A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.
Action needed (1)
securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.
Check if affected (2)
securityhighPlugin verification when
.is missingprov Applies if you use plugins.
GHSA-q5jf-9vfq-h4h7 covers a fix for plugin verification that fails open when
.is missing, allowing unsigned plugin installation.prov securityhighPlugin metadata version path traversal
Applies if you use plugins.
GHSA-vmx8-mqv2-9gmg covers a fix for path traversal in plugin metadata versions that enables arbitrary file writes outside the Helm plugin directory.