George Jenkins
4dec37abd2
Merge pull request #32148 from helm/dependabot/go_modules/main/golang.org/x/crypto-0.52.0
...
chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
15 hours ago
dependabot[bot]
7510b83214
chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.51.0 to 0.52.0.
- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.52.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
15 hours ago
George Jenkins
63a5d1baa9
Merge pull request #32153 from TerryHowe/fix/bump-x-net-go-2026-5026-main
...
fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026
15 hours ago
Terry Howe
54ae27fd84
fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026
...
Upgrades golang.org/x/net from v0.53.0 to v0.55.0 to fix CVE-2026-39821
(GO-2026-5026), where idna.ToASCII/ToUnicode incorrectly accept Punycode-
encoded labels that decode to ASCII-only labels, enabling privilege escalation
via hostname check bypass.
Coordinated x/ upgrade pulled in by the module graph:
- golang.org/x/sys v0.44.0 => v0.45.0
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
5 days ago
Terry Howe
609e1ca72c
Merge pull request #32145 from helm/dependabot/github_actions/main/github/codeql-action-4.36.0
...
chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0
5 days ago
Terry Howe
8807308231
Merge pull request #32146 from helm/dependabot/github_actions/main/golangci/golangci-lint-action-9.2.1
...
chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
5 days ago
dependabot[bot]
dbb3e35337
chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
...
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action ) from 9.2.0 to 9.2.1.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases )
- [Commits](1e7e51e771...82606bf257 )
---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
dependency-version: 9.2.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
5 days ago
dependabot[bot]
60665e9035
chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.5 to 4.36.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](9e0d7b8d25...7211b7c807 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
5 days ago
Terry Howe
ff2b139502
Merge pull request #32141 from benoittgt/update-v4-readme
...
docs: update version status for v4 stable release
5 days ago
Benoit Tigeot
442e1460b9
docs: update version status for v4 stable release
...
Helm v4 shipped on 2025-11-17. Mark it as the current stable release
and v3 as support-mode with its end-of-support dates.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
5 days ago
Terry Howe
e65b8666aa
Merge pull request #32138 from helm/dependabot/github_actions/main/actions/stale-10.3.0
...
chore(deps): bump actions/stale from 10.2.0 to 10.3.0
6 days ago
dependabot[bot]
ace245b827
chore(deps): bump actions/stale from 10.2.0 to 10.3.0
...
Bumps [actions/stale](https://github.com/actions/stale ) from 10.2.0 to 10.3.0.
- [Release notes](https://github.com/actions/stale/releases )
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md )
- [Commits](b5d41d4e1d...eb5cf3af3a )
---
updated-dependencies:
- dependency-name: actions/stale
dependency-version: 10.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
6 days ago
Terry Howe
16a39b73fd
Merge pull request #32134 from lexfrei/fix/zero-width-spaces-plugin-comment
...
internal/plugin: remove zero-width spaces from plugin name comment
6 days ago
Aleksei Sviridkin
979e68fbbd
internal/plugin: remove zero-width spaces from plugin name comment
...
The comment describing allowed plugin name characters contained three
U+200B (zero-width space) characters around the '_' and '-' literals.
The rendered comment is identical without them; the ZWSP were likely
copy-pasted from a rich-text source.
Downstream impact: every project that vendors helm.sh/helm/v4 and runs
Renovate gets a repo-wide warning on its Dependency Dashboard about
hidden Unicode characters. Renovate scans the whole tree (including
vendor/) for ZWSP/bidi-override codepoints and cannot be told to skip
a path for this specific check. Removing the characters here clears
the warning everywhere downstream.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
1 week ago
Terry Howe
fcdf3854b0
Merge pull request #32113 from isumitsolanki/issue_32100
...
fix(downloader): order DiskCache.Get checks for overlayfs empty dirs
1 week ago
Robert Sirchia
6c3f397d2c
Merge pull request #32122 from quyentonndbs/chore/lint-deprecations-comment-typo
...
docs: fix typo in deprecated API godoc
1 week ago
George Jenkins
94d5023846
Merge pull request #32125 from SebTardif/fix-slog-printf-args
...
fix(repo): use structured slog args in index.go
1 week ago
Evans Mungai
62082d986b
Merge pull request #32128 from matheuscscp/upgrade-cli-utils-c-r
...
fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1
2 weeks ago
Terry Howe
a7291a1df4
Merge pull request #32127 from helm/dependabot/go_modules/main/github.com/fluxcd/cli-utils-1.2.1
...
chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1
2 weeks ago
Terry Howe
b7d3b4e704
Merge pull request #32126 from helm/dependabot/github_actions/main/github/codeql-action-4.35.5
...
chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5
2 weeks ago
Matheus Pimenta
378ceacd9c
fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1
...
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
2 weeks ago
dependabot[bot]
b5a9299eec
chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1
...
Bumps [github.com/fluxcd/cli-utils](https://github.com/fluxcd/cli-utils ) from 1.2.0 to 1.2.1.
- [Release notes](https://github.com/fluxcd/cli-utils/releases )
- [Commits](https://github.com/fluxcd/cli-utils/compare/v1.2.0...v1.2.1 )
---
updated-dependencies:
- dependency-name: github.com/fluxcd/cli-utils
dependency-version: 1.2.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 weeks ago
dependabot[bot]
f772ffedc6
chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](68bde559de...9e0d7b8d25 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 weeks ago
Sebastien Tardif
ea2343ebea
fix(repo): use structured slog args in index.go
...
slog.Error on line 157 passes printf-style positional args (%q, %s)
instead of key-value pairs. The slog API treats these as unkeyed
attributes, producing garbled log output.
