Helm v4.1.4
security~****!!!
Changes
- GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segmentsecurity
- GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin installsecurity
- GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directorysecurity
- Ignore error plugin loads (cli, getter) 25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)changed
- Plugin missing provenance bypass 05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)fixed
- Chart dot-name path bug 4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)fixed
- Plugin version path traversal 36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)fixed
- Pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)fixed
- For questions and just to hang outother
- For discussing PRs, code, and bugsother
- Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoomother
- MacOS amd64 (checksum / abf09c8503ad1d8ef76d3737a058c3456a998aae5f5966fce4bb3031aeb1654e)other
12 more lines
- MacOS arm64 (checksum / 7c2eca678e8001fa863cdf8cbf6ac1b3799f9404a89eb55c08260ef5732e658d)other
- Linux amd64 (checksum / 70b2c30a19da4db264dfd68c8a3664e05093a361cefd89572ffb36f8abfa3d09)other
- Linux arm (checksum / c4a7d37032379cc7e82c9c76487d1041b193c9a0fbb4b8f3790230899b830a4f)other
- Linux arm64 (checksum / 13d03672be289045d2ff00e4e345d61de1c6f21c1257a45955a30e8ae036d8f1)other
- Linux i386 (checksum / 3e9bcefb85293854367bea931d669bb742974bbd978b3960df921ed129ff40f9)other
- Linux ppc64le (checksum / 35a48f5db5c655b4471b37be75e76bfb2b23fc8a95d0fa2f0f344f0694336358)other
- Linux s390x (checksum / c5653d0b3687f008dc48f80219906b574af3b623ddc114f92383327299ad935e)other
- Linux riscv64 (checksum / 9d747ed5761a6a5c15aa7ad108b65aee917d8e33448690e83a6451b6a48748e6)other
- Windows amd64 (checksum / bd60f567f667631a2c9b698dfabe5e3cd52eaaf4264163c0a9cae566db8560e8)other
- Windows arm64 (checksum / d0a651026da4a26b28bdfc3d455ce3dfacbc267182dc2225c2172b1dcc549643)other
- 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026other
- 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026other
1 maintenance lines (dependency bumps, CI, tests, docs)
- Test, debug, and contribute charts: ArtifactHub/packagesmaintenance
25 lines3 security1 changed4 fixed16 other1 maintenancetyped from the source notes