Helm 3.22.1 → 4.3.1
16 releases · 15 breaking changes · 4 security fixes · 1 advisory fixed
4security15breaking3deprecated57feature190fix
Vulnerabilities fixed by this upgrade
- 4.8 CVE-2026-35206 Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Breaking changes
- breaking fix (internal/plugin): remove zero-width spaces from plugin name comment in 4.3.0
- breaking Remove deprecated internal/chart/v3/ code (#32365) 4dfbaa40c6cd67e1df345889113a7879ec66136c (George Jenkins) in 4.3.0
- breaking Removed extra space in rollback-with-description.txt b177a8e9060720e91c402cdba2224c6d58789fa3 (MrJack) in 4.3.0
- breaking remove legacy import comments from remaining packages (#31933) 82be04d7f2881f59b3a85483eb248417e1d18fc3 (Abhay Chaurasiya) in 4.3.0
- breaking remove freeport dependency fc743b2a1be47c69cc3bf58e0fdc023f8844f866 (kimsungmin1) in 4.3.0
- breaking internal/plugin: remove zero-width spaces from plugin name comment 979e68fbbd5a932c67b756884880d7641f268632 (Aleksei Sviridkin) in 4.3.0
- breaking remove freeport dependency 9fbd190c30addb4786e4fe930a0fe98bf354116a (kimsungmin1) in 4.2.4
- breaking remove GOTOOLCHAIN e7bea8513c30475664919f031774e18fecdf1f66 (Terry Howe) in 4.2.0
- breaking pkg/kube: remove legacy import comments d7cdc9e8fb20c42d19a2371f37ee719be6be6b94 (abhay1999) in 4.2.0
- breaking Remove legacy sync-repo.sh script 97fd00786f16ebc3b68164bff7133592f19f70b6 (Jeevan Yewale) in 4.2.0
- breaking Remove refactorring changes from coalesce_test.go 0298b2ffd0823eead74c75e1b890b0bf47d0db62 (Evans Mungai) in 4.2.0
- breaking Remove refactorring changes from coalesce_test.go c3c57dba9878074a7642f2cdf583e809bba7f96e (Evans Mungai) in 4.1.3
- breaking Fixed regression where vendor-specific suffixes were stripped from .Capabilities.KubeVersion.GitVersion, breaking charts that detect managed Kubernetes platforms #31528 in 4.1.0
- breaking Remove two redundant if-checks. 380abe2b1643e1a8eec9cd575d1d5c0521cf1c31 (Mads Jensen) in 4.1.0
- breaking Fixed rollback error when a manifest is removed in a failed upgrade #13437 in 4.0.5
Security changes
- security GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in 4.1.4
- security GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install in 4.1.4
- security GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in 4.1.4
- security Run the vulnerability check on PR that change the file 24a82589f8ee9f8f385c63b6c68dabdf19109da7 (Matt Farina) in 4.1.0
Deprecations
- deprecated deprecate unused --hide-notes and --render-subchart-notes flags in 4.2.0
- deprecated Fixed broken backwards compatibility for deprecated --atomic flag on install command #31901 in 4.1.3
- deprecated Replace deprecated NewSimpleClientset a15db7f087826312eff5fddf77b5956521fbaa6b (George Jenkins) in 4.1.0
Every release in between
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
fixfix(action): wait for CRD establishment under HookOnlyStrategy #32672 by @pujitha24
fixfix(linters): update golangci-lint to v2.14.0 #32744 by @ruslan-shaydullin
other4.3.2 and 3.22.2 are the next patch releases scheduled for November 11, 2026
other4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)
otherchore(deps): bump otlploghttp and stdoutlog to v0.21.0 c0d08d0d6d9424d4a14febb5e8a3e51b0dd00dff (Terry Howe)
otherchore(deps): bump the k8s-io group across 1 directory with 7 updates 0c0146eb409bcbc1793d97d67500cdf55050a742 (dependabot[bot])
fixfix: bump golang.org/x/net to v0.61.0 (#32758) dd91731c138d76a26b3aa3ff69e6d40febe8e737 (Terry Howe)
fixfix(linters): update golangci-lint to v2.14.0 (#32744) 3a376b2917d335edcbc714c0b3770442255ec9af (Ruslan Shaydullin)
fixfix(action): wait for CRD establishment under HookOnlyStrategy (#32672) 5fed6a5e0de4669dc4436eb02db9036fe5941b46 (Pujitha Paladugu)
otherchore(deps): bump sigs.k8s.io/controller-runtime from 0.25.1 to 0.25.2 (#32726) b227bf4704ab6ce9aa2de78ba70d8d227564f0c8 (dependabot[bot])
otherchore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 (#32715) af79b8ebe296201b47e8f7dac9b6c8a8927086d7 (dependabot[bot])
otherchore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc ab6b245a2cdcadac70d5abbe25b0ae748df914e6 (dependabot[bot])
otherchore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (#32665) 0f206176faf573da63727dd7ddea5a11bfa98792 (dependabot[bot])
otherchore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (#32664) e26e15829234121ee0c1bad535ad4ba70e8caa65 (dependabot[bot])
otherchore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace (#32663) 23ab1c558484f6e58b28029cdacce7a4938b59e3 (dependabot[bot])
otherchore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 (#32662) 8303180a5eec17dda46ac1995d65d7d40bf21b98 (dependabot[bot])
