Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update module helm.sh/helm/v3 to v3.14.2 [SECURITY] #1185

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update module helm.sh/helm/v3 to v3.14.2 [SECURITY] #1185

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 12, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
helm.sh/helm/v3 v3.10.3 -> v3.14.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-25165

A Helm contributor discovered an information disclosure vulnerability using the getHostByName template function.

Impact

getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with helm install|upgrade|template or when the Helm SDK is used to render a chart.

Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject getHostByName into a chart in order to disclose values to a malicious DNS server.

Patches

The issue has been fixed in Helm 3.11.1.

Workarounds

Prior to using a chart with Helm verify the getHostByName function is not being used in a template to disclose any information you do not want passed to DNS servers.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Philipp Stehle at SAP.

CVE-2024-25620

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Impact

When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name.

Patches

This issue has been resolved in Helm v3.14.1.

Workarounds

Check all charts used by Helm for path changes in their name as found in the Chart.yaml file. This includes dependencies.

Credits

Disclosed by Dominykas Blyžė at Nearform Ltd.

CVE-2024-26147

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Impact

When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would occur in Helm.

In the Helm SDK this is found when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client this impacts functions around adding a repository and all Helm functions if a malicious plugin is added as Helm inspects all known plugins on each invocation.

Patches

This issue has been resolved in Helm v3.14.2.

Workarounds

If a malicious plugin has been added which is causing all Helm client commands to panic, the malicious plugin can be manually removed from the filesystem.

If using Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Release Notes

helm/helm (helm.sh/helm/v3)

v3.14.2: Helm v3.14.2

Compare Source

Helm v3.14.2 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content.

Jakub Ciolek with AlphaSense discovered the vulnerability.

Installation and Upgrading

Download Helm v3.14.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.3 will contain only bug fixes and be released on March 13, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

v3.14.1: Helm v3.14.1

Compare Source

Helm v3.14.1 is a security (patch) release. Users are strongly recommended to update to this release.

A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time.

Dominykas Blyžė with Nearform Ltd. discovered the vulnerability.

Installation and Upgrading

Download Helm v3.14.1. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.2 will contain only bug fixes and be released on March 13, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

v3.14.0: Helm v3.14.0

Compare Source

Helm v3.14.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • New helm search flag of --fail-on-no-result
  • Allow a nested tpl invocation access to defines
  • Speed up the tpl function
  • Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate
  • Added --kube-version to lint command
  • The ignore pkg is now public

Installation and Upgrading

Download Helm v3.14.0. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.1 will contain only bug fixes and will be on February 14, 2024.
  • 3.15.0 is the next feature release and will be on May 08, 2024.

