614120ff25
chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.83.1 to 1.83.2.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2 days ago
87268ee077
chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 ( #32632 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.55.0 to 0.56.0.
- [Commits](https://github.com/golang/crypto/compare/v0.55.0...v0.56.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.56.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 days ago
357678488e
chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0 ( #32631 )
...
Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime ) from 0.24.1 to 0.25.0.
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases )
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md )
- [Commits](https://github.com/kubernetes-sigs/controller-runtime/compare/v0.24.1...v0.25.0 )
---
updated-dependencies:
- dependency-name: sigs.k8s.io/controller-runtime
dependency-version: 0.25.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 days ago
fa11636b01
Merge pull request #32590 from cuishuang/main
...
fix(downloader): pass getter options when fetching cached provenance
1 week ago
7803d52e7f
Merge pull request #32598 from helm/dependabot/go_modules/main/k8s-io-997deca8d0
...
chore(deps): bump the k8s-io group across 1 directory with 6 updates
1 week ago
61313b07c1
Merge pull request #32613 from helm/dependabot/go_modules/main/github.com/fluxcd/cli-utils-1.2.3
...
chore(deps): bump github.com/fluxcd/cli-utils from 1.2.2 to 1.2.3
1 week ago
b588bcd32f
chore(deps): bump the k8s-io group across 1 directory with 6 updates
...
Bumps the k8s-io group with 3 updates in the / directory: [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver ), [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime ) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl ).
Updates `k8s.io/apiextensions-apiserver` from 0.36.4 to 0.37.0
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases )
- [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/apimachinery` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/apiserver` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/apiserver/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/cli-runtime` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/client-go` from 0.36.4 to 0.37.0
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/kubernetes/client-go/compare/v0.36.4...v0.37.0 )
Updates `k8s.io/kubectl` from 0.36.4 to 0.37.0
- [Commits](https://github.com/kubernetes/kubectl/compare/v0.36.4...v0.37.0 )
---
updated-dependencies:
- dependency-name: k8s.io/apiextensions-apiserver
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/apimachinery
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/apiserver
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/cli-runtime
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/client-go
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/kubectl
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
...
Signed-off-by: dependabot[bot] <support@github.com>
1 week ago
42af994c33
Merge pull request #32614 from helm/dependabot/go_modules/google.golang.org/grpc-1.83.1
...
chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1
1 week ago
9c9c8e10ca
chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.82.1 to 1.83.1.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.1 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
1 week ago
fa6ea21d4c
chore(deps): bump github.com/fluxcd/cli-utils from 1.2.2 to 1.2.3
...
Bumps [github.com/fluxcd/cli-utils](https://github.com/fluxcd/cli-utils ) from 1.2.2 to 1.2.3.
- [Release notes](https://github.com/fluxcd/cli-utils/releases )
- [Commits](https://github.com/fluxcd/cli-utils/compare/v1.2.2...v1.2.3 )
---
updated-dependencies:
- dependency-name: github.com/fluxcd/cli-utils
dependency-version: 1.2.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 week ago
67946bb22e
chore(deps): bump the github-actions group across 1 directory with 4 updates ( #32603 )
...
Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](db488ddef3...cdf488f595
1 week ago
4ba1280837
chore(deps): bump github.com/gobwas/glob from 0.2.3 to 1.0.0 ( #32602 )
...
Bumps [github.com/gobwas/glob](https://github.com/gobwas/glob ) from 0.2.3 to 1.0.0.
- [Release notes](https://github.com/gobwas/glob/releases )
- [Commits](https://github.com/gobwas/glob/compare/v0.2.3...v1.0.0 )
---
updated-dependencies:
- dependency-name: github.com/gobwas/glob
dependency-version: 1.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 week ago
702c67e97d
chore(deps): bump github.com/gofrs/flock from 0.13.0 to 0.13.1 ( #32601 )
...
Bumps [github.com/gofrs/flock](https://github.com/gofrs/flock ) from 0.13.0 to 0.13.1.
- [Release notes](https://github.com/gofrs/flock/releases )
- [Commits](https://github.com/gofrs/flock/compare/v0.13.0...v0.13.1 )
---
updated-dependencies:
- dependency-name: github.com/gofrs/flock
dependency-version: 0.13.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 week ago
c0039291c1
bump version to 4.3 ( #32605 )
...