fixfor discussing PRs, code, and bugs
featurefeat: Add duration functions
featurefeat(engine): add debug logging when lookup returns empty
featurefeat: add ownership verification before deleting resources during uni…
featurefeat: honor SOURCE_DATE_EPOCH for chart archives
featurefeat(rollback): add --description flag to provide rollback reason
breakingfix (internal/plugin): remove zero-width spaces from plugin name comment
fixfix(loader): do not drop values files ending at a 4096-byte boundary
fixfix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test
fixfix(provenance): support GnuPG keybox (pubring.kbx) keyrings
fixfix(template): regression - route registry messages to stderr in template and show
featureperf: enable concurrent status computation to prevent multi-minute delays
breakingRemove deprecated internal/chart/v3/ code (#32365) 4dfbaa40c6cd67e1df345889113a7879ec66136c (George Jenkins)
fixfix(template): regression - route registry messages to stderr in template and show (#32217) 9a3c040369361678aef1ab251e83a38b455f5159 (Aaron Mark)
fixfix: correct 'doest not match' in readiness debug logs 6888b0a280bb6fbb847c85d2a473c425b6a0862d (MsfPablo)
fixfix(provenance): support GnuPG keybox (pubring.kbx) keyrings (#32281) 67d54fd8808ab47e93dad40f4238d5fe28d1efd0 (Ruslan Shaydullin)
fixfix(loader): do not drop values files ending at a 4096-byte boundary 601445e88cf1fe66b2885c793d564030aad1d707 (Dean Chen)
fixfix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#32521) a0c2f6dade5180fdb08bcc5debef56357cd586ab (Terry Howe)
fixfix(chart): normalize StampModTimes timestamp + Chart.lock test 3c3be926aaea573cf94931877e8072aefb231b60 (Ilya Kiselev)
fixfix(scripts): clarify cache-busting behavior bc0114c70841e2a05c95e53e20358fb761dbfb2e (Solomon Wakhungu)
fixfix(scripts): address cache-busting review feedback bbaf420a101379dad4f8452129cf26f2fff7e536 (Solomon Wakhungu)
featureAdded missing import 94a3315f4d699c6bb4140550d4c98b46bb4382d2 (MrJack)
fixPotential fix for pull request finding f1ede7c9c114c745da2f5c6cef8d27e1eb342498 (MrJack)
breakingRemoved extra space in rollback-with-description.txt b177a8e9060720e91c402cdba2224c6d58789fa3 (MrJack)
featurefeat(rollback): add --description flag to provide rollback reason f8180e6de473bb4b1008b76aa2ac63b8bcd104c0 (MrJack)
fixPotential fix for pull request finding a27f3a062027d8b459eed2186076fb9384b82f38 (Matthieu MOREL)
featureperf: enable concurrent status computation to prevent multi-minute delays (#32043) 3bcf965f997499c477436515e6ccf5d51ab82e5e (Zhaofeng Miao)
breakingremove legacy import comments from remaining packages (#31933) 82be04d7f2881f59b3a85483eb248417e1d18fc3 (Abhay Chaurasiya)
featurefeat: honor SOURCE_DATE_EPOCH for chart archives (#32162) ad93b7df635d032a71201206cc3490e76b83bef4 (Lohit Kolluri)
featurefeat(linters): add new revive rules for better code quality 16787d65f5091cf5c5e4f2884ef0027ada117465 (Matthieu MOREL)
breakingremove freeport dependency fc743b2a1be47c69cc3bf58e0fdc023f8844f866 (kimsungmin1)
featureadd newline in license header 319e06cda30e706db541066d5fe07249b0ed656c (kimsungmin1)
breakinginternal/plugin: remove zero-width spaces from plugin name comment 979e68fbbd5a932c67b756884880d7641f268632 (Aleksei Sviridkin)
featurefeat: report in debug the version we select with version range arg bf78b876c74ee4359a6cebb54e0b97183cdfe129 (Benoit Tigeot)
featureAdd duration functions 722dd3e3a82b06fbda60ebf24edc653e7b74e3f9 (Jorge Rocamora)
featurefeat(history): add --show-rollback flag for opt-in rollback column e889cff0896d842c7e1854729611ac520a925d0b (MrJack)
featureAdded missing pkg/cmd/testdata/output files d52b489459d51d67d9db877f169bd09273b6cd6c (MrJack)
featurefeat(history): add rollback revision column to helm history output 300f71b1ebb1b383241a1806a813c6f30a8ff382 (MrJack)
featureAdd ownership verification to uninstall action f552950b05066d4d6a9d6cf9a91c26656f4a90fc (Evans Mungai)
featurefeat: add ownership verification before deleting resources during uninstall 906f87ce1d6d7a46bc68601c1217623e40b78877 (Evans Mungai)
+237 more items in the release notesotherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
fixfix: Improve error reporting for helm template --debug with --show-only- #31185 by @kyokuping
fixfix: fetch logs from all containers in test pods- #32099 by @SebTardif
fixfix(provenance): check error return in Digest and encodeRelease- #32136 by @SebTardif
fixfix panic on repeated IsReachable calls- #32184 by @atkrad
fixfix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211 by @kimsungmin1
fixFix missing conflict retry with server-side apply- #32088 by @Kajot-dev
