Upgrades golang.org/x/net from v0.53.0 to v0.55.0 to fix CVE-2026-39821
(GO-2026-5026), where idna.ToASCII/ToUnicode incorrectly accept Punycode-
encoded labels that decode to ASCII-only labels, enabling privilege escalation
via hostname check bypass.
Coordinated x/ upgrade pulled in by the module graph:
- golang.org/x/sys v0.44.0 => v0.45.0
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Helm v4 shipped on 2025-11-17. Mark it as the current stable release
and v3 as support-mode with its end-of-support dates.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Return the actual error from io.Copy in Digest() instead of nil.
The previous code swallowed the error and returned an empty string
as a valid SHA-256 digest, which could silently break chart
provenance verification.
Also fix encodeRelease() in pkg/storage/driver/util.go:
- Close the gzip writer on the w.Write() error path to avoid
leaking resources.
- Check the error return from gzip.Writer.Close(), which flushes
remaining compressed data and can fail.
Assisted-by: Grok/xAI
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
The comment describing allowed plugin name characters contained three
U+200B (zero-width space) characters around the '_' and '-' literals.
The rendered comment is identical without them; the ZWSP were likely
copy-pasted from a rich-text source.
Downstream impact: every project that vendors helm.sh/helm/v4 and runs
Renovate gets a repo-wide warning on its Dependency Dashboard about
hidden Unicode characters. Renovate scans the whole tree (including
vendor/) for ZWSP/bidi-override codepoints and cannot be told to skip
a path for this specific check. Removing the characters here clears
the warning everywhere downstream.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Before this change, hooks with `helm.sh/hook: test` but Kind != Pod
(ConfigMap, Secret, ...) led to `helm test --logs` fail with
`unable to get pod <name>`.
Signed-off-by: Gregory Man <man.gregory@gmail.com>
slog.Error on line 157 passes printf-style positional args (%q, %s)
instead of key-value pairs. The slog API treats these as unkeyed
attributes, producing garbled log output.
Two nearby slog.Warn calls wrap fmt.Sprintf unnecessarily. Convert
all three calls to use proper structured key-value arguments.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Assisted-by: Grok/grok-4
- ChartDownloader.repositoryURL is now cleared at the start of
ResolveChartVersion and set in the absolute-URL branch too, so
reused downloaders don't report stale URLs.
- New ChartPathOptions.ResolvedRepoURL() carries provenance from
LocateChart so it no longer overwrites the --repo input field.
Install/Upgrade actions stamp metadata.RepoURL from it first,
falling back to RepoURL for consumers that bypass LocateChart.
- Align RepoURL doc strings in chart v2 and v3 metadata.
Signed-off-by: Aleksei Krugliak <aleksei.krugliak@altenar.com>
- Stamp chart.Metadata.RepoURL in Install/Upgrade actions instead of
pkg/cmd, so library consumers also get provenance recorded.
- Don't mislabel local installs as path; fill RepoURL only for
resolved repos, OCI refs, and absolute http(s) URLs.
- Unexport ChartDownloader.RepositoryURL; expose via accessor to
preserve ABI for downstream unkeyed-struct users.
- Fix render test template to use .Chart.RepoURL.
Signed-off-by: Aleksei Krugliak <aleksei.krugliak@altenar.com>
- Distinguish unowned resources from those whose ownership could not be
verified (e.g. RBAC/network errors). Unverifiable resources are now
returned in a separate list with the underlying error so log output
and the "kept" summary describe what actually happened.
- Only prefix the kept summary with the resource-policy header when
there are policy-kept resources, so users with only ownership-skipped
resources don't see a misleading header.
- Update verifyOwnershipBeforeDelete doc comment to reflect that
not-found resources are excluded from all returned lists.
- Assert success of Releases.Create in uninstall tests so fixture
setup failures are surfaced immediately.
Signed-off-by: Evans Mungai <mbuevans@gmail.com>
- Close log stream after reading (prevents connection/fd leak)
- Strengthen tests to assert on output headers rather than error paths
- Remove unused import
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
When a test pod contains multiple containers (e.g. Istio/Consul/Vault
sidecars), 'helm test --logs' failed with 'a container name must be
specified'. This happened because GetPodLogs called the Kubernetes log
API without specifying a container name.
The fix fetches the pod spec first, then iterates over all containers
(init containers + regular containers) and requests logs for each one
explicitly. Errors from individual containers are collected and returned
together via errors.Join rather than aborting on the first failure.
Also fixes a typo: hooksByWight -> hooksByWeight.
Closes#6902
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
Terry Howe
dependabot[bot]
Benoit Tigeot
Sebastien Tardif
Aleksei Sviridkin
Robert Sirchia
MrJack
Gregory Man
George Jenkins
Evans Mungai
Matheus Pimenta
Kai Tanaka
Aleksei Krugliak
box4wangjing
Sumit Solanki
Scott Rigby