Changelog

  • Improve release action 3fc9f4b (George Jenkins)
  • bump version to 69dcc92 (Matt Farina)
  • Fix issues when verify generation readiness was merged c042264 (Matt Farina)
  • fix test to use the default code's k8sVersionMinor 6e5332e (Joe Julian)
  • lint: Add --kube-version flag to set capabilities and deprecation rules 869c1d2 (Antoine Deschênes)
  • Update to Go 1.21 for builds 847369c (Matt Farina)
  • chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 08ea59c (dependabot[bot])
  • chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 30e1a2c (dependabot[bot])
  • Removing Asset Transparency 803cf2d (Matt Farina)
  • tests(pkg/engine): test RenderWithClientProvider a997de1 (Marcin Owsiany)
  • Make the ignore pkg public again 5586760 (Ismail Alidzhikov)
  • chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 b3cb20a (dependabot[bot])
  • Updating to Kubernetes 1.29.0 libraries e5fff68 (Matt Farina)
  • feature(pkg/engine): introduce RenderWithClientProvider bfec4ec (Marcin Owsiany)
  • chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 70c1519 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 be10183 (dependabot[bot])
  • Updating Helm libraries for k8s 1.28.4 015e174 (Matt Farina)
  • chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 2a211bf (dependabot[bot])
  • Remove excessive logging ce87ece (Sean Mills)
  • chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 3cb6b06 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 42c5af2 (dependabot[bot])
  • Update CONTRIBUTING.md 312a073 (lixin18)
  • Fixing release labelling in rollback 8814bfb (Marcin Chojnacki)
  • chore(deps): bump github.com/docker/docker c54e39a (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 d6e9197 (dependabot[bot])
  • feat: move livenessProbe and readinessProbe values to default values file 9f0313e (Denis Policastro)
  • Revert "fix(main): fix basic auth for helm pull or push" 24e2864 (Matt Farina)
  • chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 c5fe7dd (dependabot[bot])
  • Revert "fix(registry): address anonymous pull issue" 992dc58 (Matt Farina)
  • Update get-helm-3 81362d9 (Marcel Humburg)
  • chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 6d1f6cd (dependabot[bot])
  • chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 372ccca (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 a1a21ae (dependabot[bot])
  • Drop filterSystemLabels usage from Query method 250f0bd (Dmitry Chepurovskiy)
  • Apply review suggestions 0ec47f8 (Dmitry Chepurovskiy)
  • Update get-helm-3 to get version through get.helm.sh f94e5db (Ian Zink)
  • feat: print failed hook name b0d1637 (Serge Logvinov)
  • chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 544cabb (dependabot[bot])
  • Fixing precedence issue with the import of values. 25371e2 (Matt Farina)
  • chore(create): indent to spaces 919bffe (genofire)
  • Allow using label selectors for system labels for sql backend. e6d9b99 (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for secrets and configmap backends. e219c75 (Dmitry Chepurovskiy)
  • remove useless print during prepareUpgrade f004d42 (b4nks)
  • Add missing with clause to release gh action 9d3d17a (Ian Zink)
  • FIX Default ServiceAccount yaml 828763e (Lars Zimmermann)
  • fix(registry): address anonymous pull issue fe4c01f (Hidde Beydals)
  • fix(registry): unswallow error da3c666 (Hidde Beydals)
  • Fix missing run statement on release action 21ea847 (Ian Zink)
  • Add qps/HELM_QPS parameter 415af5b (Andy Smith)
  • chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 102e931 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 2505592 (dependabot[bot])
  • bump version to v3.13.0 c372b15 (Matt Farina)
  • chore(deps): bump github.com/evanphx/json-patch 8b0a78c (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 58ccfc0 (dependabot[bot])
  • Write latest version to get.helm.sh bucket 0619d08 (Ian Zink)
  • Increased release information key name max length. 4199be8 (abrarcv170)
  • Pin gox to specific commit 0403305 (Antony Chazapis)
  • Remove GoFish from package managers for installing the binary a9377f9 (y-yagi)
  • Test update for "Allow a nested tpl invocation access to defines in a containing one" b261a1b (Graham Reed)
  • Test update for "Speed up tpl" 36d417d (Graham Reed)
  • addressing comment 1a3e9a9 (Stefan McShane)
  • Add support for RISC-V 786707c (Antony Chazapis)
  • lint and validate dependency metadata to reference dependencies with a unique key (name or alias) 6a4035a (Daniel Strobusch)
  • Work around template.Clone omitting options 95905f1 (Graham Reed)
  • fix: pass 'passCredentialsAll' as env-var to getter fa067ec (Mathias Neerup)
  • feat: pass basic auth to env-vars when running download plugins f28447c (Mathias Neerup)
  • helm search: New CLI Flag --fail-on-no-result b9cece6 (Bhargav Ravuri)
  • Update pkg/kube/ready.go 141fa4a (muang0)
  • Update pkg/kube/ready.go 4cb62d1 (muang0)
  • Update pkg/kube/ready.go dbb21fc (muang0)
  • Update pkg/kube/ready.go fcc0332 (muang0)
  • Update pkg/kube/ready.go a1a1aaf (muang0)
  • fix post install hook deletion due to before-hook-creation policy fa025fc (zak905)
  • Allow a nested tpl invocation access to defines in a containing one a7d3fd6 (Graham Reed)
  • Remove the 'reference templates' concept e2a7c79 (Graham Reed)
  • Speed up tpl db4f330 (Graham Reed)
  • ready checker- comment update Signed-off-by: James Oden [email protected] d008340 (James Oden)
  • ready checker- remove duplicate statefulset generational check Signed-off-by: James Oden [email protected] 4f99c86 (James Oden)
  • Verify generation in readiness checks d94c509 (James Oden)
  • feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' a9d59f9 (Quentin Devos)

