Helm 4.1.0 → 4.2.2
6 releases · 5 breaking changes · 3 security fixes · 3 advisories fixed
3security5breaking2deprecated14feature88fix
Vulnerabilities fixed by this upgrade
- 4.8 CVE-2026-35206 Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
- 8.4 CVE-2026-35204 Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
- 9.3 CVE-2026-35205 Plugin verification fails open when `.prov` is missing, allowing unsigned plugin install
Breaking changes
- breaking remove GOTOOLCHAIN e7bea8513c30475664919f031774e18fecdf1f66 (Terry Howe) in 4.2.0
- breaking pkg/kube: remove legacy import comments d7cdc9e8fb20c42d19a2371f37ee719be6be6b94 (abhay1999) in 4.2.0
- breaking Remove legacy sync-repo.sh script 97fd00786f16ebc3b68164bff7133592f19f70b6 (Jeevan Yewale) in 4.2.0
- breaking Remove refactorring changes from coalesce_test.go 0298b2ffd0823eead74c75e1b890b0bf47d0db62 (Evans Mungai) in 4.2.0
- breaking Remove refactorring changes from coalesce_test.go c3c57dba9878074a7642f2cdf583e809bba7f96e (Evans Mungai) in 4.1.3
Security changes
- security GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment in 4.1.4
- security GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install in 4.1.4
- security GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in 4.1.4
Deprecations
- deprecated deprecate unused --hide-notes and --render-subchart-notes flags in 4.2.0
- deprecated Fixed broken backwards compatibility for deprecated --atomic flag on install command #31901 in 4.1.3
Every release in between
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
otherRevert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214
other4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
other4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
otherRevert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881cf967a5a09e19866799d0edfd40675803a (George Jenkins)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
fixFixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925
fixFixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056
fixFixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757
fixFixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32081
otherBumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32153
fixFixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #32128
otherDependency updates
other4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
other4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
fixfix: protect FailingKubeClient.RecordedWaitOptions from data race (#31925) d591a19b953bd9cfdf7d9ddd83c2f4ffdaeafb29 (Terry Howe)
fixfix: route registry client output to stdout instead of stderr (#32056) 2a9fcae29280472edec988c6bf0528e4ae79b33a (Terry Howe)
otherchore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd693eee68ba9c1ba42d160c69114eda962c (dependabot[bot])
otherchore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf94008044a516cda4837565237306578a7 (dependabot[bot])
otherchore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891699ae9c8f2d0e06d5db3dd117649886a2 (dependabot[bot])
otherchore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2b7d4ed9ca3bb4be7562f76dd5f2fd8f71 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b0ef8882b062ba8f6b87261411309875b8 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586df3f2a79fca5202b6713f8675bb097a904 (dependabot[bot])
fixfix(version): avoid false range detection on prerelease x/X eabfae560459d1ffe1f7a3268d5441238e9f84b2 (Benoit Tigeot)
fixfix(version): version range || can has no space e3fd51f331e14fb4056951540d2f2ffde81b405c (Benoit Tigeot)
featurefeat: report in debug the version we select with version range arg 1e47395a9566bcaaaf7ed9e31a8367eb1f95e0a3 (Benoit Tigeot)
fixfix: prevent warning when using version range constraints a33e23939a85ac60eb9a6bee818f2c5459fda576 (Benoit Tigeot)
fixfix(kube): always propagate context.Canceled in WaitForDelete fa06d4455724afe22bbe00af7925549a82d95e6c (Terry Howe)
