[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/labstack/echo/v4	v4.15.1 → v4.16.2
github.com/labstack/echo/v5	v5.1.0 → v5.4.2
github.com/minio/minio-go/v7	v7.0.100 → v7.4.1
helm.sh/helm/v3	v3.20.2 → v3.22.1
helm.sh/helm/v4	v4.1.4 → v4.3.1
k8s.io/api	v0.35.3 → v0.37.1
k8s.io/apiextensions-apiserver	v0.35.3 → v0.37.1
k8s.io/apimachinery	v0.35.3 → v0.37.1
k8s.io/cli-runtime	v0.35.3 → v0.37.1
k8s.io/client-go	v0.35.3 → v0.37.1
sigs.k8s.io/controller-runtime	v0.23.3 → v0.25.2

---

Release Notes

labstack/echo (github.com/labstack/echo/v4)

v4.16.2

Compare Source

Fixes

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #​3188, backport of #​3138, with credit to @​Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #​3189, backport of #​3135, with credit to @​hoangtaiki.
• Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #​3149, thanks to @​orinnz; backport of the existing v5 validation in #​3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Compare Source

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
• Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
• Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

Behavior to review when upgrading

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

Other changes

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @​Duodum, @​irisitymichaelgrundberg, @​q490107865, @​Hama1cco, @​jakezwang and @​Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

Full changelog: labstack/echo@v4.16.0...v4.16.1

v4.16.0

Compare Source

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

• Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. the new Echo#SchemeExtractor field selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
• JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
• MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
• Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
• Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr
• Dependencies: update golang.org/x/text to v0.40.0 (GO-2026-5970).

Client IP address (no code change in v4)

Without Echo#IPExtractor, Context.RealIP() in v4 trusts the X-Forwarded-For and X-Real-IP headers from any client, so the rate limiter can be bypassed and the Proxy middleware forwards a spoofed X-Real-IP (GHSA-246p-cpwv-v3jq, GHSA-99jh-6h7p-pp36). Changing this default in v4 would put all clients behind a proxy into one rate-limit bucket, so v4 keeps it. Set an extractor that matches your deployment:

e.IPExtractor = echo.ExtractIPDirect()        // no proxy in front of the app
e.IPExtractor = echo.ExtractIPFromXFFHeader() // behind proxies in private networks that set X-Forwarded-For
// behind a proxy with public addresses (e.g. a CDN), also trust its ranges:
// e.IPExtractor = echo.ExtractIPFromXFFHeader(echo.TrustIPRange(cdnRange))

v5 uses the direct peer address by default since v5.1.0.

Behavior changes to check before upgrading

• Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges:

  _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
  _, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
  e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))

  Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. echo.LegacySchemeExtractor() restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set RemoteAddr to the client's address also make X-Forwarded-Proto ignored (or, if they take it from a header, spoofable).
• Trusted proxies must set X-Forwarded-Proto. A proxy on a trusted address that passes the client's X-Forwarded-Proto through (for example nginx without proxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalid X-Forwarded-Proto value now results in http instead of falling back to the other scheme headers.
• Your own tests. httptest.NewRequest sets RemoteAddr to 192.0.2.1:1234, which is not trusted, so tests that set X-Forwarded-Proto now see http. Set req.RemoteAddr = "10.0.0.1:1234" or use e.SchemeExtractor = echo.LegacySchemeExtractor() in such tests.
• Proxy middleware headers. X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme are no longer forwarded to the upstream; X-Forwarded-Proto carries the scheme.
• MethodOverride. Overriding a POST to GET (for example with X-HTTP-Method-Override: GET to send a long query in a POST body) is no longer done; such requests keep the POST method.
• Static files. Paths with a double slash or dot segment (for example /assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example %2C, %40 or lowercase hex like %c3%a9) unless StaticConfig.EnablePathUnescaping is set; Echo.Static has behaved this way since v4.15.4. With StaticConfig.EnablePathUnescaping or Echo#EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
• JSONP. Context.JSONP returns an error for callbacks that are not JavaScript identifiers.

Documentation

• Static middleware: when registered with Echo#Use it runs before route and group middleware, so route guards do not protect the files it serves.

