msb-public/helm - helm - 马士兵教育代码仓库

Commit Graph

Author	SHA1	Message	Date
kimsungmin1	9dbcb9f1ed	fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362 ) * set [pull,push] scope when helm push * add a validation for push scope setting, add some test code to check the scope when registry use token auth * eliminate gin-gonic dependency in client_scope_test.go test code * change the parameter order in suite.Equal in client_scope_test.go code * add license header in client_scope_test.go file * move variable location * remove freeport dependency Signed-off-by: kimsungmin1 <sm28.kim@samsung.com>	1 week ago
dependabot[bot]	0841093658	chore(deps): bump the k8s-io group with 7 updates (#32573 ) Bumps the k8s-io group with 7 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [k8s.io/api](https://github.com/kubernetes/api) \| `0.36.3` \| `0.36.4` \| \| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) \| `0.36.3` \| `0.36.4` \| \| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) \| `0.36.3` \| `0.36.4` \| \| [k8s.io/apiserver](https://github.com/kubernetes/apiserver) \| `0.36.3` \| `0.36.4` \| \| [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) \| `0.36.3` \| `0.36.4` \| \| [k8s.io/client-go](https://github.com/kubernetes/client-go) \| `0.36.3` \| `0.36.4` \| \| [k8s.io/kubectl](https://github.com/kubernetes/kubectl) \| `0.36.3` \| `0.36.4` \| Updates `k8s.io/api` from 0.36.3 to 0.36.4 - [Commits](https://github.com/kubernetes/api/compare/v0.36.3...v0.36.4) Updates `k8s.io/apiextensions-apiserver` from 0.36.3 to 0.36.4 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.36.3...v0.36.4) Updates `k8s.io/apimachinery` from 0.36.3 to 0.36.4 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.3...v0.36.4) Updates `k8s.io/apiserver` from 0.36.3 to 0.36.4 - [Commits](https://github.com/kubernetes/apiserver/compare/v0.36.3...v0.36.4) Updates `k8s.io/cli-runtime` from 0.36.3 to 0.36.4 - [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.36.3...v0.36.4) Updates `k8s.io/client-go` from 0.36.3 to 0.36.4 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.36.3...v0.36.4) Updates `k8s.io/kubectl` from 0.36.3 to 0.36.4 - [Commits](https://github.com/kubernetes/kubectl/compare/v0.36.3...v0.36.4) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apimachinery dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/cli-runtime dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/client-go dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.36.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 weeks ago
dependabot[bot]	d0569c7d62	chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563 ) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.12.0 to 1.12.1. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 weeks ago
dependabot[bot]	6cdcc8f91d	chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554 ) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 weeks ago
dependabot[bot]	158719fb43	chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.54.0 to 0.55.0. - [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.55.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4 weeks ago
Scott Rigby	a442b8cf64	[dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536 ) backport of https://github.com/helm/helm/pull/32450 updated with: ``` go get google.golang.org/grpc@v1.82.1 go mod tidy ``` example actions failure: https://github.com/helm/helm/actions/runs/31733009013/job/94557780520 ``` Vulnerability #1: GO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc More info: https://pkg.go.dev/vuln/GO-2026-6061 Module: google.golang.org/grpc Found in: google.golang.org/grpc@v1.80.0 Fixed in: google.golang.org/grpc@v1.82.1 Example traces found: Error: #1: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Close Error: #2: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Header Error: #3: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Read Error: #4: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.RecvCompress Error: #5: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.TrailersOnly Error: #6: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Write Error: #7: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.NewHTTP2Client Error: #8: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.Stream.ReadMessageHeader Error: #9: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.Close Error: #10: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.GracefulClose Error: #11: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.http2Client.NewStream ``` Signed-off-by: Scott Rigby <scott@r6by.com>	4 weeks ago
Scott Rigby	adab0ef15d	fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535 ) backport of https://github.com/helm/helm/pull/32521 see https://pkg.go.dev/vuln/GO-2026-5158 Signed-off-by: Scott Rigby <scott@r6by.com>	4 weeks ago
