Skip to content

chore(deps): bump helm.sh/helm/v4 from 4.1.3 to 4.1.4#2683

Merged
eddycharly merged 1 commit into
mainfrom
dependabot/go_modules/helm.sh/helm/v4-4.1.4
Apr 30, 2026
Merged

chore(deps): bump helm.sh/helm/v4 from 4.1.3 to 4.1.4#2683
eddycharly merged 1 commit into
mainfrom
dependabot/go_modules/helm.sh/helm/v4-4.1.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps helm.sh/helm/v4 from 4.1.3 to 4.1.4.

Release notes

Sourced from helm.sh/helm/v4's releases.

Helm v4.1.4 is a security fix patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
  • GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
  • GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

A big thank you to the reporters of these issues (@​maru1009, @​1seal).

Installation and Upgrading

Download Helm v4.1.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Plugin missing provenance bypass 05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)
  • fix: Chart dot-name path bug 4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)
  • ignore error plugin loads (cli, getter) 25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)
  • fix: Plugin version path traversal 36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)
Commits
  • 05fa379 fix: Plugin missing provenance bypass
  • 4e7994d fix: Chart dot-name path bug
  • 2581943 ignore error plugin loads (cli, getter)
  • 36c8539 fix: Plugin version path traversal
  • c61e086 fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 10, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner April 10, 2026 15:35
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/helm.sh/helm/v4-4.1.4 branch from 902d80b to 787263b Compare April 28, 2026 16:34
@eddycharly
eddycharly enabled auto-merge (squash) April 30, 2026 06:49
@eddycharly

eddycharly commented Apr 30, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@eddycharly eddycharly added this to the v0.2.15 milestone Apr 30, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/helm.sh/helm/v4-4.1.4 branch from 787263b to e1972be Compare April 30, 2026 06:50
@eddycharly

eddycharly commented Apr 30, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
chore(deps): bump helm.sh/helm/v4 from 4.1.3 to 4.1.4
90ea77d 
Bumps [helm.sh/helm/v4](https://github.com/helm/helm) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v4.1.3...v4.1.4)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v4
  dependency-version: 4.1.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/helm.sh/helm/v4-4.1.4 branch from e1972be to 90ea77d Compare April 30, 2026 07:10
@eddycharly
eddycharly merged commit f1a648b into main Apr 30, 2026
12 of 13 checks passed
@eddycharly
eddycharly deleted the dependabot/go_modules/helm.sh/helm/v4-4.1.4 branch April 30, 2026 07:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eddycharly eddycharly eddycharly approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

v0.2.15

Development

Successfully merging this pull request may close these issues.

1 participant

@eddycharly