msb-public/helm - helm - 马士兵教育代码仓库

Commit Graph

Author	SHA1	Message	Date
Karan V	bd392c6a60	fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 Backport of the openpgp migration already merged to main (`7c9176ae3`) to dev-v3. golang.org/x/crypto/openpgp is frozen and flagged by govulncheck as GO-2026-5932 with no fixed release, leaving the govulncheck check red on every Go PR targeting dev-v3. Replace it with the maintained drop-in fork github.com/ProtonMail/go-crypto in pkg/provenance, the only consumer on this branch. The only API difference is openpgp.CheckDetachedSignature, which now takes an io.Reader and a *packet.Config. Pin the indirect github.com/cloudflare/circl at v1.6.3, as v1.6.2 pulled in by default is itself flagged (GO-2026-4550, fixed in v1.6.3). Also backport the mixed RSA/ed25519 keyring sign/verify regression test from main, adapted to the v3 Signatory API, since keyrings with modern key algorithms are the main behavioral surface of this swap. govulncheck ./... now reports 0 vulnerabilities. Fixes #32361 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Karan V <karanvknarayanan@gmail.com>	2 weeks ago
Robert Sirchia	f174561a97	Merge pull request #32452 from helm/dependabot/github_actions/dev-v3/github-actions-85dd5d8b53 chore(deps): bump the github-actions group with 4 updates	3 weeks ago
dependabot[bot]	7cd01254d3	chore(deps): bump the github-actions group with 4 updates Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`e0647621c2...e4fba868fa`) Updates `github/codeql-action/autobuild` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`e0647621c2...e4fba868fa`) Updates `github/codeql-action/analyze` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`e0647621c2...e4fba868fa`) Updates `github/codeql-action/upload-sarif` from 4.37.2 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`e0647621c2...e4fba868fa`) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>	3 weeks ago
Terry Howe	2ada254ad1	Merge pull request #32445 from helm/dependabot/github_actions/dev-v3/github/codeql-action/init-4.37.2 chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2	3 weeks ago
Terry Howe	4836fbc1e9	Merge pull request #32447 from helm/dependabot/github_actions/dev-v3/github/codeql-action/autobuild-4.37.2 chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2	3 weeks ago
Terry Howe	44a4202f38	Merge pull request #32448 from helm/dependabot/github_actions/dev-v3/github/codeql-action/analyze-4.37.2 chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2	3 weeks ago
dependabot[bot]	79330fceb9	chore(deps): bump github/codeql-action/upload-sarif (#32449 ) Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.1 to 4.37.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`7188fc3636...e0647621c2`) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 weeks ago
dependabot[bot]	b29c7309f1	chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 (#32446 ) Bumps [actions/labeler](https://github.com/actions/labeler) from 6.2.0 to 7.0.0. - [Release notes](https://github.com/actions/labeler/releases) - [Commits](`b8dd2d9be0...bf12e9b00b`) --- updated-dependencies: - dependency-name: actions/labeler dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 weeks ago
dependabot[bot]	973bb346b8	chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.1 to 4.37.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`7188fc3636...e0647621c2`) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	3 weeks ago
dependabot[bot]	e25efcf283	chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.37.1 to 4.37.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`7188fc3636...e0647621c2`) --- updated-dependencies: - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	3 weeks ago
dependabot[bot]	98e547f8ed	chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.1 to 4.37.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`7188fc3636...e0647621c2`) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	3 weeks ago
dependabot[bot]	7f4b72a711	chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#32412 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](`9c091bb21b...3d3c42e5aa`) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 weeks ago
dependabot[bot]	2cf1437c20	chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 (#32381 ) * chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`99df26d4f1...7188fc3636`) --- updated-dependencies: - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): bump github/codeql-action init and analyze to 4.37.1 Signed-off-by: Terry Howe <terrylhowe@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Terry Howe <terrylhowe@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Terry Howe <terrylhowe@gmail.com>	3 weeks ago
dependabot[bot]	270f73b2df	chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#32383 ) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](`924ae3a1cd...b7ad1dad31`) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 weeks ago
dependabot[bot]	9e3a0100a9	chore(deps): bump github/codeql-action/upload-sarif (#32382 ) Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.37.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`99df26d4f1...7188fc3636`) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 weeks ago