otherProperly format the extra field in gzipped packages- #31884 by @ouillie
fixFix vanishing empty lines- #32327 by @matheuscscp
fixfix: pass registry client to downloader.Manager in upgrade- #32400 by @SetagGnaw
otherchore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1- for GO-2026-6061 #32450
fixfix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158- #32521 by @TerryHowe
other4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
otherMinimal fix to build failure from #31211. 3900f434fd3ef2b84065dc04508df48f288dba00 (Scott Rigby)
fixfix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#32521) f7c6e8f0f1e0e649e8d03b1535db4f3b8d0c9af2 (Terry Howe)
otherchore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 035a2c38e9a75ca0988c8449c0b7257f30d04064 (dependabot[bot])
fixfix: pass registry client to downloader.Manager in upgrade f76a5f46a952f731cc1543f348121297c8b3f6cc (Gates Wang)
otherApply suggestions 5a7c6c7c732b04ad6517b452d538da9e18993d67 (Will Noble)
otherProperly format the extra field in gzipped packages 22818486ce0fc18d92e01ba39faf65f70ffa8865 (Will Noble)
fixFix missing conflict retry with server-side apply (#32088) 2c979a17ac6b6d7bfe2d6650b69fa9effe963d4d (Jakub Jaruszewski)
fixPotential fix for pull request finding 2bd2c66544634e419ede3cfa18952cce5a5acd08 (kimsungmin1)
fixfix(registry): resolve golangci-lint issues in token-auth tests 183a5402291c553898b9c404bc17c95c81ea1c6c (kimsm28)
fixfix(registry): use plain-http registry in token-auth scope test 9655b5aecc0d36142d0620ff5ed762065a997739 (kimsm28)
fixfix typos in withScopeHint function comment 63f2b6809919e5e8e3e04f52064a536a14f1ff9b (kimsm28)
fixfix registry test failures by adjusting DockerRegistryHost and auth server listener management f7488c0be8c65dd16386c215cac4332900667278 (kimsm28)
fixfix variable naming requestUrl -> requestURL 8fe78fbe46eb2db5c75ab1cc89699c750017dca6 (kimsm28)
fixfix typo, remove unnecessary code, fix to avoid to use the assertion in http hanlder d0670d2fb2c3426cde4b41927b5e9b8b4370df93 (kimsm28)
fixfix typo d34fcd9264225a1e6296c4b0ee124dc69f3b3ecc (kimsungmin1)
breakingremove freeport dependency 9fbd190c30addb4786e4fe930a0fe98bf354116a (kimsungmin1)
featureadd newline in license header 9275661357afdfe12b8ce561e8103673f16cca8d (kimsungmin1)
fixfix scope when helm push to a registry that use token auth fef91f3e6942a20148542461eaebfb24f2c09584 (kimsungmin1)
fixfix panic on repeated IsReachable calls e89ce68bc5fec430bc1e2f0aef1aca6a2e71f795 (Mohammad Abdolirad)
fixfix(provenance): check error return in Digest ff1ac83bfb1246cdf1b57a4db0042085cc8b265d (Sebastien Tardif)
fixfix: address review feedback 4b4dedb2bdcfac886c124a361a5126e3c5e3c5df (Sebastien Tardif)
fixfix: fetch logs from all containers in test pods 7c8010322b8639cdf7844ac1ae5f8d444db43935 (Sebastien Tardif)
fixFix vanishing empty lines 83a8b70ffc1bcf97bb293cf6b35bd3b5093e8c30 (Matheus Pimenta)
+10 more items in the release notesotherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
other4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
other4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
otherchore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7feece8beb0fcba47059ec9b522fd929a64 (Terry Howe)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
otherRevert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214
other4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
other4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
otherRevert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881cf967a5a09e19866799d0edfd40675803a (George Jenkins)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
fixFixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925
fixFixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056
fixFixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757
fixFixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32081
otherBumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32153
fixFixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #32128
otherDependency updates
other4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
other4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
fixfix: protect FailingKubeClient.RecordedWaitOptions from data race (#31925) d591a19b953bd9cfdf7d9ddd83c2f4ffdaeafb29 (Terry Howe)
fixfix: route registry client output to stdout instead of stderr (#32056) 2a9fcae29280472edec988c6bf0528e4ae79b33a (Terry Howe)
otherchore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd693eee68ba9c1ba42d160c69114eda962c (dependabot[bot])