dependabot[bot]	1c50d2f8bd	chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 Bumps [github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/santhosh-tekuri/jsonschema/releases) - [Commits](https://github.com/santhosh-tekuri/jsonschema/compare/v6.0.2...v6.0.3) --- updated-dependencies: - dependency-name: github.com/santhosh-tekuri/jsonschema/v6 dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	1 month ago
Matt Farina	a560eab10d	Merge pull request #32463 from karan-vk/fix/dev-v3-openpgp-govulncheck fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932	1 month ago
Karan V	bd392c6a60	fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 Backport of the openpgp migration already merged to main (`7c9176ae3`) to dev-v3. golang.org/x/crypto/openpgp is frozen and flagged by govulncheck as GO-2026-5932 with no fixed release, leaving the govulncheck check red on every Go PR targeting dev-v3. Replace it with the maintained drop-in fork github.com/ProtonMail/go-crypto in pkg/provenance, the only consumer on this branch. The only API difference is openpgp.CheckDetachedSignature, which now takes an io.Reader and a *packet.Config. Pin the indirect github.com/cloudflare/circl at v1.6.3, as v1.6.2 pulled in by default is itself flagged (GO-2026-4550, fixed in v1.6.3). Also backport the mixed RSA/ed25519 keyring sign/verify regression test from main, adapted to the v3 Signatory API, since keyrings with modern key algorithms are the main behavioral surface of this swap. govulncheck ./... now reports 0 vulnerabilities. Fixes #32361 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Karan V <karanvknarayanan@gmail.com>	2 months ago
dependabot[bot]	66a6f5601d	chore(deps): bump the k8s-io group with 7 updates Bumps the k8s-io group with 7 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [k8s.io/api](https://github.com/kubernetes/api) \| `0.36.2` \| `0.36.3` \| \| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) \| `0.36.2` \| `0.36.3` \| \| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) \| `0.36.2` \| `0.36.3` \| \| [k8s.io/apiserver](https://github.com/kubernetes/apiserver) \| `0.36.2` \| `0.36.3` \| \| [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) \| `0.36.2` \| `0.36.3` \| \| [k8s.io/client-go](https://github.com/kubernetes/client-go) \| `0.36.2` \| `0.36.3` \| \| [k8s.io/kubectl](https://github.com/kubernetes/kubectl) \| `0.36.2` \| `0.36.3` \| Updates `k8s.io/api` from 0.36.2 to 0.36.3 - [Commits](https://github.com/kubernetes/api/compare/v0.36.2...v0.36.3) Updates `k8s.io/apiextensions-apiserver` from 0.36.2 to 0.36.3 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.36.2...v0.36.3) Updates `k8s.io/apimachinery` from 0.36.2 to 0.36.3 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.36.2...v0.36.3) Updates `k8s.io/apiserver` from 0.36.2 to 0.36.3 - [Commits](https://github.com/kubernetes/apiserver/compare/v0.36.2...v0.36.3) Updates `k8s.io/cli-runtime` from 0.36.2 to 0.36.3 - [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.36.2...v0.36.3) Updates `k8s.io/client-go` from 0.36.2 to 0.36.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.36.2...v0.36.3) Updates `k8s.io/kubectl` from 0.36.2 to 0.36.3 - [Commits](https://github.com/kubernetes/kubectl/compare/v0.36.2...v0.36.3) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apimachinery dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/cli-runtime dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/client-go dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com>	2 months ago
dependabot[bot]	b842ddfccb	chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#32331 ) Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.6.1 to 2.6.2. - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](https://github.com/oras-project/oras-go/compare/v2.6.1...v2.6.2) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 months ago
dependabot[bot]	f6047c96c7	chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#32332 ) Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords) from 1.0.13 to 1.0.14. - [Commits](https://github.com/mattn/go-shellwords/compare/v1.0.13...v1.0.14) --- updated-dependencies: - dependency-name: github.com/mattn/go-shellwords dependency-version: 1.0.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 months ago
Matt Farina	5194383553	Merge pull request #32300 from benoittgt/fix/govulncheck-containerd [dev-v3] fix: drop containerd v1 dep to resolve govulncheck CVEs	2 months ago
dependabot[bot]	2c24490679	chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. - [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 months ago
