Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: HelmClear ×

Helmv4.2.4Kubernetes CoreAug 13, 2026

ACTION 2OTHER 9View full analysis

A maintenance release with correctness fixes and dependency updates tied to GO advisories. The changes affect Helm users through both general fixes and updated Go dependencies.

Action needed (2)

securitymediumThe go.opentelemetry.io/otel dependency upgrade for GO-2026-5158
go.opentelemetry.io/otel was upgraded to v1.44.0 for advisory GO-2026-5158.
securityThe google.golang.org/grpc dependency upgrade for GO-2026-6061
google.golang.org/grpc was upgraded from 1.80.0 to 1.82.1 for advisory GO-2026-6061.

Source ↗

Helmv3.21.3Kubernetes CoreJul 9, 2026

ACTION 1OTHER 1View full analysis

This release includes a security-related dependency cleanup and a dependency update. The github.com/containerd/containerd dependency moves from 1.7.32 to 1.7.33.

Action needed (1)

securityThe containerd v1 dependency, removed
The containerd v1 dependency is removed in Helm v3.21.3 to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.

Source ↗

Helmv4.2.3Kubernetes CoreJul 9, 2026

OTHER 1View full analysis

Helm v4.2.3 is a maintenance release that updates the third-party dependency golang.org/x/crypto from 0.53.0 to 0.54.0. The remaining release content concerns release navigation and a general upgrade recommendation.

Source ↗

Helmv3.21.2Kubernetes CoreJun 20, 2026

OTHER 1View full analysis

Helm v3.21.2 is a patch release that updates its Kubernetes client-library dependency set to v1.36. The release concerns compatibility with the expected Kubernetes v1.36 libraries, including client-go and related components.

Source ↗

Helmv4.2.2Kubernetes CoreJun 17, 2026

OTHER 1View full analysis

This release includes an operator-facing correctness fix in Helm. The remaining release-note material does not describe additional included changes.

Source ↗

Helmv4.2.1Kubernetes CoreJun 12, 2026

ACTION 1OTHER 11View full analysis

Helm v4.2.1 is a maintenance release with correctness fixes and dependency updates. It includes an update to golang.org/x/net that addresses GO-2026-5026.

Action needed (1)

securitycriticalThe golang.org/x/net dependency update for GO-2026-5026
Helm v4.2.1 updates golang.org/x/net to v0.55.0 to address GO-2026-5026.

Source ↗

Helmv3.21.1Kubernetes CoreJun 12, 2026

ACTION 1OTHER 17View full analysis

Helm v3.21.1 includes dependency and toolchain updates alongside fixes for correctness issues. The disclosed dependency update affects releases using golang.org/x/net.

Action needed (1)

securitycriticalThe golang.org/x/net dependency, updated for GO-2026-5026
Helm v3.21.1 bumps golang.org/x/net to v0.55.0 to address GO-2026-5026.

Source ↗

Helmv3.21.0Kubernetes CoreMay 14, 2026

ACTION 1OTHER 10View full analysis

Helm v3.21.0 is a maintenance release with dependency updates and fixes to chart and OCI handling. It also includes a security fix in the opentelemetry packages.

Action needed (1)

securityThe opentelemetry packages, upgraded for CVE patches
Helm v3.21.0 upgrades the opentelemetry packages to patch CVEs.

Source ↗

Helmv4.2.0Kubernetes CoreMay 14, 2026

ACTION 1CHECK 1PLAN 1OTHER 68View full analysis

A feature and maintenance release with new template and CLI capabilities, dependency updates, flag deprecations, and numerous correctness fixes. It also includes security fixes for plugin path traversal and GO-2026-4394.

Action needed (1)

securityhighgo.opentelemetry.io/otel/sdk update for GO-2026-4394
Helm v4.2.0 updates go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394.

Check if affected (1)

securityPlugin version path traversal fix
Applies if you use the Plugin extension.
Plugin version handling fixes a path traversal issue. The fix ships in Helm v4.2.0.