otherchore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf94008044a516cda4837565237306578a7 (dependabot[bot])
otherchore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891699ae9c8f2d0e06d5db3dd117649886a2 (dependabot[bot])
otherchore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2b7d4ed9ca3bb4be7562f76dd5f2fd8f71 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b0ef8882b062ba8f6b87261411309875b8 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586df3f2a79fca5202b6713f8675bb097a904 (dependabot[bot])
fixfix(version): avoid false range detection on prerelease x/X eabfae560459d1ffe1f7a3268d5441238e9f84b2 (Benoit Tigeot)
fixfix(version): version range || can has no space e3fd51f331e14fb4056951540d2f2ffde81b405c (Benoit Tigeot)
featurefeat: report in debug the version we select with version range arg 1e47395a9566bcaaaf7ed9e31a8367eb1f95e0a3 (Benoit Tigeot)
fixfix: prevent warning when using version range constraints a33e23939a85ac60eb9a6bee818f2c5459fda576 (Benoit Tigeot)
fixfix(kube): always propagate context.Canceled in WaitForDelete fa06d4455724afe22bbe00af7925549a82d95e6c (Terry Howe)
fixfix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d4835df0fb8bd7cbde4cad0cbc79de01a6e93 (Terry Howe)
otherchore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf21e31b5c33df82e67f23855d1358d021d (dependabot[bot])
otherchore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e43f3620eb60ef3524527c1b2fceed90e9 (dependabot[bot])
fixfix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a7461a524b87e5bb73ea5a0c4f82c72469 (Terry Howe)
otherchore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c5751b1723239cbce042533db0d84b65c6bc1 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb364dbfb781059e628572d7177ba191cc4 (dependabot[bot])
otherchore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2a11b2e111acddcbc55d5a4733ba461f20 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb6263f59fe541acd75ce0b508034c65899e1 (dependabot[bot])
otherchore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16b58aa4cb9dbaf8c37055faa28b1b350ae (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de054b5ab1b59f60c790fad39861e294671f1 (dependabot[bot])
fixfix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803bd4953d8ef9d51d927f492ecaaf5df9db (Matheus Pimenta)
otherchore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02b9cd7fcba804391ab3d364739cb2a8780 (dependabot[bot])
fixfor discussing PRs, code, and bugs
featureAdd mustToToml template function
deprecateddeprecate unused --hide-notes and --render-subchart-notes flags
fix4.2.1 will contain only bug fixes
fixfix: add -extldflags -static to dist target to match build-cross f60ab7c31c81a73b8e0aade5aff41bfc01c08820 (Terry Howe)
fixfix: address goreleaser build issues flagged in review c075022ce16489f5f7afd45a37b679cf58fa36ea (Terry Howe)
fixfix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd905b6f8a823733dbc9b9f5cb2843a975f (Terry Howe)
fixfix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce66cb6374d9d7b552802f53b21ea2c2dd1 (Terry Howe)
fixfix: use index for optional env var in version_template e49a1dc16eee526928d8928b8d96c01ee513ebd9 (Terry Howe)
fixfix: canary build file names eaa09100b9b18175d878b1e114cbe9df2a3f70c2 (Terry Howe)
fixFix archive name 5a75279c1a017a60b97bd44986288af7399c6ff8 (Terry Howe)
fixfix goreleaser archive 37284a9211972f7f41a2acc3c3313517596dd4b0 (Terry Howe)
featureadd support for loong64 45336ccd5b2621357e3f785c1fe93627c5990a6e (Terry Howe)
fixfix artifact directory a9659b07e3eec20ab5b964fddae05f51f478f704 (Terry Howe)
breakingremove GOTOOLCHAIN e7bea8513c30475664919f031774e18fecdf1f66 (Terry Howe)
fixfix: adds topLevel permissions to improve openSSF scores 277d9702555532d13426119d31c70fffb389d589 (Gagan H R)
fixfix(templating): hooks conflicting with templates in post-renderers (#32049) 8f56f24d638612a46f3e23265d06338c1f93bccb (Matheus Pimenta)
fixfix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#31952) 265c5eb530a36ec651e79ecf4d37ba2f098b7e59 (Matheus Pimenta)
fixfix(values): do not copy chart-default nils into coalesced values 00638773d1366dc962c785de3d297cf0279b9a0d (Johannes Lohmer)
fixfix(templating): fix wrong YAML separator parsing for post-renderers (#31941) a27f1add79c6c02459413dbb60f8438d8051cf06 (Matheus Pimenta)
fixfix: add debug logging to HTTP getter for helm pull c26be60d81e5cb6a147d6088477cf86fd5aaf1f0 (Cairon)
fixfix: unnecessary-format lint issues from merge 087736b66e97393ccaa0bdf1e5df13dcc9d88340 (George Jenkins)
fixfix: Plugin missing provenance bypass 586eb57338d848e65686a3a9616e2776e87cfd1e (George Jenkins)
fixMinor nit: fix import instructions to comply with canonical import paths de58531ca7ff557342acaa2c906082e58521ef47 (Anmol Virdi)