v3.13.3: Helm v3.13.3

Compare Source

Helm v3.13.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.3. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • Updating Helm libraries for k8s 1.28.4 c8b9489 (Matt Farina)
  • Remove excessive logging 2f03d01 (Sean Mills)
  • chore(create): indent to spaces 2e63576 (genofire)

v3.13.2: Helm v3.13.2

Compare Source

Helm v3.13.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.2. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.3 is a patch release and will be on December 13, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 2a2fb3b (dependabot[bot])
  • Update get-helm-3 8f554be (Marcel Humburg)
  • chore(deps): bump github.com/docker/docker 00a334c (dependabot[bot])
  • Fixing release labelling in rollback 12826e8 (Marcin Chojnacki)
  • Drop filterSystemLabels usage from Query method 666b199 (Dmitry Chepurovskiy)
  • Apply review suggestions 7e0084a (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for sql backend. 10018ff (Dmitry Chepurovskiy)
  • Allow using label selectors for system labels for secrets and configmap backends. 3b4cacf (Dmitry Chepurovskiy)
  • Revert "fix(main): fix basic auth for helm pull or push" e785e6c (Matt Farina)
  • Revert "fix(registry): address anonymous pull issue" 268dced (Matt Farina)
  • chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 99ce118 (dependabot[bot])
  • Update get-helm-3 to get version through get.helm.sh 28f208c (Ian Zink)

v3.13.1: Helm v3.13.1

Compare Source

Helm v3.13.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.13.1. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.2 is a patch release and will be on November 08, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • Fixing precedence issue with the import of values. 3547a4b (Matt Farina)
  • Add missing with clause to release gh action 6f9ad87 (Ian Zink)
  • FIX Default ServiceAccount yaml bae7b32 (Lars Zimmermann)
  • fix(registry): unswallow error 06e4fb1 (Hidde Beydals)
  • remove useless print during prepareUpgrade 0e7ec78 (b4nks)
  • fix(registry): address anonymous pull issue 0ac7894 (Hidde Beydals)
  • Fix missing run statement on release action 0901269 (Ian Zink)
  • Write latest version to get.helm.sh bucket 6101393 (Ian Zink)
  • chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 c99a8ac (dependabot[bot])
  • Increased release information key name max length. 52a029d (abrarcv170)
  • chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 ff8e61d (dependabot[bot])

v3.13.0: Helm v3.13.0

Compare Source

Helm v3.13.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • The --dry-run flag now has multiple options which can enable Helm to connect to a Kubernetes instance. The default, when --dry-run is used, is unchanged.
  • Values handling had numerous issues fixed and now consistently has a priority of (1) User specified values (e.g CLI), (2) parent chart values, (3) imported values, and (4) subchart values. Additionally, null can now consistently be used to remove values. Note, there is a regression around this in 3.13.0 that's fixed in 3.13.1.
  • Can work with OCI registries over HTTP using the --plain-http flag
  • Helm now adds the OCI creation annotation
  • New helm get metadata command
  • The SQL driver now only needs write on the first run or when the schema is updated
  • Added labels support for install and upgrade commands
  • The ability to have index.yaml holding JSON content instead of YAML using the --json flag when creating it. JSON is faster to parse and uses less memory which impacts larger files. This is backwards compatible as Helm, all the way back to 3.0.0, parsing can handle JSON content in the index.yaml file.

Installation and Upgrading

Download Helm v3.13.0. The common platform binaries are here:

This release was signed with 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E and can be found at @​mattfarina keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.13.1 is the next bug fix release and will be on October 11, 2023.
  • 3.14.0 is the next feature release and be on January 17, 2024.