Plan ahead (1)

deprecatedThe --hide-notes and --render-subchart-notes flags, deprecated
Applies if you use --hide-notes or --render-subchart-notes.
The template command deprecates both flags in Helm v4.2.0.

Source ↗

Helmv3.20.2Kubernetes CoreApr 9, 2026

CHECK 1View full analysis

A security maintenance release corrects a Helm Chart extraction defect tied to GHSA-hr2v-4r36-88hr. The changelog also contains a duplicate mention of this advisory-backed fix.

Check if affected (1)

securitymediumGHSA-hr2v-4r36-88hr: Helm Chart extraction output directory collapse
Applies if you use Helm Chart extraction.
This release corrects the Helm Chart extraction output directory collapse caused by a dot-segment in Chart.yaml name. The fix addresses GHSA-hr2v-4r36-88hr.

Source ↗

Helmv4.1.4Kubernetes CoreApr 9, 2026

ACTION 1CHECK 2OTHER 1View full analysis

A maintenance release with security fixes affecting Helm plugins. It also changes plugin-load error handling in the CLI and getter paths.

Action needed (1)

securitymediumGHSA-hr2v-4r36-88hr security fix
GHSA-hr2v-4r36-88hr is addressed in this release.

Check if affected (2)

securityhighPlugin verification when .prov is missing
Applies if you use plugins.
GHSA-q5jf-9vfq-h4h7 covers a fix for plugin verification that fails open when .prov is missing, allowing unsigned plugin installation.
securityhighPlugin metadata version path traversal
Applies if you use plugins.
GHSA-vmx8-mqv2-9gmg covers a fix for path traversal in plugin metadata versions that enables arbitrary file writes outside the Helm plugin directory.

Source ↗

Helmv3.20.1Kubernetes CoreMar 12, 2026

OTHER 3View full analysis

Helm v3.20.1 fixes preservation of user-provided nil values in charts with empty maps or no default values, and corrects OCI references that combine a tag and digest. It also updates the Kubernetes dependency group.

Source ↗

Helmv4.1.3Kubernetes CoreMar 11, 2026

ACTION 1OTHER 13View full analysis

Helm v4.1.3 is primarily a maintenance release with defect corrections, dependency updates, and a change that aligns defaults. The explicitly identified security-related change updates the OpenTelemetry SDK for GO-2026-4394.

Action needed (1)

securityhighThe go.opentelemetry.io/otel/sdk dependency update for GO-2026-4394
The go.opentelemetry.io/otel/sdk dependency was updated to v1.40.0 for GO-2026-4394 in Helm v4.1.3.

Source ↗

Helmv4.1.1Kubernetes CoreFeb 9, 2026

OTHER 4View full analysis

Helm v4.1.1 is a correctness-fix release. The recorded note tail points to fixes for waiting context options, failed-resource handling in kstatus, resource matching behavior, and nil elements during slice copying.

Source ↗

Helmv3.20.0Kubernetes CoreJan 21, 2026

ACTION 1OTHER 44View full analysis

A maintenance release with dependency and toolchain updates, several defect corrections, and a new repository timeout flag. The pkg/registry login option for passing TLS configuration in memory has been removed.

Action needed (1)

breakingThe pkg/registry in-memory TLS configuration login option, removed
The pkg/registry login option for passing TLS configuration in memory is reverted and does not ship in this release.

Source ↗

Helmv4.1.0Kubernetes CoreJan 21, 2026

OTHER 49View full analysis

Helm v4.1.0 adds CLI and SDK capabilities and changes waiting and dependency behavior. It also corrects several defects and updates dependencies, with no security advisories or explicitly described vulnerabilities in the release information.

Source ↗

Helmv3.19.5Kubernetes CoreJan 15, 2026

OTHER 2View full analysis

Helm v3.19.5 is a small operator-focused bug-fix release. No security changes are disclosed.

Source ↗

Helmv4.0.5Kubernetes CoreJan 14, 2026

OTHER 10View full analysis

Helm v4.0.5 is a correctness-fix release covering commands, plugins, dependency handling, watching, rollback, and SDK environment handling. The release also includes a new SDK environment exposure change.

Source ↗

Browse by month