fixfix(action): return correct error variable in prepareUpgrade 8ef2d45934ba1b9ca341818f1157112fcf7cdf1d (Rhys McNeill)
fixfix(kube): clarify server-side apply patch errors f257c95c783f5595e36cb5a7dcc862cc1f6266b5 (abhay1999)
fixfix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 7025480397d8b6b7fd8cdb5e083dc37b62dbd3d8 (Terry Howe)
featurefeat(engine): add mustToToml template function b075f7a35d25ec0a4414b011142744f8f1821b47 (Ilya Kiselev)
fixfix(kube): remove legacy import comments from test files e64d628a139fab8c876a1d2f4c2928096b286bed (Terry Howe)
breakingpkg/kube: remove legacy import comments d7cdc9e8fb20c42d19a2371f37ee719be6be6b94 (abhay1999)
fixfix: Plugin version path traversal 36dcc27ca3c0cd6d0d08713b03dca82f43d7c5f9 (George Jenkins)
fixfix: Chart dot-name path bug 60184996e5332d26e0b6390cefbf86776829dc46 (George Jenkins)
featurefeat(release): add internal/release/v2 package for chart v3 support (#31709) 4a91f3ad5cc0c1521f6d4dcb5681e2da4baaa157 (Evans Mungai)
featurefeat(create): add --chart-api-version flag (when HELM_EXPERIMENTAL_CHART_V3 env var is set) (#31592) 5aac32077f87ed8cd80da1648abbd323320d4a0b (Evans Mungai)
featureadd image index test e8f386b5aac232c114a036598c2e3015fe296edc (Pedro Tôrres)
featurefeat(kstatus): fine-grained context options for waiting b0b35f1231b0b885b1624c5586938cfa69d30995 (Matheus Pimenta)
breakingRemove legacy sync-repo.sh script 97fd00786f16ebc3b68164bff7133592f19f70b6 (Jeevan Yewale)
breakingRemove refactorring changes from coalesce_test.go 0298b2ffd0823eead74c75e1b890b0bf47d0db62 (Evans Mungai)
featureupdate: test coverage added for helper function validateNameAndGenerateName 115409976b5c3fd94c893eabde114e655c01c573 (Mujib Ahasan)
featureupdate: helper function added for the business logic 522d2fe61508639cfe8f06a43235e7c3eaea3b9a (Mujib Ahasan)
+153 more items in the release notesotherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
securityGHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
securityGHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
securityGHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
fix4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
other4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026
fixfix: Plugin missing provenance bypass 05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)
fixfix: Chart dot-name path bug 4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)
otherignore error plugin loads (cli, getter) 25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)
fixfix: Plugin version path traversal 36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)
fixfix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
fixFixed a bug where --dry-run=server was not respecting generateName #31563
fixFixed a bug where empty CRD resources caused a crash. Now it prints an error #31578
fixFixed a bug where OCI references with tag+digest failed with "invalid byte" error #31601
fixFixed a bug where user-provided nil value was not preserved when chart has an empty map or no default for a key #31644
fixFixed a regression since Helm 3.18.0 where Pulling charts from OCI repositories that use an index to store both Container Images and Helm Charts under the same tag failed #31776
fixFixed a Helm 4 regression where gotemplate white space trimming directly after YAML doc separators, when present after postrendering, caused YAML file corruption #31868
fixFixed a bug where FailedStatus is treated as a terminal state, causing upgrades to fail prematurely when cluster autoscalers needed time to provision nodes, or when pods were being deleted during rolling updates #31897
deprecatedFixed broken backwards compatibility for deprecated --atomic flag on install command #31901
fixSDK: Fixed a Windows 'Access Deined' error if multiple processes try to download the same chart version concurrently #31128
fixSDK: Fixed a bug where users did not receive any logs from the waiter, causing confusion as several minutes could pass with no user feedback #31717
fixSDK: Fixed a bug where server-side apply defaults did not always match the CLI defaults #31732
fixSDK: Fixed a Go import issue when downstream tooling attempted to vendor helm.sh/helm/v4/pkg/kube #31852
breakingRemove refactorring changes from coalesce_test.go c3c57dba9878074a7642f2cdf583e809bba7f96e (Evans Mungai)
fixFix import d47cb2b7efaa26090510f4c2289127f40451062e (Evans Mungai)
fixFix lint warning f7cec12e23fe800495814432da4368b54c6d4552 (Evans Mungai)
fixfix(values): preserve nil values when chart default is empty map 8c5fe4ef9781c714dc121288a4d499e62cc10bf8 (Evans Mungai)
