Skip to content

chore(deps): update module helm.sh/helm/v3 to v3.18.5 [security] #339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update module helm.sh/helm/v3 to v3.18.5 [security] #339

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Apr 10, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
helm.sh/helm/v3 v3.16.3 → v3.18.5 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-32386

A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

CVE-2025-32387

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.

Impact

A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

CVE-2025-53547

A Helm contributor discovered that a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated.

Impact

Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.

This affects when dependencies are updated. When using the helm command this happens when helm dependency update is run. helm dependency build can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader Manager performs an update.

Patches

This issue has been resolved in Helm v3.18.4

Workarounds

Ensure the Chart.lock file in a chart is not a symlink prior to updating dependencies.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

CVE-2025-55199

A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A malicious chart can point $ref in values.schema.json to a device (e.g. /dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of $ref pointing to /dev/zero.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

CVE-2025-55198

A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.

Impact

There are two areas of YAML validation that were impacted. First, when a Chart.yaml file had a null maintainer or the child or parent of a dependencies import-values could be parsed as something other than a string, helm lint would panic. Second, when an index.yaml had an empty entry in the list of chart versions Helm would panic on interactions with that repository.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Ensure YAML files are formatted as Helm expects prior to processing them with Helm.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm

BIT-helm-2025-32387 / CVE-2025-32387 / GHSA-5xqw-8hwv-wg92 / GO-2025-3602

More information

Details

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

BIT-helm-2025-32387 / CVE-2025-32387 / GHSA-5xqw-8hwv-wg92 / GO-2025-3602

More information

Details

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.

Impact

A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

BIT-helm-2025-32386 / CVE-2025-32386 / GHSA-4hfp-h4cw-hj8p / GO-2025-3601

More information

Details

A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate.

Patches

This issue has been resolved in Helm v3.17.3.

Workarounds

Ensure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm

BIT-helm-2025-32386 / CVE-2025-32386 / GHSA-4hfp-h4cw-hj8p / GO-2025-3601

More information

Details

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Helm vulnerable to Code Injection through malicious chart.yaml content

BIT-helm-2025-53547 / CVE-2025-53547 / GHSA-557j-xg8c-q2mm / GO-2025-3802

More information

Details

A Helm contributor discovered that a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated.

Impact

Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.

This affects when dependencies are updated. When using the helm command this happens when helm dependency update is run. helm dependency build can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader Manager performs an update.

Patches

This issue has been resolved in Helm v3.18.4

Workarounds

Ensure the Chart.lock file in a chart is not a symlink prior to updating dependencies.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 8.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

BIT-helm-2025-53547 / CVE-2025-53547 / GHSA-557j-xg8c-q2mm / GO-2025-3802

More information

Details

Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Helm May Panic Due To Incorrect YAML Content in helm.sh/helm

BIT-helm-2025-55198 / CVE-2025-55198 / GHSA-f9f8-9pmf-xv68 / GO-2025-3888

More information

Details

Helm May Panic Due To Incorrect YAML Content in helm.sh/helm

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Helm May Panic Due To Incorrect YAML Content

BIT-helm-2025-55198 / CVE-2025-55198 / GHSA-f9f8-9pmf-xv68 / GO-2025-3888

More information

Details

A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.

Impact

There are two areas of YAML validation that were impacted. First, when a Chart.yaml file had a null maintainer or the child or parent of a dependencies import-values could be parsed as something other than a string, helm lint would panic. Second, when an index.yaml had an empty entry in the list of chart versions Helm would panic on interactions with that repository.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Ensure YAML files are formatted as Helm expects prior to processing them with Helm.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

BIT-helm-2025-55199 / CVE-2025-55199 / GHSA-9h84-qmv7-982p / GO-2025-3887

More information

Details

A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Impact

A malicious chart can point $ref in values.schema.json to a device (e.g. /dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.

Patches

This issue has been resolved in Helm v3.18.5.

Workarounds

Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of $ref pointing to /dev/zero.