Signed-off-by: Scott Rigby <scott@r6by.com>
1 week ago
4c36bd1d4e
Merge pull request #32364 from gjenkins8/gjenkins/cleanup_deprecated_todo_comments
...
chore: Cleanup deprecated and TODO comments
1 week ago
babae796e3
chore: Cleanup deprecated and TODO comments
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
1 week ago
2b3f680754
Merge pull request #32596 from gjenkins8/gjenkins/fix_ci
...
chore: Fix independent-merge lint issues
1 week ago
ca6681ca55
chore: Fix independent-merge lint issues
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
1 week ago
37752b70b2
refactor(repo): Use byte buffer to build index file ( #32579 )
...
The string returned by the string builder was cast to a byte slice
anyways. Remove this indirection. Also, write directly to the buffer
instead of using fmt.Fprintln(...).
Signed-off-by: Tom Wieczorek <twieczorek@mirantis.com>
1 week ago
28e64bd2dd
chore: fix gofumpt extra-rules ( #32486 )
...
* chore: fix gofumpt extra-rules
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
* Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
---------
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 week ago
4dfbaa40c6
Remove deprecated `internal/chart/v3/` code ( #32365 )
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
1 week ago
9a3c040369
fix(template): regression - route registry messages to stderr in template and show ( #32217 )
...
* fix: route registry messages to stderr in template and show
When pulling an OCI chart, the registry client prints "Pulled: ..." and
"Digest: ..." status lines (and deprecation/underscore warnings) to its
configured output writer. Since v4.2.1 (introduced by #32056 ), these
messages leaked into the stdout output of helm template and helm show,
breaking downstream consumers such as cdk8s and other YAML parsers.
Fix by passing the command's stderr to the registry client in the
template and show commands instead of stdout. This keeps stdout clean
for machine-readable YAML while still surfacing registry warnings and
status messages on stderr for troubleshooting, rather than discarding
them. The pull/push commands continue to print these messages on their
normal output writer.
The show command's addRegistryClient writer parameter is renamed to
registryOut and wired through to the registry client, so it is no longer
a no-op.
Fixes #32215
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
* test(cmd): cover registry client stderr routing via OCI pull
Exercise helm template and helm show against an in-process OCI registry
(repotest.NewOCIServer) and assert Pulled:/Digest: status lines appear
on stderr only, keeping stdout free of registry noise.
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
* test(cmd): drop weak addRegistryClient unit test
OCI pull coverage already asserts Pulled/Digest land on stderr, not stdout.
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
---------
Signed-off-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
Co-authored-by: amarkdotdev <amarkdotdev@users.noreply.github.com>
1 week ago
11e2010aeb
refactor: remove per-file decompression size limit ( #31748 )
...
* refactor: remove per-file decompression size limit
Remove MaxDecompressedFileSize as it's no longer necessary after
migrating to a maintained JSON schema library (santhosh-tekuri/jsonschema/v6).
The original limit was added to protect against vulnerabilities in an
unmaintained library.
The total decompressed chart size limit (MaxDecompressedChartSize) remains
to protect against other attack vectors.
Partially resolves #30738
Related:
- https://github.com/helm/helm/pull/30743
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: deprecate MaxDecompressedFileSize instead of removing
As Matt suggested we should keep the variable until v5 as it can be used
because it is public.
Related:
- https://github.com/helm/helm/pull/31748#discussion_r2738518696
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: enforce aggregate size budget on directory loading
Directory-based chart loading (`LoadDir`) used unbounded `os.ReadFile`
calls with no total size check. Archive loading already enforces
`MaxDecompressedChartSize` via a remaining-byte budget but directory
loading did not, leaving local charts and `file://` dependencies as
an unbounded memory path.
Add `ReadFileWithBudget` in the archive package and use it in both
v2 and v3 directory loaders so they track the same aggregate budget.
Ref: https://github.com/helm/helm/pull/31748#issuecomment-4138927643
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix: cap directory budget reads with LimitReader
Use `os.Open` + `io.LimitReader` instead of `os.ReadFile` in
`ReadFileWithBudget` so a file that grows between stat and read
cannot allocate unbounded memory.
Also fix `MaxDecompressedFileSize` doc comment to reflect it is
unused/deprecated, add nil guard on remaining, and check
`os.Stat` errors in tests.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* test: add v3 directory loader budget test
Mirror the v2 `TestLoadDirExceedsBudget` test for the v3 loader
to prevent budget enforcement regressions in either path.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* refactor(loader): make read budget configurable
Follow recommendations from https://github.com/helm/helm/pull/31748#discussion_r3058581419
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix(loader): export BudgetedReader for cross-package use
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* fix(loader): rename max param to avoid shadowing built-in
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
---------
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
1 week ago
d2de64e64b
Merge pull request #32577 from mattfarina/bump-go-1.27
...