fixfix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394 5b26d4f1f99091262fef50ed51133e7ae8e3b011 (Terry Howe)
fixfix: bump fluxcd/cli-utils to v0.37.2-flux.1 360c1315ba2d468fcff77193f52764c6ad912c90 (Terry Howe)
fixfix: insert newline after doc separators glued to content by template trimming b868e6a7cce696744d3f0c87e3f6bba6a779aff3 (Matheus Pimenta)
fixfix: correct import comment in statuswait.go from v3 to v4 dbfbea91e34220911481f82fc6831284d954959a (rohansood10)
featureadd image index test 4967ead76215e2ea694c37164d14520da9ba8bde (Pedro Tôrres)
fixfix pulling charts from OCI indices 2fe6b106e6d515b6792d53aff517489ae97387be (Pedro Tôrres)
fixfix: handle OCI digest algorithm prefix in chart downloader (#31601) e3e2d01ef45c6e4179d0536ea4a475f18fa23846 (Evans Mungai)
fixfix(install): check nil for restClientGetter and fix tests c15e7114dc0a0f24e0fda65dff83e7a18e264f60 (Manuel Alonso)
fixfix(test): fix tests and check nil for restclient 4b896ca82fa827760086998d6521965e0ace059f (Manuel Alonso)
fixfix(test): merge fix correctly 3fc79399c8af02b6704c10cba14be2ced9497cb2 (Manuel Alonso Gonzalez)
fixfix(install): add more tests and check nil file data 6017d2b470b07a4f55efd2c55ac0745203ddcd0b (Manuel Alonso)
fixfix(test): no check empty resources f451967ab5a5a9b1a26deb699bd1a1f4f2ba6b1e (Manuel Alonso)
fixfix(install): check lenght and file nil, add tests fdadff59eb8c3552de76c7647a9c787c248cdbd2 (Manuel Alonso)
fixfix(action): crd resources can be empty 10d606726560f1e813617c050c7b9cfbb8b0cb26 (Manuel Alonso)
fixfix: casing issue fixed 0fec40f9b61a1dc5799e67bd4fb4ea4321cdd836 (Mujib Ahasan)
fixfix: error handled correctly 263749874cb21ba31ebca17fe6c19fb3d0379417 (Mujib Ahasan)
fixfix: doc string added 961d7d7cd6b39ccc3a63bce7bba505b94a9be384 (Mujib Ahasan)
featureupdate: test coverage added for helper function validateNameAndGenerateName 29e45067f3f5a772c1400eb756605ba3bc615176 (Mujib Ahasan)
featureupdate: helper function added for the business logic d55b0b9022017aa7a5005d1c6bdc049872bc37f7 (Mujib Ahasan)
fixfixed: --dry-run=server now respect generateName f289d1605c9f02c843dd1b5dd03221fdb980f28e (Mujib Ahasan)
fixfix(downloader): safely handle concurrent file writes on Windows bfac7393e4cc8b22a36fb015264d10ddb30e03da (Orgad Shaneh)
+16 more items in the release notesotherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
fixfix: fine-grained context options for waiting #31735
fixfix: kstatus do not wait forever on failed resources #31730
fixfix: Revert "Consider GroupVersionKind when matching resources" #31772
fixfix: handle nil elements in slice copying #31751
other4.2.0 and 3.21.0 are the next minor releases and will be on May 13, 2026
other4.1.2 and 3.20.1 are the next patch releases and will be on March 11, 2026
featurefeat(kstatus): fine-grained context options for waiting 5caf0044d4ef3d62a955440272999e139aafbbed (Matheus Pimenta)
fixbugfix(kstatus): do not wait forever on failed resources 2519a88b0b8ec7c69623f616617b01f626d9aaf5 (Matheus Pimenta)
otherRevert "Consider GroupVersionKind when matching resources" b2c487c4368db88fe9267d2ed62de9a52b333b5b (Matheus Pimenta)
fixfix(copystructure): handle nil elements in slice copying 261387a112bd91edca6511d34de23f7cc5ce9f8b (Philipp Born)
fixfor discussing PRs, code, and bugs
featureFeature: added chart name to dependency logs, namespace to resource waiting logs, and confirmation message when all resources are ready #31530
featureFeature: allow concurrent dependency build with atomic file write #30984
featureFeature: added a --no-headers flag to the 'helm repo list' command, allowing users to suppress table headers in the output. Useful for scripting and automation #31448
featureSDK feature: added a LoadArchive to common loader #31462
featureSDK feature: introduced support for custom kstatus readers #31706
fixFixed bug where a plugin name could already be used by another command #31427
fixFixed bug where --server-side flag was not passed to install when using upgrade --install #31635
fixFixed bug where HELM_ environment variables were not passed to plugins. this fixes a regression which was blocking some getter plugins #31613
fixFixed bug where Helm test --logs failed with hook-delete-policy "hook-failed" or "hook-succeed" #31579
fixFixed kube client logging issue #31560
breakingFixed regression where vendor-specific suffixes were stripped from .Capabilities.KubeVersion.GitVersion, breaking charts that detect managed Kubernetes platforms #31528
fixFixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #12564
featurepkg/kube: introduce support for custom kstatus readers 59ece92bed72767332ddc827c5548e7355ffb09a (Matheus Pimenta)
