9e3a0100a9
chore(deps): bump github/codeql-action/upload-sarif ( #32382 )
...
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) from 4.37.0 to 4.37.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](99df26d4f1...7188fc3636
2 weeks ago
c9ed0caeba
ci: auto-label PRs targeting dev-v3 ( #32340 )
...
* ci: auto-label PRs targeting dev-v3
Use actions/labeler to apply a "dev-v3" label on PRs
opened against the `dev-v3` branch.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* ci: bump actions/labeler to v6.2.0
https://github.com/actions/labeler/releases/tag/v6.2.0
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Benoit Tigeot <benoittgt@users.noreply.github.com>
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* ci: reuse existing v3.x label for dev-v3 PRs
Avoid creating a new label since v3.x already exists in the repo
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
---------
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Signed-off-by: Benoit Tigeot <benoittgt@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2 weeks ago
b842ddfccb
chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 ( #32331 )
...
Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go ) from 2.6.1 to 2.6.2.
- [Release notes](https://github.com/oras-project/oras-go/releases )
- [Commits](https://github.com/oras-project/oras-go/compare/v2.6.1...v2.6.2 )
---
updated-dependencies:
- dependency-name: oras.land/oras-go/v2
dependency-version: 2.6.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 weeks ago
f6047c96c7
chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 ( #32332 )
...
Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords ) from 1.0.13 to 1.0.14.
- [Commits](https://github.com/mattn/go-shellwords/compare/v1.0.13...v1.0.14 )
---
updated-dependencies:
- dependency-name: github.com/mattn/go-shellwords
dependency-version: 1.0.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 weeks ago
f2f6bf6e99
chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0 ( #32357 )
...
* chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action ) from 3.26.6 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](4dd16135b6...99df26d4f1
2 weeks ago
69f70a8674
chore(deps): bump actions/checkout from 4.2.2 to 7.0.0 ( #32368 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.2.2 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](11bd71901b...9c091bb21b
2 weeks ago
c95222ab5a
chore(deps): bump actions/stale from 9.0.0 to 10.4.0 ( #32369 )
...
Bumps [actions/stale](https://github.com/actions/stale ) from 9.0.0 to 10.4.0.
- [Release notes](https://github.com/actions/stale/releases )
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md )
- [Commits](28ca103628...1e223db275
2 weeks ago
fc71f51069
chore(deps): bump actions/setup-go from 5.1.0 to 6.5.0 ( #32358 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.1.0 to 6.5.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](41dfa10bad...924ae3a1cd
2 weeks ago
6596318b34
chore(deps): bump github/codeql-action/upload-sarif ( #32360 )
...
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) from 3.35.1 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](5c8a8a642e...99df26d4f1
2 weeks ago
5d9943ca09
chore(deps): bump github/codeql-action/init from 3.26.6 to 4.37.0 ( #32359 )
...
Bumps [github/codeql-action/init](https://github.com/github/codeql-action ) from 3.26.6 to 4.37.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](4dd16135b6...99df26d4f1
2 weeks ago
a3d7a6c50a
chore(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 ( #32356 )
...
Bumps [golang/govulncheck-action](https://github.com/golang/govulncheck-action ) from 1.0.4 to 1.1.0.
- [Release notes](https://github.com/golang/govulncheck-action/releases )
- [Commits](b625fbe08f...032d45514a
2 weeks ago
8e199708cc
chore(deps): bump golangci/golangci-lint-action from 6.1.1 to 9.3.0 ( #32354 )
...
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action ) from 6.1.1 to 9.3.0.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases )
- [Commits](971e284b60...ba0d7d2ec0
2 weeks ago
24ef09ac19
chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 ( #32353 )
...
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action ) from 2.4.0 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases )
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md )
- [Commits](62b2cac7ed...4eaacf0543
2 weeks ago
5194383553
Merge pull request #32300 from benoittgt/fix/govulncheck-containerd
...
[dev-v3] fix: drop containerd v1 dep to resolve govulncheck CVEs
3 weeks ago
8082dd4a0d
chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 ( #32310 )
...
Bumps [golang.org/x/text](https://github.com/golang/text ) from 0.38.0 to 0.40.0.
- [Release notes](https://github.com/golang/text/releases )
- [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/text
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
2c24490679
chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 ( #32308 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.53.0 to 0.54.0.
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
953d280f92
chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 ( #32306 )
...
Bumps [golang.org/x/term](https://github.com/golang/term ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/term
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
093015b3b7
Apply suggestions from code review
...
