Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: HelmClear ×

Helmv4.2.0Kubernetes CoreMay 14, 2026

ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394
Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

securityPlugin version path traversal fix
Applies if you use the Plugin extension.
Plugin version handling fixes a path traversal issue. The fix ships in Helm v4.2.0.

Plan ahead (1)

deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated
Applies if you use --hide-notes or --render-subchart-notes.
The template command deprecates both flags in Helm v4.2.0.

Source ↗

Helmv3.20.2Kubernetes CoreApr 9, 2026

CHECK 1View full analysis

A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.

Check if affected (1)

securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.
This release corrects the Helm Chart extraction output directory collapse caused by a dot-segment in Chart.yaml name. The fix addresses GHSA-hr2v-4r36-88hr.

Source ↗

Helmv4.1.4Kubernetes CoreApr 9, 2026

ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

securityhighPlugin verification when .prov is missing
Applies if you use plugins.
GHSA-q5jf-9vfq-h4h7 covers a fix for plugin verification that fails open when .prov is missing, allowing unsigned plugin installation.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
GHSA-vmx8-mqv2-9gmg covers a fix for path traversal in plugin metadata versions that enables arbitrary file writes outside the Helm plugin directory.

Source ↗

Browse by month