Benoit Tigeot	c9ed0caeba	ci: auto-label PRs targeting dev-v3 (#32340 ) * ci: auto-label PRs targeting dev-v3 Use actions/labeler to apply a "dev-v3" label on PRs opened against the `dev-v3` branch. Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr> * ci: bump actions/labeler to v6.2.0 https://github.com/actions/labeler/releases/tag/v6.2.0 Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Benoit Tigeot <benoittgt@users.noreply.github.com> Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr> * ci: reuse existing v3.x label for dev-v3 PRs Avoid creating a new label since v3.x already exists in the repo Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr> --------- Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr> Signed-off-by: Benoit Tigeot <benoittgt@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	4 weeks ago
dependabot[bot]	b842ddfccb	chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#32331 ) Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.6.1 to 2.6.2. - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](https://github.com/oras-project/oras-go/compare/v2.6.1...v2.6.2) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	f6047c96c7	chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#32332 ) Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords) from 1.0.13 to 1.0.14. - [Commits](https://github.com/mattn/go-shellwords/compare/v1.0.13...v1.0.14) --- updated-dependencies: - dependency-name: github.com/mattn/go-shellwords dependency-version: 1.0.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	f2f6bf6e99	chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0 (#32357 ) * chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 3.26.6 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`4dd16135b6...99df26d4f1`) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * ci: align codeql-action init and autobuild to v4.37.0 Dependabot bumped only codeql-action/analyze to v4.37.0, leaving init and autobuild on v3.26.6. Mixing v3 init/autobuild with v4 analyze causes the SARIF upload to fail with a configuration error. Align all three steps. Signed-off-by: Terry Howe <terrylhowe@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Terry Howe <terrylhowe@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Terry Howe <terrylhowe@gmail.com>	4 weeks ago
dependabot[bot]	69f70a8674	chore(deps): bump actions/checkout from 4.2.2 to 7.0.0 (#32368 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](`11bd71901b...9c091bb21b`) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	c95222ab5a	chore(deps): bump actions/stale from 9.0.0 to 10.4.0 (#32369 ) Bumps [actions/stale](https://github.com/actions/stale) from 9.0.0 to 10.4.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](`28ca103628...1e223db275`) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	fc71f51069	chore(deps): bump actions/setup-go from 5.1.0 to 6.5.0 (#32358 ) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.1.0 to 6.5.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](`41dfa10bad...924ae3a1cd`) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	6596318b34	chore(deps): bump github/codeql-action/upload-sarif (#32360 ) Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 3.35.1 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`5c8a8a642e...99df26d4f1`) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	5d9943ca09	chore(deps): bump github/codeql-action/init from 3.26.6 to 4.37.0 (#32359 ) Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 3.26.6 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`4dd16135b6...99df26d4f1`) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	a3d7a6c50a	chore(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#32356 ) Bumps [golang/govulncheck-action](https://github.com/golang/govulncheck-action) from 1.0.4 to 1.1.0. - [Release notes](https://github.com/golang/govulncheck-action/releases) - [Commits](`b625fbe08f...032d45514a`) --- updated-dependencies: - dependency-name: golang/govulncheck-action dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	8e199708cc	chore(deps): bump golangci/golangci-lint-action from 6.1.1 to 9.3.0 (#32354 ) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 6.1.1 to 9.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](`971e284b60...ba0d7d2ec0`) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
dependabot[bot]	24ef09ac19	chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#32353 ) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](`62b2cac7ed...4eaacf0543`) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
Matt Farina	5194383553	Merge pull request #32300 from benoittgt/fix/govulncheck-containerd [dev-v3] fix: drop containerd v1 dep to resolve govulncheck CVEs	1 month ago
dependabot[bot]	8082dd4a0d	chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 (#32310 ) Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.40.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1 month ago
dependabot[bot]	2c24490679	chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. - [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1 month ago
dependabot[bot]	953d280f92	chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 (#32306 ) Bumps [golang.org/x/term](https://github.com/golang/term) from 0.44.0 to 0.45.0. - [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1 month ago
Benoit Tigeot	093015b3b7	Apply suggestions from code review Co-authored-by: Terry Howe <terrylhowe@gmail.com> Signed-off-by: Benoit Tigeot <benoittgt@users.noreply.github.com>	1 month ago
Benoit Tigeot	a061886b72	fix: drop containerd v1 dep to resolve govulncheck CVEs containerd v1 is EOL and will never receive fixes for GO-2026-5622, GO-2026-5338, GO-2026-5064. The only import was for `remotes.Resolver` in the deprecated `ClientOptResolver` stub. Changing its parameter type to `any` preserves the public API while removing the vulnerable dependency entirely. It should help for PR like https://github.com/helm/helm/pull/32297 Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>	1 month ago
