Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: helm/helm
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v3.21.0
Choose a base ref
...
head repository: helm/helm
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v3.21.1
Choose a head ref
  • 18 commits
  • 8 files changed
  • 4 contributors

Commits on Jun 12, 2026

  1. chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0 

    Bumps [golang.org/x/text](https://github.com/golang/text) from 0.35.0 to 0.37.0.
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.35.0...v0.37.0)

---
updated-dependencies:
- dependency-name: golang.org/x/text
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit a664a58)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    cd4dac3 View commit details
    Browse the repository at this point in the history

  2. chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0 

    Bumps [k8s.io/klog/v2](https://github.com/kubernetes/klog) from 2.130.1 to 2.140.0.
- [Release notes](https://github.com/kubernetes/klog/releases)
- [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md)
- [Commits](kubernetes/klog@v2.130.1...2.140.0)

---
updated-dependencies:
- dependency-name: k8s.io/klog/v2
  dependency-version: 2.140.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 0162fed)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    75c2e9b View commit details
    Browse the repository at this point in the history

  3. fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 

    Upgrades golang.org/x/net from v0.53.0 to v0.55.0 to fix CVE-2026-39821
(GO-2026-5026), where idna.ToASCII/ToUnicode incorrectly accept Punycode-
encoded labels that decode to ASCII-only labels, enabling privilege escalation
via hostname check bypass.

Coordinated x/ upgrades pulled in by the module graph:
- golang.org/x/crypto v0.50.0 => v0.51.0
- golang.org/x/sys v0.43.0 => v0.45.0
- golang.org/x/term v0.42.0 => v0.43.0

Signed-off-by: Terry Howe <[email protected]>
(cherry picked from commit 1dde6c7)
    @TerryHowe @scottrigby
    TerryHowe authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    bad6cd4 View commit details
    Browse the repository at this point in the history

  4. chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 

    Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.
- [Commits](golang/crypto@v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 980836f)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    29bdd1b View commit details
    Browse the repository at this point in the history

  5. chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 

    Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords) from 1.0.12 to 1.0.13.
- [Commits](mattn/go-shellwords@v1.0.12...v1.0.13)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-shellwords
  dependency-version: 1.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit fe141bd)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    97e4bc3 View commit details
    Browse the repository at this point in the history

  6. chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 

    Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/Masterminds/semver/releases)
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md)
- [Commits](Masterminds/semver@v3.4.0...v3.5.0)

---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 8c17168)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    1af25d4 View commit details
    Browse the repository at this point in the history

  7. chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 

    Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.30 to 1.7.32.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v1.7.30...v1.7.32)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-version: 1.7.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 995c31e)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    858aa47 View commit details
    Browse the repository at this point in the history

  8. chore(deps): bump github.com/distribution/distribution/v3 

    Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.0.0 to 3.1.1.
- [Release notes](https://github.com/distribution/distribution/releases)
- [Commits](distribution/distribution@v3.0.0...v3.1.1)

---
updated-dependencies:
- dependency-name: github.com/distribution/distribution/v3
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit a0f9711)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    30b9f51 View commit details
    Browse the repository at this point in the history

  9. chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3 

    Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.11.2 to 1.12.3.
- [Release notes](https://github.com/lib/pq/releases)
- [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md)
- [Commits](lib/pq@v1.11.2...v1.12.3)

---
updated-dependencies:
- dependency-name: github.com/lib/pq
  dependency-version: 1.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 12c4d45)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    58b6ccf View commit details
    Browse the repository at this point in the history

  10. chore: bump go to 1.26 

    Signed-off-by: Terry Howe <[email protected]>
(cherry picked from commit c678c0c)
    @TerryHowe @scottrigby
    TerryHowe authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    bec346a View commit details
    Browse the repository at this point in the history

  11. ci: bump golangci-lint to v2.11.3 for go 1.26 

    golangci-lint v2.5.0 is built with go1.25 and refuses to lint a module targeting go 1.26.0. Bump to v2.11.3 (matching main) and apply the new staticcheck QF1012 fixes it surfaces in jsonschema.go.

Signed-off-by: Terry Howe <[email protected]>
(cherry picked from commit 0ed92f0)
    @TerryHowe @scottrigby
    TerryHowe authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    00eac21 View commit details
    Browse the repository at this point in the history

  12. Update .github/env 

    Co-authored-by: Matthieu MOREL <[email protected]>
Signed-off-by: Terry Howe <[email protected]>
(cherry picked from commit ceb9a62)
    @TerryHowe @mmorel-35 @scottrigby
    2 people authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    402225f View commit details
    Browse the repository at this point in the history

  13. chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 

    Bumps [golang.org/x/text](https://github.com/golang/text) from 0.37.0 to 0.38.0.
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/text
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit af67af8)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    ae2f31f View commit details
    Browse the repository at this point in the history

  14. chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 

    Bumps [golang.org/x/term](https://github.com/golang/term) from 0.43.0 to 0.44.0.
- [Commits](golang/term@v0.43.0...v0.44.0)

---
updated-dependencies:
- dependency-name: golang.org/x/term
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 5b5ef19)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    44aff8b View commit details
    Browse the repository at this point in the history

  15. chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 

    Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.52.0 to 0.53.0.
- [Commits](golang/crypto@v0.52.0...v0.53.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit b920935)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    dcf35f8 View commit details
    Browse the repository at this point in the history

  16. chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 

    Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.6.0 to 2.6.1.
- [Release notes](https://github.com/oras-project/oras-go/releases)
- [Commits](oras-project/oras-go@v2.6.0...v2.6.1)

---
updated-dependencies:
- dependency-name: oras.land/oras-go/v2
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit acc867b)
    @dependabot @scottrigby
    dependabot[bot] authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    178e120 View commit details
    Browse the repository at this point in the history

  17. fix(registry): keep credentials on plain-HTTP fallback with oras-go v… 

    …2.6.1

oras-go v2.6.1 hardens the auth client to drop the Authorization header
when a request's origin changes mid-flight (GHSA-vh4v-2xq2-g5cg). Helm's
fallbackTransport reaches plain-HTTP registries by downgrading the
connection from https to http inside a single round trip, which oras now
treats as a credential-leaking origin change and refuses to authenticate.

On login, detect when the transport has fallen back to plain HTTP and, in
that case, set PlainHTTP explicitly and re-ping so requests are built as
http from the start. The scheme no longer changes mid-request, credentials
flow as before, and the new cross-origin protection is preserved for real
https registries (forcedHTTP stays false, so the retry never triggers).

Signed-off-by: Terry Howe <[email protected]>
(cherry picked from commit 2fb05f8)
    @TerryHowe @scottrigby
    TerryHowe authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    702529f View commit details
    Browse the repository at this point in the history

  18. fix(action): avoid nil REST client getter panic when installing CRDs 

    Signed-off-by: sergiochan <[email protected]>
(cherry picked from commit 711a4ea)
    @SergioChan @scottrigby
    SergioChan authored and scottrigby committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    c56dd00 View commit details
    Browse the repository at this point in the history
Loading