RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Project: HelmClear ×
Helmv4.2.4Kubernetes CoreAug 13, 2026
ACTION 2OTHER 9View full analysis

A maintenance release with correctness fixes and dependency updates tied to GO advisories. The changes affect Helm users through both general fixes and updated Go dependencies.

Action needed (2)

  • securitymediumThe go.opentelemetry.io/otel dependency upgrade for GO-2026-5158

    go.opentelemetry.io/otel was upgraded to v1.44.0 for advisory GO-2026-5158.

  • securityThe google.golang.org/grpc dependency upgrade for GO-2026-6061

    google.golang.org/grpc was upgraded from 1.80.0 to 1.82.1 for advisory GO-2026-6061.

Source ↗
Helmv3.21.3Kubernetes CoreJul 9, 2026
ACTION 1OTHER 1View full analysis

This release includes a security-related dependency cleanup and a dependency update. The github.com/containerd/containerd dependency moves from 1.7.32 to 1.7.33.

Action needed (1)

  • securityThe containerd v1 dependency, removed

    The containerd v1 dependency is removed in Helm v3.21.3 to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.

Source ↗
Helmv4.2.1Kubernetes CoreJun 12, 2026
ACTION 1OTHER 11View full analysis

Helm v4.2.1 is a maintenance release with correctness fixes and dependency updates. It includes an update to golang.org/x/net that addresses GO-2026-5026.

Action needed (1)

  • securitycriticalThe golang.org/x/net dependency update for GO-2026-5026

    Helm v4.2.1 updates golang.org/x/net to v0.55.0 to address GO-2026-5026.

Source ↗
Helmv3.21.1Kubernetes CoreJun 12, 2026
ACTION 1OTHER 17View full analysis

Helm v3.21.1 includes dependency and toolchain updates alongside fixes for correctness issues. The disclosed dependency update affects releases using golang.org/x/net.

Action needed (1)

  • securitycriticalThe golang.org/x/net dependency, updated for GO-2026-5026

    Helm v3.21.1 bumps golang.org/x/net to v0.55.0 to address GO-2026-5026.

Source ↗
Helmv3.21.0Kubernetes CoreMay 14, 2026
ACTION 1OTHER 10View full analysis

Helm v3.21.0 is a maintenance release with dependency updates and fixes to chart and OCI handling. It also includes a security fix in the opentelemetry packages.

Action needed (1)

  • securityThe opentelemetry packages, upgraded for CVE patches

    Helm v3.21.0 upgrades the opentelemetry packages to patch CVEs.

Source ↗
Helmv4.2.0Kubernetes CoreMay 14, 2026
ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

  • securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394

    Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

  • securityPlugin version path traversal fix

    Applies if you use the Plugin extension.

    Plugin version handling fixes a path traversal issue. The fix ships in Helm v4.2.0.

Plan ahead (1)

  • deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated

    Applies if you use --hide-notes or --render-subchart-notes.

    The template command deprecates both flags in Helm v4.2.0.

Source ↗
Helmv4.1.4Kubernetes CoreApr 9, 2026
ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

  • securitymediumGHSA-hr2v-4r36-88hr security fix

    GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

  • securityhighPlugin verification when .prov is missing

    Applies if you use plugins.

    GHSA-q5jf-9vfq-h4h7 covers a fix for plugin verification that fails open when .prov is missing, allowing unsigned plugin installation.

  • securityhighPlugin metadata version path traversal

    Applies if you use plugins.

    GHSA-vmx8-mqv2-9gmg covers a fix for path traversal in plugin metadata versions that enables arbitrary file writes outside the Helm plugin directory.

Source ↗
Helmv4.1.3Kubernetes CoreMar 11, 2026
ACTION 1OTHER 13View full analysis

Helm v4.1.3 is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.

Action needed (1)

  • securityhighThe go.opentelemetry.io/otel/sdk dependency update for GO-2026-4394

    The go.opentelemetry.io/otel/sdk dependency was updated to v1.40.0 for GO-2026-4394 in Helm v4.1.3.

Source ↗
Helmv3.20.0Kubernetes CoreJan 21, 2026
ACTION 1OTHER 44View full analysis

A maintenance release with dependency and toolchain updates, several defect corrections, and a new repository timeout flag. The pkg/registry login option for passing TLS configuration in memory has been removed.

Action needed (1)

  • breakingThe pkg/registry in-memory TLS configuration login option, removed

    The pkg/registry login option for passing TLS configuration in memory is reverted and does not ship in this release.

Source ↗
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023