Updating the Go version
2 weeks ago
57a67b30d2
fix(downloader): pass getter options when fetching cached provenance
...
Signed-off-by: cuishuang <imcusg@gmail.com>
2 weeks ago
b5b498b774
Updating the Go version
...
This is needed for goreleaser to create updates. Its latest release
needs it.
Updates needed for linting and to fix failed tests resulting from
Go std library changes.
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 weeks ago
d62bee21c2
Merge pull request #32570 from MsfPablo/fix-readiness-log-typo
...
fix: correct 'doest not match' in readiness debug logs
2 weeks ago
1af7ea274a
Merge branch 'main' into fix-readiness-log-typo
2 weeks ago
6d1f67cf6a
Updating the Go version
...
This is needed for goreleaser to create updates. Its latest release
needs it.
Signed-off-by: Matt Farina <matt.farina@suse.com>
2 weeks ago
0f4decb96b
chore(deps): bump the github-actions group across 1 directory with 4 updates ( #32574 )
...
Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.7 to 4.37.8
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](ff2f1c621b...db488ddef3
2 weeks ago
fb1930096e
chore(deps): bump the k8s-io group with 7 updates ( #32572 )
...
Bumps the k8s-io group with 7 updates:
| Package | From | To |
| --- | --- | --- |
| [k8s.io/api](https://github.com/kubernetes/api ) | `0.36.3` | `0.36.4` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver ) | `0.36.3` | `0.36.4` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery ) | `0.36.3` | `0.36.4` |
| [k8s.io/apiserver](https://github.com/kubernetes/apiserver ) | `0.36.3` | `0.36.4` |
| [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime ) | `0.36.3` | `0.36.4` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go ) | `0.36.3` | `0.36.4` |
| [k8s.io/kubectl](https://github.com/kubernetes/kubectl ) | `0.36.3` | `0.36.4` |
Updates `k8s.io/api` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/api/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/apiextensions-apiserver` from 0.36.3 to 0.36.4
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases )
- [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/apimachinery` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/apiserver` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/apiserver/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/cli-runtime` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/client-go` from 0.36.3 to 0.36.4
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/kubernetes/client-go/compare/v0.36.3...v0.36.4 )
Updates `k8s.io/kubectl` from 0.36.3 to 0.36.4
- [Commits](https://github.com/kubernetes/kubectl/compare/v0.36.3...v0.36.4 )
---
updated-dependencies:
- dependency-name: k8s.io/api
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apiextensions-apiserver
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apimachinery
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/apiserver
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/cli-runtime
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/client-go
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
- dependency-name: k8s.io/kubectl
dependency-version: 0.36.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: k8s-io
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 weeks ago
6888b0a280
fix: correct 'doest not match' in readiness debug logs
...
Signed-off-by: MsfPablo <pablogarciacaceres5@gmail.com>
2 weeks ago
67d54fd880
fix(provenance): support GnuPG keybox (pubring.kbx) keyrings ( #32281 )
...
* fix(provenance): support GnuPG keybox (pubring.kbx) keyrings
Starting with GnuPG 2.1, file-backed public keyrings can use
~/.gnupg/pubring.kbx instead of the legacy pubring.gpg. Helm only read
the legacy format, so chart and plugin verification failed on
installations using the file-backed keybox.
Make the keyring loader format-aware:
- GnuPG keybox (pubring.kbx): extract OpenPGP keyblocks from the
keybox container without adding a dependency. Skip ephemeral blobs,
matching GnuPG's own read behavior.
- ASCII-armored keyrings: load single or concatenated exports.
- Legacy binary packet streams (pubring.gpg): retain the existing path.
defaultKeyring() falls back to pubring.kbx when pubring.gpg is absent.
pubring.gpg keeps precedence when both files exist.
This change covers file-backed public keyrings. It does not read the
SQLite database used by keyboxd, which needs a separate design.
Related to #31836
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
* fix(provenance): treat only not-exist as keyring absence in defaultKeyring
A stat error other than 'not exist' (e.g. a permission problem) meant
the file may well be present, but defaultKeyring() skipped past it: an
unreadable pubring.gpg silently lost precedence to pubring.kbx, and the
surfaced error could point at the wrong file. Treat only fs.ErrNotExist
as absence. For any other stat error, return that path unchanged so the
real error surfaces when the keyring is opened.
