fix(deps): update module helm.sh/helm/v3 to v3.18.5 [security] - autoclosed #207
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
❌ 2 Tests Failed:
View the top 2 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
3 times, most recently
from
ed232d1 to
f55fe03
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
5 times, most recently
from
7a744f3 to
8a06a8a
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
5 times, most recently
from
5eab81e to
1bd5452
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
3 times, most recently
from
6b3828a to
c749fb8
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
4 times, most recently
from
a94efe0 to
c37a2c4
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
8 times, most recently
from
8e15440 to
793e9dd
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
6 times, most recently
from
a5259c8 to
01b71ad
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
3 times, most recently
from
44b7187 to
cd30758
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
8 times, most recently
from
a36ca9c to
87b3d0e
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
5 times, most recently
from
a575b5b to
4caf54d
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
3 times, most recently
from
f2cfa78 to
85e6605
Compare
botty-mcbottington
bot
force-pushed
the
renovate/go-helm.sh-helm-v3-vulnerability
branch
from
85e6605 to
62e8939
Compare
botty-mcbottington
bot
changed the title
botty-mcbottington
bot
deleted the
renovate/go-helm.sh-helm-v3-vulnerability
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.18.4->v3.18.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2025-55199
A Helm contributor discovered that it was possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination.
Impact
A malicious chart can point
$refin values.schema.json to a device (e.g./dev/*) or other problem file which could cause Helm to use all available memory and have an out of memory (OOM) termination.Patches
This issue has been resolved in Helm v3.18.5.
Workarounds
Make sure that all Helm charts that are being loaded into Helm doesn't have any reference of
$refpointing to/dev/zero.References
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
CVE-2025-55198
A Helm contributor discovered an improper validation of type error when parsing Chart.yaml and index.yaml files that can lead to a panic.
Impact
There are two areas of YAML validation that were impacted. First, when a
Chart.yamlfile had anullmaintainer or thechildorparentof a dependenciesimport-valuescould be parsed as something other than a string,helm lintwould panic. Second, when anindex.yamlhad an empty entry in the list of chart versions Helm would panic on interactions with that repository.Patches
This issue has been resolved in Helm v3.18.5.
Workarounds
Ensure YAML files are formatted as Helm expects prior to processing them with Helm.
References
Helm's security policy is spelled out in detail in our SECURITY document.
Credits
Disclosed by Jakub Ciolek at AlphaSense.
Release Notes
helm/helm (helm.sh/helm/v3)
v3.18.5: Helm v3.18.5Compare Source
Helm v3.18.5 is a security release. Users are encouraged to upgrade for the best experience.
The community keeps growing, and we'd love to see you there!
Security Advisories
Installation and Upgrading
Download Helm v3.18.5. The common platform binaries are here:
The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with
bash.What's Next
Changelog
7799b48(Matt Farina)dd8502f(Matt Farina)cb8595b(Robert Sirchia)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.