---

If your company depends on Echo, please consider sponsoring it.

v4.15.4

Compare Source

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3016, released in v5.2.1). Thanks to @​a-tt-om and @​oran-gugu for reporting.

---

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

Full Changelog: labstack/echo@v4.15.3...v4.15.4

v4.15.3: - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)

Compare Source

Security

• fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in #​3011

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3009, released in v5.2.0). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Full Changelog: labstack/echo@v4.15.2...v4.15.3

v4.15.2: - Context.Scheme() header validation

Compare Source

Security

• Context.Scheme() should validate values taken from header by @​aldas in #​2962

Thanks to @​shblue21 for reporting this issue.

Full Changelog: labstack/echo@v4.15.1...v4.15.2

minio/minio-go (github.com/minio/minio-go/v7)

v7.4.1

Compare Source

What's Changed

• fix: abort failed uploads even when the caller cancels by @​harshavardhana in #​2318

Full Changelog: minio/minio-go@v7.4.0...v7.4.1

v7.4.0

Compare Source

Go 1.26 or later is now required. Go 1.25 is out of support, and golang.org/x/net v0.60.0 (the fix for GO-2026-6603, 6610, 6611, 6612 and 6617) requires Go 1.26 (#​2313).

What's Changed

• feat(rdma): stream a PUT over RDMA instead of pinning the whole object by @​harshavardhana in #​2284
• fix(rdma): report the transferred size from Stat on an RDMA GET by @​harshavardhana in #​2285
• feat: add ListUnsorted() for the ?unsorted=true listing extension by @​harshavardhana in #​2286
• fix(s3utils): reject path-shaped bucket names explicitly by @​zveinn in #​2287
• fix: use rerr instead of err in EOF check during multipart stream upload by @​jiuker in #​2288
• fix: swap Owner XML tags so DisplayName/ID parse correctly by @​jiuker in #​2289
• fix: race on shared checksum hasher in parallel multipart upload by @​jiuker in #​2290
• fix: typos in S3 Express endpoint and randString alphabet by @​jiuker in #​2291
• update minio-cpp version v0.7.0 by @​harshavardhana in #​2292
• fix: keep opts.Internal on CompleteMultipartUpload by @​harshavardhana in #​2297
• fix: select S3 Express zonal endpoint from the bucket's AZ by @​jiuker in #​2293
• Return CopyObject checksums in UploadInfo by @​Vonng in #​2295
• feat: support dualstack S3 Express endpoints by @​jiuker in #​2298
• Allow setting custom upload limits by @​klauspost in #​2299
• signer: fix streaming signer to include Content-Type in SignedHeaders (fixes #​2300) by @​jiuker in #​2301
• fix: honor the caller's TLS trust on the RDMA path by @​harshavardhana in #​2302
• Report listing checksums consistently, add WithRestoreStatus by @​klauspost in #​2303
• Fix windows CI by @​klauspost in #​2307
• fix CopyObject swallowing errors embedded in a 200 OK response by @​huanghaoyuanhhy in #​2306
• fix: trim whitespace-only Region in error responses before header fallback by @​cipherprofessor in #​2308
• credentials: send the requested AssumeRole DurationSeconds as is by @​prakashsvmx in #​2310
• ci: test on Go 1.26/1.27 and bump golang.org/x/net to v0.60.0 by @​harshavardhana in #​2313
• docs: remove broken Slack badges by @​auroraxo in #​2304
• credentials: allow NewKubernetesIdentity to read a projected token file by @​harshavardhana in #​2312
• fix: trim whitespace from bucket location by @​vigneshakaviki in #​2274
• docs: fix 'Recieved' typo in CancelBucketReplicationResync by @​harshavardhana in #​2314
• compose: allow parallel upload-part-copy with NumThreads by @​harshavardhana in #​2316
• fix: send RetainUntilDate in UTC by @​harshavardhana in #​2315
• get: add opt-in parallel range GET via ParallelWorkers by @​harshavardhana in #​2317