Co-authored-by: Terry Howe <terrylhowe@gmail.com>
Signed-off-by: Benoit Tigeot <benoittgt@users.noreply.github.com>
3 weeks ago
a061886b72
fix: drop containerd v1 dep to resolve govulncheck CVEs
...
containerd v1 is EOL and will never receive fixes for
GO-2026-5622, GO-2026-5338, GO-2026-5064. The only import
was for `remotes.Resolver` in the deprecated `ClientOptResolver`
stub. Changing its parameter type to `any` preserves the public
API while removing the vulnerable dependency entirely.
It should help for PR like https://github.com/helm/helm/pull/32297
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
3 weeks ago
fd501ad7c8
Merge pull request #32248 from helm/dependabot/go_modules/dev-v3/github.com/containerd/containerd-1.7.33
...
chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33
1 month ago
f979836098
chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33
...
Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd ) from 1.7.32 to 1.7.33.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v1.7.32...v1.7.33 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
dependency-version: 1.7.33
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
1 month ago
a2d165db73
Merge pull request #32239 from helm/dependabot/go_modules/dev-v3/k8s-io-3e1eb108b8
...
chore(deps): bump the k8s-io group with 2 updates
1 month ago
081909f300
Merge pull request #32240 from helm/dependabot/go_modules/dev-v3/github.com/cyphar/filepath-securejoin-0.7.0
...
chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0
1 month ago
c4446659f6
chore(deps): bump github.com/cyphar/filepath-securejoin
...
Bumps [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin ) from 0.6.1 to 0.7.0.
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases )
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md )
- [Commits](https://github.com/cyphar/filepath-securejoin/compare/v0.6.1...v0.7.0 )
---
updated-dependencies:
- dependency-name: github.com/cyphar/filepath-securejoin
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
1 month ago
1bf9b5fbba
chore(deps): bump the k8s-io group with 2 updates
...
Bumps the k8s-io group with 2 updates: [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver ) and [k8s.io/apiserver](https://github.com/kubernetes/apiserver ).
Updates `k8s.io/apiextensions-apiserver` from 0.35.1 to 0.36.2
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases )
- [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.35.1...v0.36.2 )
Updates `k8s.io/apiserver` from 0.35.1 to 0.36.2
- [Commits](https://github.com/kubernetes/apiserver/compare/v0.35.1...v0.36.2 )
---
updated-dependencies:
- dependency-name: k8s.io/apiextensions-apiserver
dependency-version: 0.36.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/apiserver
dependency-version: 0.36.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
...
Signed-off-by: dependabot[bot] <support@github.com>
1 month ago
67995c1632
Merge pull request #32182 from helm/dependabot/go_modules/dev-v3/k8s-io-8dededac42
...
[dev-v3] chore(deps): bump the k8s-io group across 1 directory with 2 updates
1 month ago
b7a0fd0ddc
fixes
...
Signed-off-by: George Jenkins <gvjenkins@gmail.com>
1 month ago
119a7d9bab
chore(deps): bump the k8s-io group across 1 directory with 2 updates
...
Bumps the k8s-io group with 2 updates in the / directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery ) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl ).
Updates `k8s.io/apimachinery` from 0.35.1 to 0.36.2
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.35.1...v0.36.2 )
Updates `k8s.io/kubectl` from 0.35.1 to 0.36.2
- [Commits](https://github.com/kubernetes/kubectl/compare/v0.35.1...v0.36.2 )
---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
dependency-version: 0.36.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
- dependency-name: k8s.io/kubectl
dependency-version: 0.36.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: k8s-io
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
5423b3d5f5
Merge pull request #32202 from helm/dependabot/go_modules/dev-v3/oras.land/oras-go/v2-2.6.1
...
chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
2 months ago
2fb05f8a35
fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1
...
oras-go v2.6.1 hardens the auth client to drop the Authorization header
when a request's origin changes mid-flight (GHSA-vh4v-2xq2-g5cg). Helm's
fallbackTransport reaches plain-HTTP registries by downgrading the
connection from https to http inside a single round trip, which oras now
treats as a credential-leaking origin change and refuses to authenticate.
On login, detect when the transport has fallen back to plain HTTP and, in
that case, set PlainHTTP explicitly and re-ping so requests are built as
http from the start. The scheme no longer changes mid-request, credentials
flow as before, and the new cross-origin protection is preserved for real
https registries (forcedHTTP stays false, so the retry never triggers).
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
2 months ago
acc867b88e
chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
...
Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go ) from 2.6.0 to 2.6.1.