fixfix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d4835df0fb8bd7cbde4cad0cbc79de01a6e93 (Terry Howe)
otherchore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf21e31b5c33df82e67f23855d1358d021d (dependabot[bot])
otherchore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e43f3620eb60ef3524527c1b2fceed90e9 (dependabot[bot])
fixfix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a7461a524b87e5bb73ea5a0c4f82c72469 (Terry Howe)
otherchore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c5751b1723239cbce042533db0d84b65c6bc1 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb364dbfb781059e628572d7177ba191cc4 (dependabot[bot])
otherchore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2a11b2e111acddcbc55d5a4733ba461f20 (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb6263f59fe541acd75ce0b508034c65899e1 (dependabot[bot])
otherchore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16b58aa4cb9dbaf8c37055faa28b1b350ae (dependabot[bot])
otherchore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de054b5ab1b59f60c790fad39861e294671f1 (dependabot[bot])
fixfix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803bd4953d8ef9d51d927f492ecaaf5df9db (Matheus Pimenta)
otherchore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02b9cd7fcba804391ab3d364739cb2a8780 (dependabot[bot])
fixfor discussing PRs, code, and bugs
featureAdd mustToToml template function
deprecateddeprecate unused --hide-notes and --render-subchart-notes flags
fix4.2.1 will contain only bug fixes
fixfix: add -extldflags -static to dist target to match build-cross f60ab7c31c81a73b8e0aade5aff41bfc01c08820 (Terry Howe)
fixfix: address goreleaser build issues flagged in review c075022ce16489f5f7afd45a37b679cf58fa36ea (Terry Howe)
fixfix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd905b6f8a823733dbc9b9f5cb2843a975f (Terry Howe)
fixfix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce66cb6374d9d7b552802f53b21ea2c2dd1 (Terry Howe)
fixfix: use index for optional env var in version_template e49a1dc16eee526928d8928b8d96c01ee513ebd9 (Terry Howe)
fixfix: canary build file names eaa09100b9b18175d878b1e114cbe9df2a3f70c2 (Terry Howe)
fixFix archive name 5a75279c1a017a60b97bd44986288af7399c6ff8 (Terry Howe)
fixfix goreleaser archive 37284a9211972f7f41a2acc3c3313517596dd4b0 (Terry Howe)
featureadd support for loong64 45336ccd5b2621357e3f785c1fe93627c5990a6e (Terry Howe)
fixfix artifact directory a9659b07e3eec20ab5b964fddae05f51f478f704 (Terry Howe)
breakingremove GOTOOLCHAIN e7bea8513c30475664919f031774e18fecdf1f66 (Terry Howe)
fixfix: adds topLevel permissions to improve openSSF scores 277d9702555532d13426119d31c70fffb389d589 (Gagan H R)
fixfix(templating): hooks conflicting with templates in post-renderers (#32049) 8f56f24d638612a46f3e23265d06338c1f93bccb (Matheus Pimenta)
fixfix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#31952) 265c5eb530a36ec651e79ecf4d37ba2f098b7e59 (Matheus Pimenta)
fixfix(values): do not copy chart-default nils into coalesced values 00638773d1366dc962c785de3d297cf0279b9a0d (Johannes Lohmer)
fixfix(templating): fix wrong YAML separator parsing for post-renderers (#31941) a27f1add79c6c02459413dbb60f8438d8051cf06 (Matheus Pimenta)
fixfix: add debug logging to HTTP getter for helm pull c26be60d81e5cb6a147d6088477cf86fd5aaf1f0 (Cairon)
fixfix: unnecessary-format lint issues from merge 087736b66e97393ccaa0bdf1e5df13dcc9d88340 (George Jenkins)
fixfix: Plugin missing provenance bypass 586eb57338d848e65686a3a9616e2776e87cfd1e (George Jenkins)
fixMinor nit: fix import instructions to comply with canonical import paths de58531ca7ff557342acaa2c906082e58521ef47 (Anmol Virdi)
fixfix(action): return correct error variable in prepareUpgrade 8ef2d45934ba1b9ca341818f1157112fcf7cdf1d (Rhys McNeill)
fixfix(kube): clarify server-side apply patch errors f257c95c783f5595e36cb5a7dcc862cc1f6266b5 (abhay1999)