dependabot[bot]	953d280f92	chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 (#32306 ) Bumps [golang.org/x/term](https://github.com/golang/term) from 0.44.0 to 0.45.0. - [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 months ago
Benoit Tigeot	a061886b72	fix: drop containerd v1 dep to resolve govulncheck CVEs containerd v1 is EOL and will never receive fixes for GO-2026-5622, GO-2026-5338, GO-2026-5064. The only import was for `remotes.Resolver` in the deprecated `ClientOptResolver` stub. Changing its parameter type to `any` preserves the public API while removing the vulnerable dependency entirely. It should help for PR like https://github.com/helm/helm/pull/32297 Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>	2 months ago
dependabot[bot]	f979836098	chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.32 to 1.7.33. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](https://github.com/containerd/containerd/compare/v1.7.32...v1.7.33) --- updated-dependencies: - dependency-name: github.com/containerd/containerd dependency-version: 1.7.33 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
George Jenkins	a2d165db73	Merge pull request #32239 from helm/dependabot/go_modules/dev-v3/k8s-io-3e1eb108b8 chore(deps): bump the k8s-io group with 2 updates	3 months ago
dependabot[bot]	c4446659f6	chore(deps): bump github.com/cyphar/filepath-securejoin Bumps [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) from 0.6.1 to 0.7.0. - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md) - [Commits](https://github.com/cyphar/filepath-securejoin/compare/v0.6.1...v0.7.0) --- updated-dependencies: - dependency-name: github.com/cyphar/filepath-securejoin dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
dependabot[bot]	1bf9b5fbba	chore(deps): bump the k8s-io group with 2 updates Bumps the k8s-io group with 2 updates: [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) and [k8s.io/apiserver](https://github.com/kubernetes/apiserver). Updates `k8s.io/apiextensions-apiserver` from 0.35.1 to 0.36.2 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.35.1...v0.36.2) Updates `k8s.io/apiserver` from 0.35.1 to 0.36.2 - [Commits](https://github.com/kubernetes/apiserver/compare/v0.35.1...v0.36.2) --- updated-dependencies: - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
dependabot[bot]	119a7d9bab	chore(deps): bump the k8s-io group across 1 directory with 2 updates Bumps the k8s-io group with 2 updates in the / directory: [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl). Updates `k8s.io/apimachinery` from 0.35.1 to 0.36.2 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.35.1...v0.36.2) Updates `k8s.io/kubectl` from 0.35.1 to 0.36.2 - [Commits](https://github.com/kubernetes/kubectl/compare/v0.35.1...v0.36.2) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
dependabot[bot]	acc867b88e	chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.6.0 to 2.6.1. - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](https://github.com/oras-project/oras-go/compare/v2.6.0...v2.6.1) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
dependabot[bot]	b920935feb	chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.52.0 to 0.53.0. - [Commits](https://github.com/golang/crypto/compare/v0.52.0...v0.53.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
dependabot[bot]	5b5ef192c7	chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 Bumps [golang.org/x/term](https://github.com/golang/term) from 0.43.0 to 0.44.0. - [Commits](https://github.com/golang/term/compare/v0.43.0...v0.44.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
dependabot[bot]	af67af8951	chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.37.0 to 0.38.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.37.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	3 months ago
Terry Howe	c678c0c9c0	chore: bump go to 1.26 Signed-off-by: Terry Howe <terrylhowe@gmail.com>	4 months ago
Terry Howe	7a97623435	Merge pull request #32164 from helm/dependabot/go_modules/dev-v3/github.com/containerd/containerd-1.7.32 chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32	4 months ago
Terry Howe	0ec5c8f30f	Merge pull request #32165 from helm/dependabot/go_modules/dev-v3/github.com/distribution/distribution/v3-3.1.1 chore(deps): bump github.com/distribution/distribution/v3 from 3.0.0 to 3.1.1	4 months ago
dependabot[bot]	12c4d45b14	chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3 Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.11.2 to 1.12.3. - [Release notes](https://github.com/lib/pq/releases) - [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md) - [Commits](https://github.com/lib/pq/compare/v1.11.2...v1.12.3) --- updated-dependencies: - dependency-name: github.com/lib/pq dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