Changelog

  • bump version to v3.13.0 825e86f (Matt Farina)
  • Fix leaking goroutines in Install 169561a (Michał Słapek)
  • chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 417040d (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 610217f (dependabot[bot])
  • Update Helm to use k8s 1.28.2 libraries c2ab954 (Matt Farina)
  • chore(deps): bump github.com/cyphar/filepath-securejoin b9fd7f5 (dependabot[bot])
  • make the dependabot k8s.io group explicit ca3a05e (Joe Julian)
  • use dependabot's group support for k8s.io dependencies 04ec71a (Joe Julian)
  • chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action ebb3168 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 fa45978 (dependabot[bot])
  • doc:Executing helm rollback release 0 will roll back to the previous release e01731d (ithrael)
  • fix conflict 4944acb (Maxim Trofimov)
  • add big tests 6138e10 (Maxim Trofimov)
  • fix conflict 199784f (Maxim Trofimov)
  • fix b786cb4 (Maxim Trofimov)
  • add check if all migrations already applied df5904d (Maxim Trofimov)
  • chore(deps): bump github.com/moby/term fa89665 (dependabot[bot])
  • chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 4283b2c (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 d82cc90 (dependabot[bot])
  • Use labels instead of selectorLabels for pod labels 479be0c (Tim Chaplin)
  • fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook 4e5e68d (Bingtan Lu)
  • chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 3c26d65 (dependabot[bot])
  • remove blank ee1cbed (ithrael)
  • add blank 0eb3df6 (ithrael)
  • add rollback unit test 0688046 (ithrael)
  • fix: helm rollback err tips db9460c (ithrael)
  • chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 817e646 (dependabot[bot])
  • Add Ian Zink (z4ce) as triage maintainer 758dc01 (Ian Zink)
  • chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 04850dc (dependabot[bot])
  • chore: HTTPGetter add default timeout 2011a31 (0xff-dev)
  • fix: precedence typo bf543d9 (guoguangwu)
  • Avoid nil dereference if passing a nil resolver 3607cd7 (Antonio Gamez Diaz)
  • Add required changes after merge 197d1de (Antonio Gamez Diaz)
  • goimports 5b08985 (satoru)
  • Fix #​3352, add support for --ignore-not-found just like kubectl delete 48dbda2 (suzaku)
  • chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 aab4c45 (dependabot[bot])
  • chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 c3a4122 (dependabot[bot])
  • Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject 5c7a631 (MR ZHAO)
  • Restore helm get metadata command 0b5e9d3 (Mikhail Kopylov)
  • Revert "Add helm get metadata command" e8e6da2 (Joe Julian)
  • Update pkg/action/install.go 735ff8f (Dmitry Chepurovskiy)
  • test: replace ensure.TempDir with t.TempDir 2ceebff (Eng Zer Jun)
  • chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 95ba0c6 (dependabot[bot])
  • use json api url + report curl/wget error on fail 9d038a2 (shoce)
  • Added error in case try to supply custom label with name of system label during install/upgrade 7b13ac9 (Dmitry Chepurovskiy)
  • Updated per feedback from gjenkins8 e8a748d (Matt Farina)
  • fix(main): fix basic auth for helm pull or push 4a27baa (cuisongliu)
  • chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 48cf02b (dependabot[bot])
  • cmd: support generating index in JSON format 2544aa2 (Hidde Beydals)
  • repo: detect JSON and unmarshal efficiently e21c9cf (Hidde Beydals)
  • Tweaking new dry-run internal handling 96e33e2 (Matt Farina)
  • chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 2e22395 (dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 7d0deb3 (dependabot[bot])
  • chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 f11e2da (dependabot[bot])
  • chore(deps): bump github.com/opencontainers/image-spec ef0f3e5 (dependabot[bot])
  • bump kubernetes modules to v0.27.3 9c4f733 (Joe Julian)
  • chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 f9e5db3 (dependabot[bot])
  • chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 6e2bddd (dependabot[bot])
  • chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 31e9e54 (dependabot[bot])
  • chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 87cbd34 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 91a3f73 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 0ff4b74 (dependabot[bot])
  • chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 b1fe927 (dependabot[bot])
  • chore(deps): bump github.com/do

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner November 12, 2024 08:24
@renovate renovate bot added dependencies Pull requests that update a dependency file renovate PR created by RenovateBot labels Nov 12, 2024
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Nov 12, 2024 •
edited
Loading