fixfix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 7025480397d8b6b7fd8cdb5e083dc37b62dbd3d8 (Terry Howe)
featurefeat(engine): add mustToToml template function b075f7a35d25ec0a4414b011142744f8f1821b47 (Ilya Kiselev)
fixfix(kube): remove legacy import comments from test files e64d628a139fab8c876a1d2f4c2928096b286bed (Terry Howe)
breakingpkg/kube: remove legacy import comments d7cdc9e8fb20c42d19a2371f37ee719be6be6b94 (abhay1999)
fixfix: Plugin version path traversal 36dcc27ca3c0cd6d0d08713b03dca82f43d7c5f9 (George Jenkins)
fixfix: Chart dot-name path bug 60184996e5332d26e0b6390cefbf86776829dc46 (George Jenkins)
featurefeat(release): add internal/release/v2 package for chart v3 support (#31709) 4a91f3ad5cc0c1521f6d4dcb5681e2da4baaa157 (Evans Mungai)
featurefeat(create): add --chart-api-version flag (when HELM_EXPERIMENTAL_CHART_V3 env var is set) (#31592) 5aac32077f87ed8cd80da1648abbd323320d4a0b (Evans Mungai)
featureadd image index test e8f386b5aac232c114a036598c2e3015fe296edc (Pedro Tôrres)
featurefeat(kstatus): fine-grained context options for waiting b0b35f1231b0b885b1624c5586938cfa69d30995 (Matheus Pimenta)
breakingRemove legacy sync-repo.sh script 97fd00786f16ebc3b68164bff7133592f19f70b6 (Jeevan Yewale)
breakingRemove refactorring changes from coalesce_test.go 0298b2ffd0823eead74c75e1b890b0bf47d0db62 (Evans Mungai)
featureupdate: test coverage added for helper function validateNameAndGenerateName 115409976b5c3fd94c893eabde114e655c01c573 (Mujib Ahasan)
featureupdate: helper function added for the business logic 522d2fe61508639cfe8f06a43235e7c3eaea3b9a (Mujib Ahasan)
+153 more items in the release notesotherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
securityGHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
securityGHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
securityGHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
fix4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
other4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026
fixfix: Plugin missing provenance bypass 05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)
fixfix: Chart dot-name path bug 4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)
otherignore error plugin loads (cli, getter) 25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)
fixfix: Plugin version path traversal 36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)
fixfix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)
otherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
fixFixed a bug where --dry-run=server was not respecting generateName #31563
fixFixed a bug where empty CRD resources caused a crash. Now it prints an error #31578
fixFixed a bug where OCI references with tag+digest failed with "invalid byte" error #31601
fixFixed a bug where user-provided nil value was not preserved when chart has an empty map or no default for a key #31644
fixFixed a regression since Helm 3.18.0 where Pulling charts from OCI repositories that use an index to store both Container Images and Helm Charts under the same tag failed #31776
fixFixed a Helm 4 regression where gotemplate white space trimming directly after YAML doc separators, when present after postrendering, caused YAML file corruption #31868
fixFixed a bug where FailedStatus is treated as a terminal state, causing upgrades to fail prematurely when cluster autoscalers needed time to provision nodes, or when pods were being deleted during rolling updates #31897
deprecatedFixed broken backwards compatibility for deprecated --atomic flag on install command #31901
fixSDK: Fixed a Windows 'Access Deined' error if multiple processes try to download the same chart version concurrently #31128
fixSDK: Fixed a bug where users did not receive any logs from the waiter, causing confusion as several minutes could pass with no user feedback #31717
fixSDK: Fixed a bug where server-side apply defaults did not always match the CLI defaults #31732