dependabot[bot]	a0f97111f5	chore(deps): bump github.com/distribution/distribution/v3 Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.0.0 to 3.1.1. - [Release notes](https://github.com/distribution/distribution/releases) - [Commits](https://github.com/distribution/distribution/compare/v3.0.0...v3.1.1) --- updated-dependencies: - dependency-name: github.com/distribution/distribution/v3 dependency-version: 3.1.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
dependabot[bot]	995c31e20b	chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.30 to 1.7.32. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](https://github.com/containerd/containerd/compare/v1.7.30...v1.7.32) --- updated-dependencies: - dependency-name: github.com/containerd/containerd dependency-version: 1.7.32 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
Terry Howe	3b18fb7a3c	Merge pull request #32149 from helm/dependabot/go_modules/dev-v3/github.com/Masterminds/semver/v3-3.5.0 chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0	4 months ago
dependabot[bot]	8c17168828	chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.4.0 to 3.5.0. - [Release notes](https://github.com/Masterminds/semver/releases) - [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md) - [Commits](https://github.com/Masterminds/semver/compare/v3.4.0...v3.5.0) --- updated-dependencies: - dependency-name: github.com/Masterminds/semver/v3 dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
dependabot[bot]	fe141bd537	chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords) from 1.0.12 to 1.0.13. - [Commits](https://github.com/mattn/go-shellwords/compare/v1.0.12...v1.0.13) --- updated-dependencies: - dependency-name: github.com/mattn/go-shellwords dependency-version: 1.0.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
dependabot[bot]	980836f726	chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0. - [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
Terry Howe	1dde6c7551	fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 Upgrades golang.org/x/net from v0.53.0 to v0.55.0 to fix CVE-2026-39821 (GO-2026-5026), where idna.ToASCII/ToUnicode incorrectly accept Punycode- encoded labels that decode to ASCII-only labels, enabling privilege escalation via hostname check bypass. Coordinated x/ upgrades pulled in by the module graph: - golang.org/x/crypto v0.50.0 => v0.51.0 - golang.org/x/sys v0.43.0 => v0.45.0 - golang.org/x/term v0.42.0 => v0.43.0 Signed-off-by: Terry Howe <terrylhowe@gmail.com>	4 months ago
dependabot[bot]	0162feda1d	chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0 Bumps [k8s.io/klog/v2](https://github.com/kubernetes/klog) from 2.130.1 to 2.140.0. - [Release notes](https://github.com/kubernetes/klog/releases) - [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes/klog/compare/v2.130.1...2.140.0) --- updated-dependencies: - dependency-name: k8s.io/klog/v2 dependency-version: 2.140.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
dependabot[bot]	a664a58f43	chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.35.0 to 0.37.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.35.0...v0.37.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.35.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	4 months ago
Terry Howe	13d5fc4ae0	fix: upgrade opentelemetry packages to patch CVEs Upgrade all OpenTelemetry Go packages to their latest versions: - go.opentelemetry.io/otel: v1.36.0 -> v1.43.0 - go.opentelemetry.io/otel/trace: v1.36.0 -> v1.43.0 - go.opentelemetry.io/otel/metric: v1.36.0 -> v1.43.0 - go.opentelemetry.io/otel/sdk: v1.36.0 -> v1.43.0 - go.opentelemetry.io/otel/sdk/metric: v1.36.0 -> v1.43.0 - go.opentelemetry.io/otel/sdk/log: v0.8.0 -> v0.19.0 - go.opentelemetry.io/otel/log: v0.8.0 -> v0.19.0 - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: v0.8.0 -> v0.19.0 - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp: v0.8.0 -> v0.19.0 - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc: v1.32.0 -> v1.43.0 - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp: v1.32.0 -> v1.43.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.34.0 -> v1.43.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.34.0 -> v1.43.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: v1.32.0 -> v1.43.0 - go.opentelemetry.io/otel/exporters/prometheus: v0.54.0 -> v0.65.0 - go.opentelemetry.io/otel/exporters/stdout/stdoutlog: v0.8.0 -> v0.19.0 - go.opentelemetry.io/otel/exporters/stdout/stdoutmetric: v1.32.0 -> v1.43.0 - go.opentelemetry.io/otel/exporters/stdout/stdouttrace: v1.32.0 -> v1.43.0 - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.61.0 -> v0.68.0 - go.opentelemetry.io/contrib/instrumentation/.../otelgrpc: v0.60.0 -> v0.68.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Terry Howe <terrylhowe@gmail.com>	5 months ago