New Contributors

• @​Vonng made their first contribution in #​2295
• @​cipherprofessor made their first contribution in #​2308
• @​prakashsvmx made their first contribution in #​2310
• @​auroraxo made their first contribution in #​2304
• @​vigneshakaviki made their first contribution in #​2274

Full Changelog: minio/minio-go@v7.3.0...v7.4.0

v7.3.0

Compare Source

What's Changed

• fix: surface UploadPartCopy part checksum in CopyPartResult by @​allanrogerr in #​2245
• fix: enable TraceOn will cause OOM when putting a large object by @​jiuker in #​2251
• fix: Stat() returns Size 0 for RDMA GET objects by @​harshavardhana in #​2263
• fix: accept endpoint URLs that already include a scheme by @​allanrogerr in #​2262
• feat: make IAM credentials expiry window customizable by @​allanrogerr in #​2261
• feat: expose response headers via ObjectInfo.Headers from StatObject/GetObject by @​allanrogerr in #​2259
• fix: honor io.Seeker contract in Object.Seek by @​allanrogerr in #​2258
• fix: treat HTTP 202 Accepted as success in executeMethod by @​allanrogerr in #​2252
• Mark PutObjectFanOut as being deprecated by @​klauspost in #​2265
• fix: disable retries for non-seekable PutObject readers by @​allanrogerr in #​2253
• feat: add SetCannedBucketPolicy by @​jiuker in #​2248
• fix: add guard check for avoiding potential panic by @​ProjectMutilation in #​2268
• fix: always emit Filter or Prefix in lifecycle rule XML by @​allanrogerr in #​2254
• fix: add UserMetadataStripped to list results by @​allanrogerr in #​2256
• feat: add AWS SSO credential provider to FileAWSCredentials by @​allanrogerr in #​2257
• fix: Object is not traced when the request returns an error by @​jiuker in #​2249
• feat: add fetchOwner options for listV2 by @​jiuker in #​2264
• Update regex pattern allowing for optional space before expiry-date by @​pgreenland in #​2224
• fix: getObject with range request and then stat would not return the correct range size by @​jiuker in #​2267
• ci: add Dependabot for GitHub Actions, pin RDMA tag by @​allanrogerr in #​2276
• rdma: reject buffers over the 4 GiB cuObject registration limit by @​harshavardhana in #​2278
• build(deps): bump the actions group with 2 updates by @​dependabot[bot] in #​2279
• Add end-to-end checksum verification on GetObject by @​jiuker in #​2272
• fix: declare aws-chunked content encoding on streaming uploads by @​allanrogerr in #​2277
• fix: return delete-marker ObjectInfo from StatObject alongside the error by @​allanrogerr in #​2273
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2280
• Add AIStor Lifecycle Compression by @​klauspost in #​2281
• feat: propagate caller context through credential providers by @​allanrogerr in #​2275
• rdma: build against libs3rdma, and fix the size guard's off-by-one by @​harshavardhana in #​2283

New Contributors

• @​allanrogerr made their first contribution in #​2245
• @​ProjectMutilation made their first contribution in #​2268
• @​pgreenland made their first contribution in #​2224

Full Changelog: minio/minio-go@v7.2.1...v7.3.0

v7.2.1

Compare Source

v7.2.0

Compare Source

What's Changed

• Use go tool for ci-lint check by @​klauspost in #​2229
• Rename github.com/go-ini/ini to gopkg.in/ini.v1 by @​ramondeklein in #​2232
• Add RDMA / NVIDIA GPU Direct Storage support by @​harshavardhana in #​2233

Full Changelog: minio/minio-go@v7.1.0...v7.2.0

v7.1.0

Compare Source

What's Changed

• GetObjectAttributes: Add missing checksum & type by @​klauspost in #​2217
• support x-minio-source-time header for getobject / statObject by @​jiuker in #​2219
• Add new AWS checksums by @​klauspost in #​2221

Full Changelog: minio/minio-go@v7.0.100...v7.1.0

helm/helm (helm.sh/helm/v3)

v3.22.1: Helm v3.22.1

Compare Source

Helm v3.22.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• Bumps dependencies to remove Go package vulnerabilities
• Updates the k8s.io Go packages