Terry Howe	fd501ad7c8	Merge pull request #32248 from helm/dependabot/go_modules/dev-v3/github.com/containerd/containerd-1.7.33 chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33	2 months ago
dependabot[bot]	f979836098	chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.32 to 1.7.33. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](https://github.com/containerd/containerd/compare/v1.7.32...v1.7.33) --- updated-dependencies: - dependency-name: github.com/containerd/containerd dependency-version: 1.7.33 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
George Jenkins	a2d165db73	Merge pull request #32239 from helm/dependabot/go_modules/dev-v3/k8s-io-3e1eb108b8 chore(deps): bump the k8s-io group with 2 updates	2 months ago
Terry Howe	081909f300	Merge pull request #32240 from helm/dependabot/go_modules/dev-v3/github.com/cyphar/filepath-securejoin-0.7.0 chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0	2 months ago
dependabot[bot]	c4446659f6	chore(deps): bump github.com/cyphar/filepath-securejoin Bumps [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) from 0.6.1 to 0.7.0. - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md) - [Commits](https://github.com/cyphar/filepath-securejoin/compare/v0.6.1...v0.7.0) --- updated-dependencies: - dependency-name: github.com/cyphar/filepath-securejoin dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
dependabot[bot]	1bf9b5fbba	chore(deps): bump the k8s-io group with 2 updates Bumps the k8s-io group with 2 updates: [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) and [k8s.io/apiserver](https://github.com/kubernetes/apiserver). Updates `k8s.io/apiextensions-apiserver` from 0.35.1 to 0.36.2 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.35.1...v0.36.2) Updates `k8s.io/apiserver` from 0.35.1 to 0.36.2 - [Commits](https://github.com/kubernetes/apiserver/compare/v0.35.1...v0.36.2) --- updated-dependencies: - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
Terry Howe	67995c1632	Merge pull request #32182 from helm/dependabot/go_modules/dev-v3/k8s-io-8dededac42 [dev-v3] chore(deps): bump the k8s-io group across 1 directory with 2 updates	2 months ago
Matheus Pimenta	b7a0fd0ddc	fixes Signed-off-by: George Jenkins <gvjenkins@gmail.com>	2 months ago
dependabot[bot]	119a7d9bab	chore(deps): bump the k8s-io group across 1 directory with 2 updates Bumps the k8s-io group with 2 updates in the / directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl). Updates `k8s.io/apimachinery` from 0.35.1 to 0.36.2 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.35.1...v0.36.2) Updates `k8s.io/kubectl` from 0.35.1 to 0.36.2 - [Commits](https://github.com/kubernetes/kubectl/compare/v0.35.1...v0.36.2) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
George Jenkins	5423b3d5f5	Merge pull request #32202 from helm/dependabot/go_modules/dev-v3/oras.land/oras-go/v2-2.6.1 chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1	2 months ago
Terry Howe	2fb05f8a35	fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1 oras-go v2.6.1 hardens the auth client to drop the Authorization header when a request's origin changes mid-flight (GHSA-vh4v-2xq2-g5cg). Helm's fallbackTransport reaches plain-HTTP registries by downgrading the connection from https to http inside a single round trip, which oras now treats as a credential-leaking origin change and refuses to authenticate. On login, detect when the transport has fallen back to plain HTTP and, in that case, set PlainHTTP explicitly and re-ping so requests are built as http from the start. The scheme no longer changes mid-request, credentials flow as before, and the new cross-origin protection is preserved for real https registries (forcedHTTP stays false, so the retry never triggers). Signed-off-by: Terry Howe <terrylhowe@gmail.com>	2 months ago
dependabot[bot]	acc867b88e	chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.6.0 to 2.6.1. - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](https://github.com/oras-project/oras-go/compare/v2.6.0...v2.6.1) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
Terry Howe	85105c8fa1	Merge pull request #32189 from helm/dependabot/go_modules/dev-v3/golang.org/x/crypto-0.53.0 chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0	2 months ago
dependabot[bot]	b920935feb	chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.52.0 to 0.53.0. - [Commits](https://github.com/golang/crypto/compare/v0.52.0...v0.53.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
Terry Howe	6f6477e631	Merge pull request #32191 from helm/dependabot/go_modules/dev-v3/golang.org/x/term-0.44.0 chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0	2 months ago
dependabot[bot]	5b5ef192c7	chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 Bumps [golang.org/x/term](https://github.com/golang/term) from 0.43.0 to 0.44.0. - [Commits](https://github.com/golang/term/compare/v0.43.0...v0.44.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
Terry Howe	f13d446096	Merge pull request #32193 from helm/dependabot/go_modules/dev-v3/golang.org/x/text-0.38.0 chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0	2 months ago

1 2 3 4 5 ...

8179 Commits (bd392c6a60d09a6c9f467dc52dbfd249a641f80d) All Branches Search

8179 Commits (bd392c6a60d09a6c9f467dc52dbfd249a641f80d)

All Branches