fixfix(release): fix test compilation error e751a70e84175212d9338738122d045aecb2ad89 (Evans Mungai)
fixfix: typo in the function names 138f730aacf96d0d94535a1d5b29d6dd128a062e (Gergely Brautigam)
featureAdd documentation for --api-versions flag in template command c7cc77b68d46b273bfb6b634d9c39b708c464221 (majiayu000)
deprecatedReplace deprecated NewSimpleClientset a15db7f087826312eff5fddf77b5956521fbaa6b (George Jenkins)
fixfix: add default casess to switch statements 1c119bcaa6f68a73f27a21f9d7dba22c4baf4d7d (Brenden Ehlers)
fixfix: use namespace-scoped watching to avoid cluster-wide LIST permissions 3dd54ed0b693e5e5805cceb535ed5167fa5ada25 (Mohsen Mottaghi)
fixfix(doc): Update default wait strategy f92ae18977bfe4fad74c7cb0e8c7f7fc68d85306 (Deepak)
fixFix TestCliPluginExitCode 3c6557dcf57ef4feee0d4840d4095f1479a63b40 (tison)
fixFix TestConcurrencyDownloadIndex typo 592815ea2b020b354510685bfa61d252095baafb (George Jenkins)
featurefeat: move TerryHowe triage to maintainers e900a255ef4cba78c87f680c52f5b8be5d617277 (Terry Howe)
fixfix(upgrade): pass --server-side flag to install when using upgrade --install 2dc581dc1c9c07e36dde9acc70bd86e23963662a (Evans Mungai)
securityRun the vulnerability check on PR that change the file 24a82589f8ee9f8f385c63b6c68dabdf19109da7 (Matt Farina)
fixFix govulncheck in CI bc9462f20fc9a948fe557c87c895c06d4c0ddc6a (Matt Farina)
fixfix(cli): handle nil config in EnvSettings.Namespace() 8534663e730f7d32ac8777c3b41a7e6c6a94ab96 (Zadkiel AHARONIAN)
fixfix(getter): pass settings environment variables 119341dca7fba0ae2987b4d0ffd41e9574e03a38 (Zadkiel AHARONIAN)
fixfixes comment in install.go a109ac2f06d7cdca85c23567f3c545c726727904 (Stephanie Hohenberg)
fixfixes tests after merge 2f598ffc850d9f83642da362a7be4121cf617275 (Stephanie Hohenberg)
fixfixes lint issue bb9356e182a8abb0f806cd4866a317f273631862 (Stephanie Hohenberg)
featureAdd tests to action package to improve coverage 31131cff9ba3c52060c4b999fa291eaf64abd51d (Stephanie Hohenberg)
fixFix linting issue 9f1c8a26f00ebbe2942064a06b49c275162d10ef (Benoit Tigeot)
featureadded check for nil shutdown d9301441f47bb8cf4c84ffcbed22f39ba70b1588 (Michelle Fernandez Bieber)
featureadded shutdown hook that is executed after the logs have been retrieved 7a557580e1b5aac8327331e720e74bbbe49c0ad7 (Michelle Fernandez Bieber)
breakingRemove two redundant if-checks. 380abe2b1643e1a8eec9cd575d1d5c0521cf1c31 (Mads Jensen)
fixFix kube client logging 936cd328ac59001f7a6716a3eb7e9075f3950f44 (Matt Farina)
featurefeat(repo): add --no-headers option to 'helm repo list' 6ef79bb8d54bd4881e60d3e78d633b021f1079ec (Paul Van Laer)
featureadd concurrency test on write & load index file 118d0eb697e52b90ad48e4e09529614be7ada4bc (Artem Vdovin)
+135 more items in the release notesotherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
fixFixed bug where helm uninstall with --keep-history did not suspend previous deployed releases #12556
breakingFixed rollback error when a manifest is removed in a failed upgrade #13437
fixFixed check to ensure CLI plugin does not load with the same name as an existing Helm command
fixFixed helm test --logs failure with hook-delete-policy "hook-failed" or "hook-succeed" #9098
fixFixed a bug where empty dependency lists were incorrectly treated as present
fixFixed a bug where the watch library did not only watch namespaces associated with the objects
fixFixed regression in downloader plugins environment variables #31612
fixFixed bug where --server-side flag is not respected with helm upgrade --install #31627
otherFor SDK users: exposed KUBECONFIG to env
other4.1.0 and 3.20.0 is the next minor releases and will be on January 21, 2026
other4.1.1 and 3.20.1 are the next patch releases and will be on March 11, 2026
fixfix(upgrade): pass --server-side flag to install when using upgrade --install 1b6053d48b51673c5581973f5ae7e104f627fcf5 (Evans Mungai)
fixfix(cli): handle nil config in EnvSettings.Namespace() 1e3ee1d2ba5a421165fe053a41aa4071cf69ed62 (Zadkiel AHARONIAN)
fixfix(getter): pass settings environment variables 31bd995ce201e295ff2f87e11fdf13bf55fdffd2 (Zadkiel AHARONIAN)
othertest(statuswait): fix Copilot code review suggestion for goroutine in tests 41a6b364a1433dabcefca945619b55a43046f6ce (Mohsen Mottaghi)
othertest(statuswait): add more tests suggested by Copilot code review 2a2e6f722a95a9c312d9f4133e98a67ceaaa5054 (Mohsen Mottaghi)
othertest(statuswait): add some tests for statuswait 3818c02f81cdaf2a0eb9e0082d1f89f2cff9df08 (Mohsen Mottaghi)
fixfix: use namespace-scoped watching to avoid cluster-wide LIST permissions 66cab24bb95f68448a83304c6d3297ec45c8fdb7 (Mohsen Mottaghi)
