🌱 Update Golang Dependencies group to v3.18.5 [SECURITY] #183
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![cluster-stack-bot[bot]](https://avatars.githubusercontent.com/u/63697494?s=60&v=4){kind=small}
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
cluster-stack-bot
bot
added
the
size/XL
cluster-stack-bot
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
from
1c63aa7 to
3f82aff
Compare
cluster-stack-bot
bot
changed the title
cluster-stack-bot
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
from
3f82aff to
8453bcf
Compare
cluster-stack-bot
bot
changed the title
| datasource | package | from | to | | ---------- | --------------- | ------- | ------- | | go | helm.sh/helm/v3 | v3.16.3 | v3.18.5 |
cluster-stack-bot
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
from
8453bcf to
0e27627
Compare
cluster-stack-bot
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.16.3->v3.18.5GitHub Vulnerability Alerts
CVE-2025-32386
A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory (OOM) termination.
Impact
A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate.
Patches
This issue has been resolved in Helm v3.17.3.
Workarounds
Ensure that any chart archive files being loaded by Helm do not contain files that are large enough to cause the Helm Client or SDK to use up available memory leading to a termination.
For more information
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
CVE-2025-32387
A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow.
Impact
A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.
Patches
This issue has been resolved in Helm v3.17.3.
Workarounds
Ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.
For more information
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
CVE-2025-53547
A Helm contributor discovered that a specially crafted
Chart.yamlfile along with a specially linkedChart.lockfile can lead to local code execution when dependencies are updated.Impact
Fields in a
Chart.yamlfile, that are carried over to aChart.lockfile when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., abash.rcfile or shell script). If theChart.lockfile is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.This affects when dependencies are updated. When using the
helmcommand this happens whenhelm dependency updateis run.helm dependency buildcan write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloaderManagerperforms an update.Patches
This issue has been resolved in Helm v3.18.4
Workarounds
Ensure the
Chart.lockfile in a chart is not a symlink prior to updating dependencies.For more information
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
CVE-2025-55199
A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.
Impact
A malicious chart can point
$refin values.schema.json to a device (e.g./dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.Patches
This issue has been resolved in Helm v3.18.5.
Workarounds
Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of
$refpointing to/dev/zero.References
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
CVE-2025-55198
A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.
Impact
There are two areas of YAML validation that were impacted. First, when a
Chart.yamlfile had anullmaintainer or thechildorparentof a dependenciesimport-valuescould be parsed as something other than a string,helm lintwould panic. Second, when anindex.yamlhad an empty entry in the list of chart versions Helm would panic on interactions with that repository.Patches
This issue has been resolved in Helm v3.18.5.
Workarounds
Ensure YAML files are formatted as Helm expects prior to processing them with Helm.
References
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
Release Notes
helm/helm (helm.sh/helm/v3)
v3.18.5: Helm v3.18.5Compare Source
Helm v3.18.5 is a security release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Security Advisories
Installation and Upgrading
Download Helm v3.18.5. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
7799b48(Matt Farina)dd8502f(Matt Farina)cb8595b(Robert Sirchia)v3.18.4: Helm v3.18.4Compare Source
Helm v3.18.4 is a security release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Security Advisories
Installation and Upgrading
Download Helm v3.18.4. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
f20a4ad(Matt Farina)563b094(dependabot[bot])00de613(Matt Farina)v3.18.3: Helm 3.18.3Compare Source
Helm v3.18.3 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Installation and Upgrading
Download Helm v3.18.3. The common platform binaries are here:
This release was signed with
672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98Eand can be found at @mattfarina keybase account. Please use the attached signatures for verifying this release usinggpg.The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
6838ebc(dependabot[bot])5b9e2f6(Terry Howe)2782412(Terry Howe)e66cf6a(Terry Howe)191f05c(Terry Howe)v3.18.2: Helm 3.18.2Compare Source
Helm v3.18.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Installation and Upgrading
Download Helm v3.18.2. The common platform binaries are here:
This release was signed with
672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98Eand can be found at @mattfarina keybase account. Please use the attached signatures for verifying this release usinggpg.The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
04cad46(Terry Howe)bc9f8a2(Matt Farina)v3.18.1: Helm v3.18.1Compare Source
Helm v3.18.1 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.
Notes:
The community keeps growing, and we'd love to see you there!