dependabot[bot]	9c854fbd93	chore(deps): bump the k8s-io group with 7 updates Bumps the k8s-io group with 7 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [k8s.io/api](https://github.com/kubernetes/api) \| `0.35.0` \| `0.35.1` \| \| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) \| `0.35.0` \| `0.35.1` \| \| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) \| `0.35.0` \| `0.35.1` \| \| [k8s.io/apiserver](https://github.com/kubernetes/apiserver) \| `0.35.0` \| `0.35.1` \| \| [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) \| `0.35.0` \| `0.35.1` \| \| [k8s.io/client-go](https://github.com/kubernetes/client-go) \| `0.35.0` \| `0.35.1` \| \| [k8s.io/kubectl](https://github.com/kubernetes/kubectl) \| `0.35.0` \| `0.35.1` \| Updates `k8s.io/api` from 0.35.0 to 0.35.1 - [Commits](https://github.com/kubernetes/api/compare/v0.35.0...v0.35.1) Updates `k8s.io/apiextensions-apiserver` from 0.35.0 to 0.35.1 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.35.0...v0.35.1) Updates `k8s.io/apimachinery` from 0.35.0 to 0.35.1 - [Commits](https://github.com/kubernetes/apimachinery/compare/v0.35.0...v0.35.1) Updates `k8s.io/apiserver` from 0.35.0 to 0.35.1 - [Commits](https://github.com/kubernetes/apiserver/compare/v0.35.0...v0.35.1) Updates `k8s.io/cli-runtime` from 0.35.0 to 0.35.1 - [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.35.0...v0.35.1) Updates `k8s.io/client-go` from 0.35.0 to 0.35.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.35.0...v0.35.1) Updates `k8s.io/kubectl` from 0.35.0 to 0.35.1 - [Commits](https://github.com/kubernetes/kubectl/compare/v0.35.0...v0.35.1) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apimachinery dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/cli-runtime dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/client-go dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.35.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com>	7 months ago
dependabot[bot]	a692247486	chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.47.0 to 0.48.0. - [Commits](https://github.com/golang/crypto/compare/v0.47.0...v0.48.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	7 months ago
dependabot[bot]	9f2a7f696a	chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0 Bumps [golang.org/x/term](https://github.com/golang/term) from 0.39.0 to 0.40.0. - [Commits](https://github.com/golang/term/compare/v0.39.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	7 months ago
Joe Julian	a46e266cd0	Merge pull request #31821 from helm/dependabot/go_modules/dev-v3/golang.org/x/text-0.34.0 chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0	7 months ago
dependabot[bot]	79f039be71	chore(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2 Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.11.1 to 1.11.2. - [Release notes](https://github.com/lib/pq/releases) - [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md) - [Commits](https://github.com/lib/pq/compare/v1.11.1...v1.11.2) --- updated-dependencies: - dependency-name: github.com/lib/pq dependency-version: 1.11.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	7 months ago
dependabot[bot]	45210d597d	chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.33.0 to 0.34.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.33.0...v0.34.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.34.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	7 months ago
dependabot[bot]	703999db84	chore(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1 Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.10.9 to 1.11.1. - [Release notes](https://github.com/lib/pq/releases) - [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md) - [Commits](https://github.com/lib/pq/compare/v1.10.9...v1.11.1) --- updated-dependencies: - dependency-name: github.com/lib/pq dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	7 months ago
dependabot[bot]	a04be9699e	chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.46.0 to 0.47.0. - [Commits](https://github.com/golang/crypto/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	8 months ago
dependabot[bot]	4f5a655876	chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.32.0 to 0.33.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.32.0...v0.33.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	8 months ago
dependabot[bot]	65c504a4ae	chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 Bumps [golang.org/x/term](https://github.com/golang/term) from 0.38.0 to 0.39.0. - [Commits](https://github.com/golang/term/compare/v0.38.0...v0.39.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	8 months ago

1 2 3 4 5 ...

464 Commits (v3.22.0-rc.1)