References

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm

BIT-helm-2025-55199 / CVE-2025-55199 / GHSA-9h84-qmv7-982p / GO-2025-3887

More information

Details

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

helm/helm (helm.sh/helm/v3)

v3.18.5: Helm v3.18.5

Compare Source

Helm v3.18.5 is a security release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Security Advisories
Installation and Upgrading

Download Helm v3.18.5. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.19.0 is the next minor release and will be on September 11, 2025
Changelog
  • fix Chart.yaml handling 7799b48 (Matt Farina)
  • Handle messy index files dd8502f (Matt Farina)
  • json schema fix cb8595b (Robert Sirchia)

v3.18.4: Helm v3.18.4

Compare Source

Helm v3.18.4 is a security release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Security Advisories
Installation and Upgrading

Download Helm v3.18.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.18.5 is the next patch release and will be on August 13, 2025
  • 3.19.0 is the next minor release and will be on September 11, 2025
Changelog
  • Disabling linter due to unknown issue f20a4ad (Matt Farina)
  • build(deps): bump the k8s-io group with 7 updates 563b094 (dependabot[bot])
  • Updating link handling 00de613 (Matt Farina)

v3.18.3: Helm 3.18.3

Compare Source

Helm v3.18.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Installation and Upgrading

Download Helm v3.18.3. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.18.4 is the next patch release and will be on July 09, 2025
  • 3.19.0 is the next minor release and will be on September 11, 2025
Changelog
  • build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0 6838ebc (dependabot[bot])
  • fix: user username password for login 5b9e2f6 (Terry Howe)
  • Update pkg/registry/transport.go 2782412 (Terry Howe)
  • Update pkg/registry/transport.go e66cf6a (Terry Howe)
  • fix: add debug logging to oci transport 191f05c (Terry Howe)

v3.18.2: Helm 3.18.2

Compare Source

Helm v3.18.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Installation and Upgrading

Download Helm v3.18.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.18.3 is the next patch release and will be on July 09, 2025
  • 3.19.0 is the next minor release and will be on September 11, 2025
Changelog
  • fix: legacy docker support broken for login 04cad46 (Terry Howe)
  • Handle an empty registry config file. bc9f8a2 (Matt Farina)

v3.18.1: Helm v3.18.1

Compare Source

Helm v3.18.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

Notes:

  • This release fixes regressions around template generation and OCI registry interaction in 3.18.0
  • There are at least 2 known regressions unaddressed in this release. They are being worked on.
    • Empty registry configuration files. When the file exists but it is empty.
    • Login to Docker Hub on some domains fails.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Installation and Upgrading

Download Helm v3.18.1. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.18.2 will contain only bug fixes.
  • 3.19.0 on September 11th, 2025 is the next feature release.
Changelog
  • fix(client): skipnode utilization for PreCopy f6f8700 (Brandt Keller)
  • fix(client): layers now returns manifest - remove duplicate from descriptors 4da7015 (Brandt Keller)
  • fix(client): return nil on non-allowed media types 1a8507f (Brandt Keller)
  • Prevent fetching newReference again as we have in calling method 015531c (Benoit Tigeot)
  • Prevent failure when resolving version tags in oras memory store 9db1a12 (Benoit Tigeot)
  • Update pkg/plugin/plugin.go e8bfa0e (Benoit Tigeot)
  • Update pkg/plugin/plugin.go 24b4490 (Benoit Tigeot)
  • Wait for Helm v4 before raising when platformCommand and Command are set 7e8f534 (Benoit Tigeot)
  • Fix 3.18.0 regression: registry login with scheme ea04cea (Scott Rigby)
  • Revert "fix (helm) : toToml` renders int as float [ backport to v3 ]" bec6609 (Matt Farina)

v3.18.0: Helm v3.18.0

Compare Source

Helm v3.18.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Notable Changes
  • Add support for JSON Schema 2020
  • Enabled cpu and memory profiling
  • Add hook annotation to output hook logs to client on error
Installation and Upgrading