Installation and Upgrading
Download Helm v3.18.1. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
f6f8700(Brandt Keller)4da7015(Brandt Keller)1a8507f(Brandt Keller)015531c(Benoit Tigeot)9db1a12(Benoit Tigeot)e8bfa0e(Benoit Tigeot)24b4490(Benoit Tigeot)7e8f534(Benoit Tigeot)ea04cea(Scott Rigby)bec6609(Matt Farina)v3.18.0: Helm v3.18.0Compare Source
Helm v3.18.0 is a feature release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Notable Changes
Installation and Upgrading
Download Helm v3.18.0. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
cc58e3f(dependabot[bot])bf1436b(Matthieu MOREL)d8edc2a(Robert Sirchia)48377fe(Rongrong Liu)cdd7c10(Terry Howe)f9ab8f7(Benoit Tigeot)087fa18(Benoit Tigeot)2a5f83b(dongjiang)5df2f30(dependabot[bot])0906fe7(Evans Mungai)4ee3a19(Patrick Seidensal)3538c2a(dependabot[bot])6fa95c8(dependabot[bot])741b5be(dependabot[bot])017f9fa(Benoit Tigeot)6667252(Benoit Tigeot)4ad1ccd(Benoit Tigeot)3ce10e4(Matt Farina)422c58e(Benoit Tigeot)5e7f12d(Benoit Tigeot)dcc286c(dependabot[bot])1435ec7(Terry Howe)674e882(Terry Howe)c188441(Terry Howe)2b12490(Matt Farina)0648918(dependabot[bot])0911b9c(dependabot[bot])2f22d55(dependabot[bot])89361c9(dependabot[bot])6d64160(dependabot[bot])bcb83e4(Scott Rigby)2aa90b8(Chris Berry)5739197(Chris Berry)b8e1387(Chris Berry)97b0e11(Scott Rigby)2f79afb(Scott Rigby)c77f4ec(Scott Rigby)3cd6afe(Scott Rigby)5367001(Chris Berry)3c44515(Chris Berry)4cb639e(Chris Berry)20f859c(Chris)ca90972(Chris Berry)a9e2075(Evans Mungai)996ad84(Evans Mungai)867c97e(Evans Mungai)af24101(Evans Mungai)c7dfa87(Evans Mungai)b39411a(Evans Mungai)4c50f01(Evans Mungai)3b43f7b(Evans Mungai)a32e11b(Evans Mungai)483ebf9(Evans Mungai)461197f(Evans Mungai)e7fa545(dependabot[bot])d1687ba(dependabot[bot])4c2f88b(Matt Farina)a2413aa(dependabot[bot])959d643(dependabot[bot])3a87c68(dependabot[bot])711cef8(dependabot[bot])7680623(dependabot[bot])03747d9(dependabot[bot])f1db83f(dependabot[bot])3bc3751(dependabot[bot])2ebce78(Jiasheng Zhu)8e86e76(dependabot[bot])326c1e3(Ryan Hockstad)fba9d08(Matt Farina)a79be7d(dependabot[bot])b029d74(dependabot[bot])a1c0ae8(dependabot[bot])d6db69e(Matt Farina)54ffefb(dependabot[bot])ef2eb55(Ryan Hockstad)60fcce1(Scott Rigby)83dddb1(Andrew Block)0a6834f(Althaf M)5a58751(Ryan Hockstad)v3.17.4: Helm v3.17.4Compare Source
Helm v3.17.4 is a patch release, this bring is the security release noted below. This is intended for Helm SDK users. CLI users are recommended to use the latest version of Helm.
Security Advisories
GHSA-557j-xg8c-q2mm: Chart Dependency Updating With Malicious Chart.yaml Content And Symlink
The community keeps growing, and we'd love to see you there!
Installation and Upgrading
Download Helm v3.17.4. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
0e59b9e(Luis Rascao)3663598(Robert Sirchia)v3.17.3: Helm v3.17.3Compare Source
Helm v3.17.3 is a security (patch) release. Users are strongly recommended to update to this release.
The community keeps growing, and we'd love to see you there!
Installation and Upgrading
Download Helm v3.17.3. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
e4da497(Matt Farina)v3.17.2: Helm v3.17.2Compare Source
Helm v3.17.2 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Installation and Upgrading
Download Helm v3.17.2. The common platform binaries are here:
This release was signed with
672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98Eand can be found at @mattfarina keybase account. Please use the attached signatures for verifying this release usinggpg.The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
cc0bbbd(Matt Farina)ecb7a74](https://redirect.github.com/helm/helm/commit/ecb7a74f19c23f76e7c18d1ce99f88bf1Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.