otherUse length check for MetaDependencies instead of nil comparison abf2007685501002a5051ded95de9090b5c530f3 (Calvin Bui)
otherDeal with golint warning with private executeShutdownFunc 4b3de18628896dc2924643e4a32ab4b9228eb922 (Benoit Tigeot)
otherCode review 321277002a2513d841cc81480dff37985f28e41a (Benoit Tigeot)
fixFix linting issue 417aae9c01a79c01f3de8c2a08079fddada6078e (Benoit Tigeot)
otherUpdate pkg/action/hooks.go 6c838b4a18fa345cce5a22367522058d3d2ebcc2 (Michelle Fernandez Bieber)
featureadded check for nil shutdown c5d87f2f7da0f3d90bd69d71daa70ada29c9d5b9 (Michelle Fernandez Bieber)
othercleaned up empty line 53175b76c784a75610c66c36a17787fc463a242d (Michelle Fernandez Bieber)
otherupdated comment and made defer of shutdown function return errors as before and not the possible shutdown error d2df1ab59e235c2a2edf27bbfdc72ccc09b3af2c (Michelle Fernandez Bieber)
featureadded shutdown hook that is executed after the logs have been retrieved 5b223de7c809fe026f1fff03d1fa684187bdfcbe (Michelle Fernandez Bieber)
fixFix TestCliPluginExitCode e845b68fe3ea0c91f429b384e3b78f3f853ae208 (tison)
otherCheck plugin name is not used 30bfd57c5f677b12ea88a32b5e66735967570e4e (tison)
fixFix rollback for missing resources 0fd2c418b0146c1ea6182c7f7c7676a345554156 (Feruzjon Muyassarov)
fixfix: assign KUBECONFIG environment variable value to env.Kubeconfig b456e274652c84316d5bfcf06d6a8b648e3cc23b (LinPr)
fixfix(rollback): errors.Is instead of string comp e2021f8818d2cf20c118d91fdba8fba5c472c3bb (Hidde Beydals)
fixfix(uninstall): supersede deployed releases af7c15303ace3c506c5c790c41186a09df1c8a54 (Hidde Beydals)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
other3.19.5 and 4.0.5 are the next patch releases and will be on January 14, 2026
other3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026
otherBump v4.0.2 CVE deps cd700e0627b8d9a4997a7ab2bc3b712d0de4dcd3 (George Jenkins)
otherUse latest patch release of Go in releases 9db13ee5c343196f642c568a03e58d3221b324d6 (Matt Farina)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
other3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026
fixfix: prevent reporting fallback on version when none specified 94659f25033af6eb43fc186c24e6c07b1091800b (Benoit Tigeot)
fixfix: prevent segmentation violation on empty yaml in multidoc 2dd1f662cce36de8910e925921dc9f86ec72205b (Benoit Tigeot)
otherIgnore duplicated URN in logs bbad438779699577b6931c1a8e29917f87422c69 (Benoit Tigeot)
otherjsonschema: warn and ignore unresolved URN $ref to match v3.18.4 bdcf920183d5ebc92ff16470864fbf97cdea138f (Benoit Tigeot)
otherPublish Helm v4 -> helm-latest-version 9ac7c2b609b10e328370de3b52915a90b4535dd0 (George Jenkins)
fixfix: Fix Helm v4 release distribtion/get-helm-3 script 0bef6bdbe6e20832dea995037c975a8631072212 (George Jenkins)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
other3.19.3 and 4.0.2 are the next patch releases and will be on December 10, 2025
other3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026
otherCopy adopted resource info 12500dd401faa7629f30ba5d5bff36287f3e94d3 (George Jenkins)
otherfixup test 1cf3841142a333c6e4f6bf935075fdaff7beb2ba (George Jenkins)
otherlogs 32e2d08c45cf1f9fedb2462a780d9f475d373729 (George Jenkins)
fixfix 4b6472ffb042a2c76c5323b9bfb1e8000cb3fd1e (George Jenkins)
fixfix: Use server-side apply for object create during update 9dfe3b35ec7fb16b941c5904c8b8dee716cc225a (George Jenkins)
fixFix kube client logging 861adc2f4a14e96bc5c627a6c557d80461777735 (Matt Farina)
otherupdate tests b2f78726956ba79c0dfde538fa604c6a8e709a75 (yxxhero)
otherRefactor environment variable expansion in PrepareCommands and update tests 77f97a169efda4e2c50453b4da4cee1a7e98af74 (yxxhero)
fixFix syntax errors in the document a156195c35525cfaf404058b0f9aa61610e9e791 (Fish-pro)
fixfix: correct LDFLAGS path for default Kubernetes version 2c0dcda29b56f1e65098a4a2acb3c384734721af (Benoit Tigeot)
featureRedesigned plugin system that supports Web Assembly based plugins
featurePost-renderers are now plugins
featureServer side apply is now supported
featureImproved resource watching, to support waiting, based on kstatus
featureLocal Content-based caching (e.g. for charts)
featureLogging via slog enabling SDK logging to integrate with modern loggers
featureReproducible builds of chart archives
featureUpdated SDK API including support for multiple chart API versions (new experimental v3 chart API version coming soon)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
other3.19.3 and 4.0.1 are the next patch releases and will be on December 10, 2025
other3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026