Download Helm v3.18.0. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 3.18.1 on June 11th, 2025 will contain only bug fixes.
  • 3.19.0 on September 11th, 2025 is the next feature release.
Changelog
  • build(deps): bump the k8s-io group with 7 updates cc58e3f (dependabot[bot])
  • fix: govulncheck workflow bf1436b (Matthieu MOREL)
  • bump version to v3.18.0 d8edc2a (Robert Sirchia)
  • fix:add proxy support when mTLS configured 48377fe (Rongrong Liu)
  • docs: Note about http fallback for OCI registries cdd7c10 (Terry Howe)
  • Bump net package to avoid CVE on dev-v3 f9ab8f7 (Benoit Tigeot)
  • Bump toml 087fa18 (Benoit Tigeot)
  • backport #​30677to dev3 2a5f83b (dongjiang)
  • build(deps): bump github.com/rubenv/sql-migrate from 1.7.2 to 1.8.0 5df2f30 (dependabot[bot])
  • Add install test for TakeOwnership flag 0906fe7 (Evans Mungai)
  • Fix --take-ownership 4ee3a19 (Patrick Seidensal)
  • build(deps): bump github.com/rubenv/sql-migrate from 1.7.1 to 1.7.2 3538c2a (dependabot[bot])
  • build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0 6fa95c8 (dependabot[bot])
  • build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0 741b5be (dependabot[bot])
  • Testing text bump 017f9fa (Benoit Tigeot)
  • Permit more Go version and not only 1.23.8 6667252 (Benoit Tigeot)
  • Bumps github.com/distribution/distribution/v3 from 3.0.0-rc.3 to 3.0.0 4ad1ccd (Benoit Tigeot)
  • Unarchiving fix 3ce10e4 (Matt Farina)
  • Fix typo 422c58e (Benoit Tigeot)
  • Report as debug log, the time spent waiting for resources 5e7f12d (Benoit Tigeot)
  • build(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27 dcc286c (dependabot[bot])
  • Update pkg/registry/fallback.go 1435ec7 (Terry Howe)
  • automatic fallback to http 674e882 (Terry Howe)
  • chore(oci): upgrade to ORAS v2 c188441 (Terry Howe)
  • Updating to 0.37.0 for x/net 2b12490 (Matt Farina)
  • build(deps): bump the k8s-io group with 7 updates 0648918 (dependabot[bot])
  • build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0 0911b9c (dependabot[bot])
  • build(deps): bump github.com/opencontainers/image-spec 2f22d55 (dependabot[bot])
  • build(deps): bump github.com/containerd/containerd from 1.7.25 to 1.7.26 89361c9 (dependabot[bot])
  • build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0 6d64160 (dependabot[bot])
  • Fix cherry-pick helm.sh/helm/v4 -> helm.sh/helm/v3 bcb83e4 (Scott Rigby)
  • Refactor based on review comment 2aa90b8 (Chris Berry)
  • Refactor based on review comment 5739197 (Chris Berry)
  • Add HookOutputFunc and generic yaml unmarshaller b8e1387 (Chris Berry)
  • clarify fix error message 97b0e11 (Scott Rigby)
  • fix err check 2f79afb (Scott Rigby)
  • remove comments about previous functionality c77f4ec (Scott Rigby)
  • add short circuit return 3cd6afe (Scott Rigby)
  • Update based on review comments 5367001 (Chris Berry)
  • Update based on review comments 3c44515 (Chris Berry)
  • Fix lint 4cb639e (Chris Berry)
  • Tidy up imports 20f859c (Chris)
  • Add hook annotations to output pod logs to client on success and fail ca90972 (Chris Berry)
  • chore: use []error instead of []string a9e2075 (Evans Mungai)
  • Update cmd/helm/profilin

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner April 10, 2025 19:45
@renovate renovate bot added the security label Apr 10, 2025
@renovate
Copy link
Contributor Author

renovate bot commented Apr 10, 2025 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: module helm.sh/helm/v3@v3.18.5 requires go >= 1.24.0; switching to go1.24.11
go: downloading go1.24.11 (linux/amd64)
go: download go1.24.11: golang.org/toolchain@v0.0.1-go1.24.11.linux-amd64: verifying module: checksum database disabled by GOSUMDB=off

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from f6d9844 to b4addab Compare May 8, 2025 08:13
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 8 times, most recently from 3954592 to d388b75 Compare June 13, 2025 02:56
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from d388b75 to 23184a8 Compare July 9, 2025 01:39
@renovate renovate bot changed the title chore(deps): update module helm.sh/helm/v3 to v3.17.3 [security] chore(deps): update module helm.sh/helm/v3 to v3.18.4 [security] Jul 9, 2025
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 23184a8 to 6909a7f Compare July 17, 2025 06:43
@renovate renovate bot changed the title chore(deps): update module helm.sh/helm/v3 to v3.18.4 [security] chore(deps): update module helm.sh/helm/v3 to v3.17.4 [security] Jul 17, 2025
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 6909a7f to a89715e Compare July 29, 2025 12:29
@renovate renovate bot changed the title chore(deps): update module helm.sh/helm/v3 to v3.17.4 [security] chore(deps): update module helm.sh/helm/v3 to v3.18.4 [security] Jul 29, 2025
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from a89715e to f4d9966 Compare August 14, 2025 11:46
@renovate renovate bot changed the title chore(deps): update module helm.sh/helm/v3 to v3.18.4 [security] chore(deps): update module helm.sh/helm/v3 to v3.18.5 [security] Aug 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security size/XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant