Replace gr.Header.ModTime with gr.ModTime in test to satisfy
staticcheck QF1008: embedded field "Header" can be elided from selector.
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Tar headers have second-level granularity and store timezone-independent
Unix timestamps. Normalize SourceDateEpoch with .UTC().Truncate(time.Second)
so callers passing sub-second or non-UTC values still get deterministic output.
Also verify in the test that gzip header ModTime is zero (helm design) and
compare tar entry ModTimes with time.Equal() since tar.Reader returns local time.
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Read SOURCE_DATE_EPOCH in the CLI layer (pkg/cmd/package.go) and pass it
to the action layer as Package.SourceDateEpoch *time.Time. Before calling
Save(), stampModTimes() overwrites every tar-entry ModTime in the chart
(including templates, files, raw values, schema and sub-charts) with the
requested epoch.
writeToTar and Save are not modified: the caller now supplies the epoch as
the modTime argument, which is how mattfarina's review (#32060) asked for
this to be structured.
Closes#31439
Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>
Adds the bidichk linter to .golangci.yml to detect dangerous invisible
Unicode characters (ZWSP, bidi controls) in source files during CI.
Fixes#32137
Signed-off-by: Arnav Nagzirkar <arnav.nagzirkar@mail.utoronto.ca>
Upgrades golang.org/x/net from v0.53.0 to v0.55.0 to fix CVE-2026-39821
(GO-2026-5026), where idna.ToASCII/ToUnicode incorrectly accept Punycode-
encoded labels that decode to ASCII-only labels, enabling privilege escalation
via hostname check bypass.
Coordinated x/ upgrade pulled in by the module graph:
- golang.org/x/sys v0.44.0 => v0.45.0
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Helm v4 shipped on 2025-11-17. Mark it as the current stable release
and v3 as support-mode with its end-of-support dates.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
The comment describing allowed plugin name characters contained three
U+200B (zero-width space) characters around the '_' and '-' literals.
The rendered comment is identical without them; the ZWSP were likely
copy-pasted from a rich-text source.
Downstream impact: every project that vendors helm.sh/helm/v4 and runs
Renovate gets a repo-wide warning on its Dependency Dashboard about
hidden Unicode characters. Renovate scans the whole tree (including
vendor/) for ZWSP/bidi-override codepoints and cannot be told to skip
a path for this specific check. Removing the characters here clears
the warning everywhere downstream.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
slog.Error on line 157 passes printf-style positional args (%q, %s)
instead of key-value pairs. The slog API treats these as unkeyed
attributes, producing garbled log output.
Two nearby slog.Warn calls wrap fmt.Sprintf unnecessarily. Convert
all three calls to use proper structured key-value arguments.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Assisted-by: Grok/grok-4
- Close log stream after reading (prevents connection/fd leak)
- Strengthen tests to assert on output headers rather than error paths
- Remove unused import
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
When a test pod contains multiple containers (e.g. Istio/Consul/Vault
sidecars), 'helm test --logs' failed with 'a container name must be
specified'. This happened because GetPodLogs called the Kubernetes log
API without specifying a container name.
The fix fetches the pod spec first, then iterates over all containers
(init containers + regular containers) and requests logs for each one
explicitly. Errors from individual containers are collected and returned
together via errors.Join rather than aborting on the first failure.
Also fixes a typo: hooksByWight -> hooksByWeight.
Closes#6902
Signed-off-by: Sebastien Tardif <SebTardif@ncf.ca>
Ilya Kiselev
Evans Mungai
Terry Howe
Austin Abro
George Jenkins
dependabot[bot]
Arnav Nagzirkar
Benoit Tigeot
Aleksei Sviridkin
Robert Sirchia
Matheus Pimenta
Sebastien Tardif
Kai Tanaka
box4wangjing
Sumit Solanki
Scott Rigby