Installation and Upgrading

Download Helm v3.22.1. The common platform binaries are here:

• MacOS amd64 (checksum / cf850a81b908f8eef0331e6b18776da2767bcac639ca84472311dad20008495c)
• MacOS arm64 (checksum / e73da8a0b0d5193774fdff17ce6319c7436bb22ee229b45fd64f3c40368c753a)
• Linux amd64 (checksum / 896cf63684a42a723d61c980369d6e588330927deb13676ca0d85006dd6da0ea)
• Linux arm (checksum / a1563d16cf9537db798116d5647ad0ef8cf963fa7cbbe24d8db534250273cccc)
• Linux arm64 (checksum / 4c29e286b279d170fa048ddfc3e4e83dcd069ca9c52102766ba672d7149e694d)
• Linux i386 (checksum / 67b35ee3d31fa93b7ca5884e71beef3c3b5d9bab46ead792081ed2b6131d73c5)
• Linux ppc64le (checksum / 48a9711b69f0b63504f710ba18766dd5f5424fe380e67304aa3c89e1c0b97b5c)
• Linux s390x (checksum / ef039296b433a0a6965fdf55f4ee0ad50e3d94bb70a77e4896309406c9bc8fab)
• Linux riscv64 (checksum / 960ca50df1eb70a50a8cb90fc67573cf047239fc0b72f63514a534e4f2e2ef32)
• Windows amd64 (checksum / 32ce9f4509b81782c9740898c43946e1f97c4d93ec5d10222c9b6eeec21ea043)
• Windows arm64 (checksum / 10104b049309d4c751bca88254843e16edd84141411f63503f10845ea33cbd2f)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.3.2 and 3.22.2 are the next patch releases scheduled for November 11, 2026
• 4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

• chore(deps): bump github.com/distribution/distribution/v3 (#​32697) d6c1a0e (dependabot[bot])
• [v3] chore(deps): bump k8s.io group to v0.37.1 (#​32761) 2c7472f (Scott Rigby)
• [v3] chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace otlptracegrpc and otlptracehttp to v1.45.0 (#​32760) 8d91c8f (Scott Rigby)
• chore(deps): bump golang.org/x/net to v0.60.0 for GO-2026-6617 GO-2026-6612 GO-2026-6611 GO-2026-6610 GO-2026-6603 (#​32759) 13edc4f (Scott Rigby)

v3.22.0: Helm v3.22.0

Compare Source

Helm v3.22.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• primarily dependency updates and k8s-io group to 0.37.0

Installation and Upgrading

Download Helm v3.22.0. The common platform binaries are here:

• MacOS amd64 (checksum / bd1d09f316558dda23698527859600936fed1371021ce0f2272d66b2fdcfa69c)
• MacOS arm64 (checksum / 4c9982a6cdeb458b60258df66b55398ca5b19293f6877faffe2909ad6f23dfe0)
• Linux amd64 (checksum / 1e4ab49e429626cf6c6958d914248b78c9730803c2751b87627e171dc800e7bb)
• Linux arm (checksum / 695793765e2246824a7c859562886f79b1cc89d99420c89f940590440f7129ee)
• Linux arm64 (checksum / f14e804dfee240f55525b667488fe9adca349e63e00c9af634c0beb1421ac310)
• Linux i386 (checksum / b96b7a125cc7d38aa952a78b16e96d05426cd9791dd013be51ebab1c203d6729)
• Linux loong64 (checksum / BlobNotFoundThe specified blob does not exist.
  RequestId:8c31497a-101e-0042-27b6-404cb4000000
  Time:2026-09-09T23:55:30.1192401Z)
• Linux ppc64le (checksum / fa304f47163a19f4e275fe4e890465a8a80a6f26ce4772c6b1649355c995def1)
• Linux s390x (checksum / 3f2cfd73018dcb9c25814e89c5946a362a8b951d8cce03152138d8cb28abcbff)
• Linux riscv64 (checksum / 50f84d698daac65bded677c61db7138e082b23e667a3cabeff4fd2521614e498)
• Windows amd64 (checksum / 899615865726d39f9b245e71e848c5bf4adc7ed33a8c43ede660facb48151b43)
• Windows arm64 (checksum / 75a331a3b03d11aed6369bdf6a1f8f9d33635bc820de5cd6025a581292046805)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.3.1 and 3.22.1 are the next patch releases scheduled for October 14, 2026
• 4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