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
---------
Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>
Co-authored-by: George Jenkins <gvjenkins@gmail.com>
3 weeks ago
e9b85e4de1
chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 ( #32562 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-version: 1.12.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
9b447b4048
Merge pull request #32485 from Mentigen/fix/stamp-mod-times-normalize
...
fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test
3 weeks ago
fa9e77c0c3
Merge pull request #32525 from locker95/fix/values-eof-multiple-of-buffer
...
fix(loader): do not drop values files ending at a 4096-byte boundary
3 weeks ago
c000a408b8
chore(deps): bump the github-actions group across 1 directory with 4 updates ( #32556 )
...
Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621bhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621bhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621bhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5595ccaf91...ff2f1c621b
3 weeks ago
bafdcde8ec
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 ( #32555 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.11.1 to 1.12.0.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-version: 1.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
2a29f1770b
chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 ( #32545 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.54.0 to 0.55.0.
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.55.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
4 weeks ago
edb94f897d
chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 ( #32543 )
...
Bumps [golang.org/x/text](https://github.com/golang/text ) from 0.40.0 to 0.41.0.
- [Release notes](https://github.com/golang/text/releases )
- [Commits](https://github.com/golang/text/compare/v0.40.0...v0.41.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/text
dependency-version: 0.41.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
4 weeks ago
fd4ed4952b
test(loader): cover 8192-byte EOF boundary for LoadValues
...
Also drop the extra blank line before the test. Addresses review on
#32525 .
Signed-off-by: Dean Chen <862469039@qq.com>
1 month ago
601445e88c
fix(loader): do not drop values files ending at a 4096-byte boundary
...
YAMLReader can return EOF without yielding the last line when that line
has no trailing newline and its length is a multiple of bufio's default
buffer. Read the file fully and ensure a trailing newline before parsing
so compact JSON values files are not silently ignored.
Fixes #32506
Signed-off-by: Dean Chen <862469039@qq.com>
1 month ago
f3d68cdbea
chore(deps): bump the github-actions group with 4 updates ( #32523 )
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](d1ba80a13d...5595ccaf91
1 month ago
a0c2f6dade
fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 ( #32521 )
...
* fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158
govulncheck on main flags GO-2026-5158 in go.opentelemetry.io/otel@v1.43.0
(fixed in v1.44.0). Bump the transitive otel dependency to clear the
vulnerability.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
* fix: bump otel/sdk and otel/sdk/metric to v1.44.0 for version parity
Keep the lockstep-versioned OpenTelemetry core and SDK modules aligned at
v1.44.0 to avoid version skew.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
---------
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 month ago
f8a308cd47
chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 ( #32514 )
...
Bumps [github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema ) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/santhosh-tekuri/jsonschema/releases )
- [Commits](https://github.com/santhosh-tekuri/jsonschema/compare/v6.0.2...v6.0.3 )
---
updated-dependencies:
- dependency-name: github.com/santhosh-tekuri/jsonschema/v6
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 month ago
e8a24895d1
Merge pull request #31580 from biagiopietro/feature/rollback-description-flag
...
feat(rollback): add --description flag to provide rollback reason
1 month ago
819e069eb9
Merge pull request #32516 from helm/dependabot/github_actions/main/github-actions-abda45ccb9
...
chore(deps): bump the github-actions group with 4 updates
1 month ago
47eb219a71
chore(deps): bump the github-actions group with 4 updates
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.4 to 4.37.5
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](f205ea1c33...d1ba80a13d
1 month ago
b44d98328b
Merge branch 'helm:main' into feature/rollback-description-flag
1 month ago
ae877c8bfb
chore(deps): bump the github-actions group with 4 updates ( #32508 )
...
Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action ), [github/codeql-action/autobuild](https://github.com/github/codeql-action ), [github/codeql-action/analyze](https://github.com/github/codeql-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/init` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](e4fba868fa...f205ea1c33
1 month ago
dependabot[bot]
Robert Sirchia
George Jenkins
Scott Rigby
Tom Wieczorek
Matthieu MOREL
Aaron Mark
Benoit Tigeot
Matt Farina
cuishuang
MsfPablo
Ruslan Shaydullin
Dean Chen
Terry Howe
MrJack