AI-analyzed release notes for CNCF graduated and incubating projects.
A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.
Check if affected (1)
securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.
This release corrects the Helm Chart extraction output directory collapse caused by a dot-segment in Chart. name. The fix addresses GHSA-hr2v-4r36-88hr.
A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.
Action needed (1)
securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.
Check if affected (2)
securityhighPlugin verification when . is missing
Applies if you use plugins.
GHSA-q5jf-9vfq-h4h7 covers a fix for plugin verification that fails open when . is missing, allowing unsigned plugin installation.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
GHSA-vmx8-mqv2-9gmg covers a fix for path traversal in plugin metadata versions that enables arbitrary file writes outside the Helm plugin directory.