fixSDK: Fixed a Go import issue when downstream tooling attempted to vendor helm.sh/helm/v4/pkg/kube #31852
breakingRemove refactorring changes from coalesce_test.go c3c57dba9878074a7642f2cdf583e809bba7f96e (Evans Mungai)
fixFix import d47cb2b7efaa26090510f4c2289127f40451062e (Evans Mungai)
fixFix lint warning f7cec12e23fe800495814432da4368b54c6d4552 (Evans Mungai)
fixfix(values): preserve nil values when chart default is empty map 8c5fe4ef9781c714dc121288a4d499e62cc10bf8 (Evans Mungai)
fixfix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394 5b26d4f1f99091262fef50ed51133e7ae8e3b011 (Terry Howe)
fixfix: bump fluxcd/cli-utils to v0.37.2-flux.1 360c1315ba2d468fcff77193f52764c6ad912c90 (Terry Howe)
fixfix: insert newline after doc separators glued to content by template trimming b868e6a7cce696744d3f0c87e3f6bba6a779aff3 (Matheus Pimenta)
fixfix: correct import comment in statuswait.go from v3 to v4 dbfbea91e34220911481f82fc6831284d954959a (rohansood10)
featureadd image index test 4967ead76215e2ea694c37164d14520da9ba8bde (Pedro Tôrres)
fixfix pulling charts from OCI indices 2fe6b106e6d515b6792d53aff517489ae97387be (Pedro Tôrres)
fixfix: handle OCI digest algorithm prefix in chart downloader (#31601) e3e2d01ef45c6e4179d0536ea4a475f18fa23846 (Evans Mungai)
fixfix(install): check nil for restClientGetter and fix tests c15e7114dc0a0f24e0fda65dff83e7a18e264f60 (Manuel Alonso)
fixfix(test): fix tests and check nil for restclient 4b896ca82fa827760086998d6521965e0ace059f (Manuel Alonso)
fixfix(test): merge fix correctly 3fc79399c8af02b6704c10cba14be2ced9497cb2 (Manuel Alonso Gonzalez)
fixfix(install): add more tests and check nil file data 6017d2b470b07a4f55efd2c55ac0745203ddcd0b (Manuel Alonso)
fixfix(test): no check empty resources f451967ab5a5a9b1a26deb699bd1a1f4f2ba6b1e (Manuel Alonso)
fixfix(install): check lenght and file nil, add tests fdadff59eb8c3552de76c7647a9c787c248cdbd2 (Manuel Alonso)
fixfix(action): crd resources can be empty 10d606726560f1e813617c050c7b9cfbb8b0cb26 (Manuel Alonso)
fixfix: casing issue fixed 0fec40f9b61a1dc5799e67bd4fb4ea4321cdd836 (Mujib Ahasan)
fixfix: error handled correctly 263749874cb21ba31ebca17fe6c19fb3d0379417 (Mujib Ahasan)
fixfix: doc string added 961d7d7cd6b39ccc3a63bce7bba505b94a9be384 (Mujib Ahasan)
featureupdate: test coverage added for helper function validateNameAndGenerateName 29e45067f3f5a772c1400eb756605ba3bc615176 (Mujib Ahasan)
featureupdate: helper function added for the business logic d55b0b9022017aa7a5005d1c6bdc049872bc37f7 (Mujib Ahasan)
fixfixed: --dry-run=server now respect generateName f289d1605c9f02c843dd1b5dd03221fdb980f28e (Mujib Ahasan)
fixfix(downloader): safely handle concurrent file writes on Windows bfac7393e4cc8b22a36fb015264d10ddb30e03da (Orgad Shaneh)
+16 more items in the release notesotherJoin the discussion in Kubernetes Slack:
otherfor questions and just to hang out
fixfor discussing PRs, code, and bugs
otherHang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
otherTest, debug, and contribute charts: ArtifactHub/packages
fixfix: fine-grained context options for waiting #31735
fixfix: kstatus do not wait forever on failed resources #31730
fixfix: Revert "Consider GroupVersionKind when matching resources" #31772
fixfix: handle nil elements in slice copying #31751
other4.2.0 and 3.21.0 are the next minor releases and will be on May 13, 2026
other4.1.2 and 3.20.1 are the next patch releases and will be on March 11, 2026
featurefeat(kstatus): fine-grained context options for waiting 5caf0044d4ef3d62a955440272999e139aafbbed (Matheus Pimenta)
fixbugfix(kstatus): do not wait forever on failed resources 2519a88b0b8ec7c69623f616617b01f626d9aaf5 (Matheus Pimenta)
otherRevert "Consider GroupVersionKind when matching resources" b2c487c4368db88fe9267d2ed62de9a52b333b5b (Matheus Pimenta)
fixfix(copystructure): handle nil elements in slice copying 261387a112bd91edca6511d34de23f7cc5ce9f8b (Philipp Born)