Pre-Go-modules import path comments (e.g. `// import "helm.sh/helm/v4/..."`)
are obsolete since Go 1.11 where go.mod is the authoritative module path.
These stale comments cause issues with downstream tooling such as Kythe.
Removes the legacy import comments from 64 files across 20 packages:
- cmd/helm
- internal/chart/v3/lint and sub-packages
- internal/plugin and sub-packages
- internal/release/v2/util
- pkg/chart/v2/lint and sub-packages
- pkg/cmd, pkg/engine, pkg/ignore, pkg/provenance
- pkg/registry
- pkg/release/v1/util
- pkg/repo/v1
- pkg/storage and pkg/storage/driver
Follows up on #31931 and #31932 which addressed pkg/kube.
Fixes#31846
Signed-off-by: abhay1999 <abhay.chaurasiya@example.com>
Signed-off-by: abhay1999 <abhaychaurasiya19@gmail.com>
The get-helm-3 script queries get.helm.sh/helm3-latest-version to
determine the latest release. The CDN serving this file has no
Cache-Control header, so edge servers can serve stale cached
responses for hours after a new release.
This causes non-deterministic behavior: machines running get-helm-3
at the same time can install different versions depending on which
CDN edge node they hit.
Fix: Append a timestamp query string (?ts=1783837438) to bust CDN
caches, and add Cache-Control: no-cache header to both curl and wget
requests.
Fixes#32329
Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
Mirrors the dev-v3 labeling workflow from #32340, reusing the
existing v4.x label since main tracks the upcoming v4 release.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
* feat: honor SOURCE_DATE_EPOCH for chart archives
Add StampModTimes() on Chart struct to recursively set ModTime on
all chart file entries. CLI reads SOURCE_DATE_EPOCH env var and wires
through all 5 commands: package, install, upgrade, dep build, dep update.
Removes unused v3 duplicate source_date_epoch.go (YAGNI).
Inlines env var parsing to CLI layer from chart util.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* docs: document SOURCE_DATE_EPOCH in environment variables help
Add a short entry for $SOURCE_DATE_EPOCH to the env var table shown
in 'helm help'. The variable is honored by 'helm package', 'install',
'upgrade', 'dep build', and 'dep update' to produce reproducible chart
archives. Full documentation belongs in helm-www.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* fix: adapt SourceDateEpoch to upstream refactored dep check
Upstream/main restructured the dependency error handling in install.go
and upgrade.go from a nested-if block (if DependencyUpdate) to an
early-return pattern (if !DependencyUpdate). Adapt the feature's
Manager construction to match the new code structure.
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
---------
Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>
* Fix missing conflict retry with server-side apply
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Only retry on resourcequota transient conflict
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
* Use isServerSideRetryable + naming nitpick
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
---------
Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>
golang/govulncheck-action published v1.1.0 on 2026-07-10, tagging the
master commit (032d455) the govulncheck step was already pinned to.
Update the pin comment to # pin@v1.1.0 so it matches the repo's
pin@<tag> convention and Dependabot can track the action by semver
again.
The pinned SHA is unchanged; v1.1.0 points to that commit, so CI
behavior is identical and only the trailing comment changes.
Closes: #32301
Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
Dependabot reads its config only from the default branch, and the
github-actions ecosystem was configured for main only. As a result,
Action version bumps never flowed to dev-v3, leaving its workflows
(e.g. govulncheck-action) frozen and drifting from main.
Add a github-actions update block targeting dev-v3 so Action bumps are
opened there too, matching the existing gomod/dev-v3 arrangement.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
The init and autobuild steps were bumped to 4.37.0 (#32313, #32305) but the analyze step remained at 4.36.2, causing CodeQL to fail on main with: "Loaded a configuration file for version '4.37.0', but running version '4.36.2'". Align analyze with the other codeql-action steps.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
x/crypto v0.54.0 raises golang.org/x/term to v0.45.0 and golang.org/x/sys to v0.47.0 via minimum version selection.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
The init and autobuild steps were bumped to 4.37.0 (#32313, #32305) but the analyze step remained at 4.36.2, causing CodeQL to fail on main with: "Loaded a configuration file for version '4.37.0', but running version '4.36.2'". Align analyze with the other codeql-action steps.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
Abhay Chaurasiya
Terry Howe
Matthieu MOREL
Solomon Wakhungu
dependabot[bot]
George Jenkins
Benoit Tigeot
Lohit Kolluri
Jakub Jaruszewski
秀吉
Matheus Pimenta
Akanksha Trehun
Matt Farina