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 45 additional dependencies were updated

Details:

Package Change
k8s.io/api v0.25.2 -> v0.29.0
k8s.io/apimachinery v0.25.2 -> v0.29.0
k8s.io/client-go v0.25.2 -> v0.29.0
github.com/BurntSushi/toml v1.1.0 -> v1.3.2
github.com/Masterminds/semver/v3 v3.1.1 -> v3.2.1
github.com/Masterminds/sprig/v3 v3.2.2 -> v3.2.3
github.com/Masterminds/squirrel v1.5.3 -> v1.5.4
github.com/containerd/containerd v1.6.12 -> v1.7.11
github.com/cyphar/filepath-securejoin v0.2.3 -> v0.2.4
github.com/docker/cli v20.10.17+incompatible -> v24.0.6+incompatible
github.com/docker/distribution v2.8.1+incompatible -> v2.8.2+incompatible
github.com/docker/docker v20.10.17+incompatible -> v24.0.7+incompatible
github.com/docker/docker-credential-helpers v0.6.4 -> v0.7.0
github.com/docker/go-units v0.4.0 -> v0.5.0
github.com/emicklei/go-restful/v3 v3.8.0 -> v3.11.0
github.com/evanphx/json-patch v5.6.0+incompatible -> v5.7.0+incompatible
github.com/go-errors/errors v1.0.1 -> v1.4.2
github.com/go-gorp/gorp/v3 v3.0.2 -> v3.1.0
github.com/go-openapi/jsonpointer v0.19.5 -> v0.19.6
github.com/go-openapi/jsonreference v0.19.5 -> v0.20.2
github.com/go-openapi/swag v0.19.14 -> v0.22.3
github.com/huandu/xstrings v1.3.2 -> v1.4.0
github.com/lib/pq v1.10.6 -> v1.10.9
github.com/mailru/easyjson v0.7.6 -> v0.7.7
github.com/mitchellh/go-wordwrap v1.0.0 -> v1.0.1
github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 -> v0.5.0
github.com/opencontainers/image-spec v1.1.0-rc2.0.20221116213201-188d3a4e1942 -> v1.1.0-rc5
github.com/rubenv/sql-migrate v1.1.2 -> v1.5.2
github.com/shopspring/decimal v1.2.0 -> v1.3.1
github.com/sirupsen/logrus v1.8.1 -> v1.9.3
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f -> v0.0.0-20190905194746-02993c407bfb
github.com/xlab/treeprint v1.1.0 -> v1.2.0
k8s.io/apiextensions-apiserver v0.25.2 -> v0.29.0
k8s.io/apiserver v0.25.2 -> v0.29.0
k8s.io/cli-runtime v0.25.2 -> v0.29.0
k8s.io/component-base v0.25.2 -> v0.29.0
k8s.io/klog/v2 v2.70.1 -> v2.110.1
k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 -> v0.0.0-20231010175941-2dd684a91f00
k8s.io/kubectl v0.25.2 -> v0.29.0
k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed -> v0.0.0-20230726121419-3b25d923346b
oras.land/oras-go v1.2.1 -> v1.2.4
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 -> v0.0.0-20221116044647-bc3834ca7abd
sigs.k8s.io/kustomize/api v0.12.1 -> v0.13.5-0.20230601165947-6ce0bf390ce3
sigs.k8s.io/kustomize/kyaml v0.13.9 -> v0.14.3-0.20230601165947-6ce0bf390ce3
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 -> v4.4.1

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 5 times, most recently from 6a72c6a to 530c141 Compare November 19, 2024 12:02
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 2 times, most recently from 68077b9 to 002ad4d Compare December 5, 2024 09:25
marians
marians requested changes Dec 5, 2024
View reviewed changes
Copy link
Member

@marians marians left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unit tests are failing

@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch 3 times, most recently from 17fd747 to 84a5930 Compare December 9, 2024 18:06
@renovate renovate bot force-pushed the renovate/go-helm.sh-helm-v3-vulnerability branch from 84a5930 to faf17ae Compare December 10, 2024 09:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marians marians marians requested changes

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file renovate PR created by RenovateBot
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@marians