps): bump the github-actions group with 4 updates ( #32509 )
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33
2 months ago
05a27980df
chore(deps): bump actions/stale in the github-actions group ( #32488 )
...
Bumps the github-actions group with 1 update: [actions/stale](https://github.com/actions/stale ).
Updates `actions/stale` from 10.4.0 to 11.0.0
- [Release notes](https://github.com/actions/stale/releases )
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md )
- [Commits](1e223db275...4391f3da66
2 months ago
14f349e357
Merge pull request #32303 from mahesh-sadupalli/fix/files-lines-empty-panic-v3
...
fix(engine): prevent Files.Lines panic on empty file (backport to v3)
2 months ago
57f1dbe507
Merge pull request #32460 from helm/dependabot/go_modules/dev-v3/k8s-io-9ea670a458
...
chore(deps): bump the k8s-io group with 7 updates
2 months ago
c27e7577e3
chore(deps): bump ossf/scorecard-action in the github-actions group ( #32461 )
...
Bumps the github-actions group with 1 update: [ossf/scorecard-action](https://github.com/ossf/scorecard-action ).
Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](4eaacf0543...2d1146689b
2 months ago
bd392c6a60
fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932
...
Backport of the openpgp migration already merged to main (7c9176ae3Fixes #32361
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Karan V <karanvknarayanan@gmail.com>
2 months ago
66a6f5601d
chore(deps): bump the k8s-io group with 7 updates
...
Bumps the k8s-io group with 7 updates:
| Package | From | To |
| --- | --- | --- |
| [k8s.io/api](https://github.com/kubernetes/api ) | `0.36.2` | `0.36.3` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver ) | `0.36.2` | `0.36.3` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery ) | `0.36.2` | `0.36.3` |
| [k8s.io/apiserver](https://github.com/kubernetes/apiserver ) | `0.36.2` | `0.36.3` |
| [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime ) | `0.36.2` | `0.36.3` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go ) | `0.36.2` | `0.36.3` |
| [k8s.io/kubectl](https://github.com/kubernetes/kubectl ) | `0.36.2` | `0.36.3` |
Updates `k8s.io/api` from 0.36.2 to 0.36.3
- [Commits](https://github.com/kubernetes/api/compare/v0.36.2...v0.36.3 )
Updates `k8s.io/apiextensions-apiserver` from 0.36.2 to 0.36.3
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases )
- [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.36.2...v0.36.3 )
Updates `k8s.io/apimachinery` from 0.36.2 to 0.36.3
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.2...v0.36.3 )
Updates `k8s.io/apiserver` from 0.36.2 to 0.36.3
- [Commits](https://github.com/kubernetes/apiserver/compare/v0.36.2...v0.36.3 )
Updates `k8s.io/cli-runtime` from 0.36.2 to 0.36.3
- [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.36.2...v0.36.3 )
Updates `k8s.io/client-go` from 0.36.2 to 0.36.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/kubernetes/client-go/compare/v0.36.2...v0.36.3 )
Updates `k8s.io/kubectl` from 0.36.2 to 0.36.3
- [Commits](https://github.com/kubernetes/kubectl/compare/v0.36.2...v0.36.3 )
---
updated-dependencies:
- dependency-name: k8s.io/api
dependency-version: 0.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apiextensions-apiserver
dependency-version: 0.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apimachinery
dependency-version: 0.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apiserver
dependency-version: 0.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/cli-runtime
dependency-version: 0.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/client-go
dependency-version: 0.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/kubectl
dependency-version: 0.36.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
f174561a97
Merge pull request #32452 from helm/dependabot/github_actions/dev-v3/github-actions-85dd5d8b53
...
chore(deps): bump the github-actions group with 4 updates
2 months ago
7cd01254d3
chore(deps): bump the github-actions group with 4 updates
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.2 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e0647621c2...e4fba868fahttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e0647621c2...e4fba868fahttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e0647621c2...e4fba868fahttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e0647621c2...e4fba868fa
2 months ago
2ada254ad1
Merge pull request #32445 from helm/dependabot/github_actions/dev-v3/github/codeql-action/init-4.37.2
...
chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2
2 months ago
4836fbc1e9
Merge pull request #32447 from helm/dependabot/github_actions/dev-v3/github/codeql-action/autobuild-4.37.2
...
chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2
2 months ago
44a4202f38
Merge pull request #32448 from helm/dependabot/github_actions/dev-v3/github/codeql-action/analyze-4.37.2
...
chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2
2 months ago
79330fceb9
chore(deps): bump github/codeql-action/upload-sarif ( #32449 )
...
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) from 4.37.1 to 4.37.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](7188fc3636...e0647621c2
2 months ago
b29c7309f1
chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 ( #32446 )
...
Bumps [actions/labeler](https://github.com/actions/labeler ) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/labeler/releases )
- [Commits](b8dd2d9be0...bf12e9b00b
2 months ago
973bb346b8
chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2
...
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action ) from 4.37.1 to 4.37.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](7188fc3636...e0647621c2
2 months ago
e25efcf283
chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2
...
Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action ) from 4.37.1 to 4.37.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](7188fc3636...e0647621c2
2 months ago
98e547f8ed
chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2
...
Bumps [github/codeql-action/init](https://github.com/github/codeql-action ) from 4.37.1 to 4.37.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](7188fc3636...e0647621c2
2 months ago
7f4b72a711
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 ( #32412 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](9c091bb21b...3d3c42e5aa
2 months ago
dependabot[bot]
Abdoul Aziz Dieng
Robert Sirchia
Scott Rigby
kimsungmin1
George Jenkins
Matt Farina
Terry Howe
Karan V