RATATOSKRATATOSK
Sign in

Helm

v4.3.0Kubernetes Core
Sep 9, 2026

ACTION 3CHECK 1OTHER 52

A feature release adding new Helm capabilities and output options, alongside correctness fixes and performance improvements. It also includes dependency updates with two disclosed security-related bumps.

Action needed (3)

  • securitycriticalgolang.org/x/net update for GO-2026-5026

    Helm updates golang.org/x/net to v0.55.0 to address GO-2026-5026.

  • securitymediumgo.opentelemetry.io/otel update for GO-2026-5158

    Helm updates go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158.

  • breakingPer-file decompression size limit removal

    Helm removes the per-file decompression size limit from file decompression.

Check if affected (1)

  • breakingOwnership verification before resource deletion

    Applicability is not stated in the release notes.

    Helm adds ownership verification before deleting resources.

    helm#31584

All 52 other recorded changesvalue changes 31 · fixes 14 · additions 4 · constraints 1 · defaults 1 · renames 1

value changes (31)

  • * feat(engine): add debug logging when lookup returns empty by @ogulcanaydogan in https://github.com/helm/helm/pull/32205
  • * feat: honor SOURCE_DATE_EPOCH for chart archives by @lohitkolluri in https://github.com/helm/helm/pull/32162
  • * perf: enable concurrent status computation to prevent multi-minute delays by @mapleeit in https://github.com/helm/helm/pull/32043
  • - Updating the Go version … (Matt Farina)×2
  • - chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 (#32543) edb94f897d1e0ec3335fb7268f07e0fd2666fbb8 (dependabot[bot])
  • - chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 (#32514) f8a308cd470bc1f087b3f4915ba775af18c5ffab (dependabot[bot])
  • - chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 ce27485634fcbd54be8fc8d99a5e4799456420c9 (dependabot[bot])
  • - chore(deps): bump the k8s-io group across 1 directory with 7 updates (#32459) 8f74dce6ba8d7264ce75f52507616720865e712d (dependabot[bot])
  • - chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 fe3f98b5641fe3a0a9fa2575df8698136c2a0029 (dependabot[bot])
  • - fix(scripts): add cache-busting to get-helm-3 version check 5a30c7ae8504218fd68d87c5a7d929d0a3bb3891 (Solomon Wakhungu)
  • - Fix missing conflict retry with server-side apply (#32088) aa1ae3a36017156817e89e59eee0e88af9fc6365 (Jakub Jaruszewski)
  • - chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#32334) dad026acb8caab81411514715c50e50510f558ca (dependabot[bot])
  • - chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#32333) 84e63e5c38913594e476b15609fb6c7ab2d60467 (dependabot[bot])
  • - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 0fc3b9385348b0d346728de3b0969ae2a3b7d47f (Terry Howe)
  • - chore(deps): bump golang.org/x/text from 0.39.0 to 0.40.0 (#32309) a242855a7e2c31efd1f0f69ad1c5ae24be0563de (dependabot[bot])
  • - fix scope when helm push to a registry that use token auth 301e3a12d55c279ef3bd0b1976bafd43bc1e0b7b (kimsungmin1)
  • - chore(deps): bump github.com/fluxcd/cli-utils from 1.2.1 to 1.2.2 5a9b8a788ff260c031f2d2f3e1b6903bd31b3496 (dependabot[bot])
  • - chore(deps): bump github.com/cyphar/filepath-securejoin a0c7d1e1f5ef222fb1be143e9846cebf8b3a2d54 (dependabot[bot])
  • - chore: Improve error reporting for helm template --debug with --show-only 2014946e550ed7a667b9ae8cfe15a377a2fe94ca (Jeaeun Kim)
  • - fix: route registry client output to stdout instead of stderr (#32056) c2f1b238a114d6d7a85b37f80fc6975bd48e4c09 (Terry Howe)
  • - chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 74c1702157722e44f72c4a731c652c9e6ed58f83 (dependabot[bot])
  • - chore(deps): bump golang.org/x/crypto from … to … … (dependabot[bot])×2
  • - chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 1019146bb36fde225ee93fdb173d12c91d96b834 (dependabot[bot])
  • - chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 7f855dfe8a1176d41808451aa0e8ab7b11664f03 (dependabot[bot])
  • - chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 3aa1b742b9228219378ce3d1b978d8d9e30547cd (dependabot[bot])
  • - fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 378ceacd9ce239e5b3de1e7ce7c55cf18e16f69b (Matheus Pimenta)
  • - fix(downloader): order DiskCache.Get checks for overlayfs empty dirs 6620fec5d19f6c86425501ee64f8cb8a8fb3fa3e (Sumit Solanki)
  • - Additional logging for ownership verification in dry-run mode 6d5b5aab32be039f8f56b0c497a7f4af28ce21f0 (Evans Mungai)
  • bump golang.org/x/crypto from 0.54.0 to 0.55.0

