You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Linux amd64 (checksum / 258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea)
Linux arm (checksum / a8a614c740399ff1ef32bcea6be6e4523f17e3376f9cf55c192cc48c8f2d1f19)
Linux arm64 (checksum / 5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691)
Linux i386 (checksum / 88e4c1834307cdbc9f3b80920e1a383e4ba50bb488fb0be1b1fbd4918bb6ae73)
Linux ppc64le (checksum / 98bb26a2f3c0b0c1a50db3181dff192554e0c204a07427d98d6b01e259f23cbe)
Linux s390x (checksum / 584dd77ef8096d6ef939a1822f72840e749fc8311b2b13ae94df5f786862a56b)
Linux riscv64 (checksum / 957391d0710d72678acd09959b5dc77888cd007a78a4b99944d3b2fc7e1895ca)
Windows amd64 (checksum / 24e8e5b71bab4ee17e6f989931ecf4fb144f9916cbe9990c0b6b2ec7b925c454)
Windows arm64 (checksum / 7c940a73a6882f50b69aec3282549da4a49917669db18fc503db930fb74b9789)
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.
What's Next
4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR successfully addresses the Helm path traversal vulnerability (GHSA-hr2v-4r36-88hr) by upgrading the dependency to v3.20.2. Codacy analysis indicates the changes are up to standards. However, the build environment defined in go.mod uses a Go version (1.25.6) with known vulnerabilities (DoS and XSS). To maintain the security posture of the project, it is recommended to update the Go directive alongside these library changes.
1 comment outside of the diffgo.mod
line 3 🟡 MEDIUM RISK
The current Go version (1.25.6) has known security vulnerabilities (CVE-2026-32288, CVE-2026-32281, CVE-2026-32289) affecting the standard library. Updating the directive to 1.25.9 ensures the build environment and compiled binaries are not exposed to these DoS and XSS risks.
This might be a simple fix:
go 1.25.9
Test suggestions
Verify successful compilation and linking with the new Helm and Kubernetes library versions.
Validate Helm chart processing logic to ensure the security patch for path traversal does not introduce regressions in valid chart handling.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify successful compilation and linking with the new Helm and Kubernetes library versions.
2. Validate Helm chart processing logic to ensure the security patch for path traversal does not introduce regressions in valid chart handling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filegoPull requests that update Go code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
bot
added
dependencies
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Bumps helm.sh/helm/v3 from 3.19.2 to 3.20.2.
Release notes
Sourced from helm.sh/helm/v3's releases.
... (truncated)
Commits
8fb76d6fix: Chart dot-name path bug3a8927efix: pin codeql-action/upload-sarif to commit SHA in scorecards workflowa2369cachore(deps): bump the k8s-io group with 7 updates90e1056add image index test911f2e9fix pulling charts from OCI indices76dad33Remove refactorring changes from coalesce_test.go45c12f7Fix import26c6f19Update pkg/chart/common/util/coalesce_test.go09f5129Fix lint warning417deb2Preserve nil values in chart alreadyDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.