- [Release notes](https://github.com/oras-project/oras-go/releases )
- [Commits](https://github.com/oras-project/oras-go/compare/v2.6.0...v2.6.1 )
---
updated-dependencies:
- dependency-name: oras.land/oras-go/v2
dependency-version: 2.6.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
85105c8fa1
Merge pull request #32189 from helm/dependabot/go_modules/dev-v3/golang.org/x/crypto-0.53.0
...
chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
2 months ago
b920935feb
chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.52.0 to 0.53.0.
- [Commits](https://github.com/golang/crypto/compare/v0.52.0...v0.53.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.53.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
6f6477e631
Merge pull request #32191 from helm/dependabot/go_modules/dev-v3/golang.org/x/term-0.44.0
...
chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
2 months ago
5b5ef192c7
chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0
...
Bumps [golang.org/x/term](https://github.com/golang/term ) from 0.43.0 to 0.44.0.
- [Commits](https://github.com/golang/term/compare/v0.43.0...v0.44.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/term
dependency-version: 0.44.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
f13d446096
Merge pull request #32193 from helm/dependabot/go_modules/dev-v3/golang.org/x/text-0.38.0
...
chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
2 months ago
af67af8951
chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0
...
Bumps [golang.org/x/text](https://github.com/golang/text ) from 0.37.0 to 0.38.0.
- [Release notes](https://github.com/golang/text/releases )
- [Commits](https://github.com/golang/text/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/text
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
699cbb1f26
Merge pull request #32168 from TerryHowe/chore/bump-go-1.26-dev-v3
...
chore: bump go to 1.26
2 months ago
ceb9a62ec0
Update .github/env
...
Co-authored-by: Matthieu MOREL <matthieu.morel35@gmail.com>
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
2 months ago
0ed92f0696
ci: bump golangci-lint to v2.11.3 for go 1.26
...
golangci-lint v2.5.0 is built with go1.25 and refuses to lint a module targeting go 1.26.0. Bump to v2.11.3 (matching main) and apply the new staticcheck QF1012 fixes it surfaces in jsonschema.go.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
2 months ago
c678c0c9c0
chore: bump go to 1.26
...
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
2 months ago
7a97623435
Merge pull request #32164 from helm/dependabot/go_modules/dev-v3/github.com/containerd/containerd-1.7.32
...
chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32
2 months ago
0ec5c8f30f
Merge pull request #32165 from helm/dependabot/go_modules/dev-v3/github.com/distribution/distribution/v3-3.1.1
...
chore(deps): bump github.com/distribution/distribution/v3 from 3.0.0 to 3.1.1
2 months ago
c90c80b0a3
Merge pull request #32166 from helm/dependabot/go_modules/dev-v3/github.com/lib/pq-1.12.3
...
chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3
2 months ago
12c4d45b14
chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3
...
Bumps [github.com/lib/pq](https://github.com/lib/pq ) from 1.11.2 to 1.12.3.
- [Release notes](https://github.com/lib/pq/releases )
- [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md )
- [Commits](https://github.com/lib/pq/compare/v1.11.2...v1.12.3 )
---
updated-dependencies:
- dependency-name: github.com/lib/pq
dependency-version: 1.12.3
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
a0f97111f5
chore(deps): bump github.com/distribution/distribution/v3
...
Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution ) from 3.0.0 to 3.1.1.
- [Release notes](https://github.com/distribution/distribution/releases )
- [Commits](https://github.com/distribution/distribution/compare/v3.0.0...v3.1.1 )
---
updated-dependencies:
- dependency-name: github.com/distribution/distribution/v3
dependency-version: 3.1.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
995c31e20b
chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32
...
Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd ) from 1.7.30 to 1.7.32.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v1.7.30...v1.7.32 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
dependency-version: 1.7.32
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
3b18fb7a3c
Merge pull request #32149 from helm/dependabot/go_modules/dev-v3/github.com/Masterminds/semver/v3-3.5.0
...
chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0
2 months ago
3226ac8942
Merge pull request #32147 from helm/dependabot/go_modules/dev-v3/github.com/mattn/go-shellwords-1.0.13
...
chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13
2 months ago
8c17168828
chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0
...
Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver ) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/Masterminds/semver/releases )
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Masterminds/semver/compare/v3.4.0...v3.5.0 )
---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
dependency-version: 3.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2 months ago
dependabot[bot]
Benoit Tigeot
Matt Farina
Benoit Tigeot
Terry Howe
George Jenkins
Matheus Pimenta