fixes (14)

  • * fix(loader): do not drop values files ending at a 4096-byte boundary by @locker95 in https://github.com/helm/helm/pull/32525
  • * fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test by @Mentigen in https://github.com/helm/helm/pull/32485
  • * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings by @ruslan-shaydullin in https://github.com/helm/helm/pull/32281
  • * fix(template): regression - route registry messages to stderr in template and show by @amarkdotdev in https://github.com/helm/helm/pull/32217
  • - fix: pass registry client to downloader.Manager in upgrade 0604d8fb1ee8ea172604cb739c93ea8d5ad068c6 (Gates Wang)
  • - Properly format the extra field in gzipped packages d887779b9b0eeb720672a7927479fc627e599c24 (Will Noble)
  • - fix panic on repeated IsReachable calls 1f7869c31f8d96638d238957b20a27d665001d88 (Mohammad Abdolirad)
  • - fix(provenance): check error return in Digest e095e690a8b3c31b6dbcb9af02f870cc41fbf18b (Sebastien Tardif)
  • - fix: skip non-Pod test hooks in GetPodLogs 1a1ec6e3cc052f1358ff668eeb439acd3f8e60c1 (Gregory Man)
  • - fix(kube): always propagate context.Canceled in WaitForDelete 5e09ee78ee5861b857a3526a2fd1ddf2f73950e2 (Terry Howe)
  • - fix(kube): prevent spurious early exit in WaitForDelete during informer sync 4e24ee41a436889a2542a008eaa0ecab8332a1eb (Terry Howe)
  • - fix(version): avoid false range detection on prerelease x/X 740174a2b12074f7ca506ff330a918a4ff335c39 (Benoit Tigeot)
  • - fix(version): version range || can has no space b79d7f18813796f101f66eff6c513ded25edf0ad (Benoit Tigeot)
  • - fix: prevent warning when using version range constraints 1e145ee2b243ef97bce0622cf55da8aa17ebb65f (Benoit Tigeot)

additions (4)

  • * feat: Add duration functions by @aeroyorch in https://github.com/helm/helm/pull/31695
  • * feat(rollback): add --description flag to provide rollback reason by @biagiopietro in https://github.com/helm/helm/pull/31580
  • - feat: report in debug the version we select with version range arg bf78b876c74ee4359a6cebb54e0b97183cdfe129 (Benoit Tigeot)
  • - feat(history): add rollback revision column to helm history output 300f71b1ebb1b383241a1806a813c6f30a8ff382 (MrJack)

constraints (1)

  • - refactor(rollback): validate description length before cluster reachability check 91520a78063582ab8265d9364815665f688deebc (MrJack)

defaults (1)

  • * refactor: lower resync period from one hour to 3 minutes by @AustinAbro321 in https://github.com/helm/helm/pull/31944

renames (1)

  • - Renamed flag from show-rollback to show-rollback-revision d097d882d473b42c7460d0be674138a3b52c08da (MrJack)
Add Helm to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Helm releases →