Two nearby slog.Warn calls wrap fmt.Sprintf unnecessarily. Convert
all three calls to use proper structured key-value arguments.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Assisted-by: Grok/grok-4
2 weeks ago
Terry Howe
b2786f15f2
Merge pull request #32118 from box4wangjing/main
...
refactor: use slices.Backward to simplify the code
2 weeks ago
George Jenkins
39b2edca71
Merge pull request #32091 from ogulcanaydogan/chore/remove-pre-go120-transport-cloner
...
fix(registry): remove pre-Go-1.20 transport cloner fallback
2 weeks ago
Kai Tanaka
2032ec5cba
docs: fix 'than'->'that' typo in deprecatedAPIError godoc
...
Signed-off-by: Kai Tanaka <275430420+quyentonndbs@users.noreply.github.com>
2 weeks ago
box4wangjing
432fc8a217
refactor: use slices.Backward to simplify the code
...
Signed-off-by: box4wangjing <box4wangjing@outlook.com>
2 weeks ago
Terry Howe
0f09636c79
Merge pull request #32099 from SebTardif/fix/helm-test-logs-multi-container
...
fix: fetch logs from all containers in test pods
2 weeks ago
Terry Howe
d9a18b59a8
Merge pull request #31695 from aeroyorch/add-duration-functions
...
Add duration functions
2 weeks ago
Terry Howe
ce7fb4dae4
Merge pull request #32112 from helm/dependabot/go_modules/main/golang.org/x/crypto-0.51.0
...
chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0
2 weeks ago
Sumit Solanki
53d5f13f46
Potential fix for pull request finding
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
3 weeks ago
Sumit Solanki
6620fec5d1
fix(downloader): order DiskCache.Get checks for overlayfs empty dirs
...
Signed-off-by: Sumit Solanki <sumit.solanki@ibm.com>
3 weeks ago
dependabot[bot]
2cc69251d8
chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.50.0 to 0.51.0.
- [Commits](https://github.com/golang/crypto/compare/v0.50.0...v0.51.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.51.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
3 weeks ago
Terry Howe
0752c1f5b5
Merge pull request #32108 from helm/dependabot/github_actions/main/github/codeql-action-4.35.4
...
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4
3 weeks ago
dependabot[bot]
d9b2716be5
chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e46ed2cbd0...68bde559de )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
3 weeks ago
George Jenkins
19b3656306
Bump to version v4.2 ( #32102 )
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
3 weeks ago
Scott Rigby
e23bf3af53
build: Clean up Goreleaser change ( #32098 )
...
Makefile:
- restore dist target
- remove unused LDFLAGS added to dist target
- remove unused TARGETS var
gh release action:
- restore build-cross to release and canary-release jobs
Signed-off-by: Scott Rigby <scott@r6by.com>
Co-authored-by: Terry Howe <terrylhowe@gmail.com>
3 weeks ago
Sebastien Tardif
922558fc1a
fix: address review feedback
...
- Close log stream after reading (prevents connection/fd leak)
- Strengthen tests to assert on output headers rather than error paths
- Remove unused import
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
3 weeks ago
Sebastien Tardif
854f7f6b72
fix: fetch logs from all containers in test pods
...
When a test pod contains multiple containers (e.g. Istio/Consul/Vault
sidecars), 'helm test --logs' failed with 'a container name must be
specified'. This happened because GetPodLogs called the Kubernetes log
API without specifying a container name.
The fix fetches the pod spec first, then iterates over all containers
(init containers + regular containers) and requests logs for each one
explicitly. Errors from individual containers are collected and returned
together via errors.Join rather than aborting on the first failure.
Also fixes a typo: hooksByWight -> hooksByWeight.
Closes #6902
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
3 weeks ago
George Jenkins
ad18580255
Merge pull request #31343 from TerryHowe/chore-replace-mitchellh-gox-with-goreleaser
...
chore: replace mitchellh/gox with goreleaser
3 weeks ago
Terry Howe
b3a458fde9
Merge pull request #31970 from isumitsolanki/fix/31965-decouple-cli-from-kube
...
refactor(cli): decouple EnvSettings from pkg/kube to avoid import cycles
3 weeks ago
Terry Howe
f60ab7c31c
fix: add -extldflags -static to dist target to match build-cross
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago
Terry Howe
64aa46f2f1
build: use goreleaser build with manual archive creation
...
goreleaser v2 has a bug with no_unique_dist_dir where it registers
archive tasks for all sub-arch variants even when constraints limit
builds to one per arch, causing archive collision errors. Switch dist
target to use goreleaser build (binaries only) and create tar.gz/zip
archives manually, copying LICENSE and README.md into each platform
directory to match the existing archive structure.
Add sub-arch constraints (goamd64, goarm64, go386, goriscv64) to ensure
only one variant is built per architecture.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago
Terry Howe
d199a1a42c
chore: remove build-cross dependency from test-acceptance
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago
Terry Howe
82899404a6
ci: add fetch-depth 0 to canary checkout for goreleaser
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago
Terry Howe
c075022ce1
fix: address goreleaser build issues flagged in review
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago
Terry Howe
04885dd905
fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago
Terry Howe
93103ce66c
fix: disable goreleaser checksums.txt and restrict zip to windows only
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago
Terry Howe
e49a1dc16e
fix: use index for optional env var in version_template
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
4 weeks ago