• chore(deps): bump the k8s-io group across 1 directory with 6 updates 144ca65 (dependabot[bot])
• bump version to 3.22 (#​32606) b5de8bb (Scott Rigby)
• fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#​32362) 9dbcb9f (kimsungmin1)
• chore(deps): bump the github-actions group across 1 directory with 4 updates (#​32575) 665ab55 (dependabot[bot])
• chore(deps): bump the k8s-io group with 7 updates (#​32573) 0841093 (dependabot[bot])
• chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#​32563) d0569c7 (dependabot[bot])
• chore(deps): bump the github-actions group across 1 directory with 4 updates (#​32557) bcbdb1e (dependabot[bot])
• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#​32554) 6cdcc8f (dependabot[bot])
• chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#​32542) 158719f (dependabot[bot])
• [dev-v3 backport] deps: bump google.golang.org/grpc@​v1.82.1 for GO-2026-6061 (#​32536) a442b8c (Scott Rigby)
• fix: bump go.opentelemetry.io/otel@​v1.44.0 for GO-2026-5158 (#​32535) adab0ef (Scott Rigby)
• chore(deps): bump the github-actions group with 4 updates (#​32524) c068b54 (dependabot[bot])
• chore(deps): bump the github-actions group with 4 updates 74271c4 (dependabot[bot])
• chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 1c50d2f (dependabot[bot])
• chore(deps): bump the github-actions group with 4 updates (#​32509) 8821540 (dependabot[bot])
• chore(deps): bump actions/stale in the github-actions group (#​32488) 05a2798 (dependabot[bot])
• chore(deps): bump ossf/scorecard-action in the github-actions group (#​32461) c27e757 (dependabot[bot])
• fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 bd392c6 (Karan V)
• chore(deps): bump the k8s-io group with 7 updates 66a6f56 (dependabot[bot])
• chore(deps): bump the github-actions group with 4 updates 7cd0125 (dependabot[bot])
• chore(deps): bump github/codeql-action/upload-sarif (#​32449) 79330fc (dependabot[bot])
• chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 (#​32446) b29c730 (dependabot[bot])
• chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 973bb34 (dependabot[bot])
• chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 e25efcf (dependabot[bot])
• chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 98e547f (dependabot[bot])
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#​32412) 7f4b72a (dependabot[bot])
• chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 (#​32381) 2cf1437 (dependabot[bot])
• chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#​32383) 270f73b (dependabot[bot])
• chore(deps): bump github/codeql-action/upload-sarif (#​32382) 9e3a010 (dependabot[bot])
• ci: auto-label PRs targeting dev-v3 (#​32340) c9ed0ca (Benoit Tigeot)
• chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#​32331) b842ddf (dependabot[bot])
• chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#​32332) f6047c9 (dependabot[bot])
• chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0 (#​32357) f2f6bf6 (dependabot[bot])
• chore(deps): bump actions/checkout from 4.2.2 to 7.0.0 (#​32368) 69f70a8 (dependabot[bot])
• chore(deps): bump actions/stale from 9.0.0 to 10.4.0 (#​32369) c95222a (dependabot[bot])
• chore(deps): bump actions/setup-go from 5.1.0 to 6.5.0 (#​32358) fc71f51 (dependabot[bot])
• chore(deps): bump github/codeql-action/upload-sarif (#​32360) 6596318 (dependabot[bot])
• chore(deps): bump github/codeql-action/init from 3.26.6 to 4.37.0 (#​32359) 5d9943c (dependabot[bot])
• chore(de

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 3am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: example/complete/go.sum

go: module github.com/minio/minio-go/v7@v7.4.1 requires go >= 1.26.0; switching to go1.26.10
go: downloading go1.26.10 (linux/amd64)
go: downloading github.com/minio/minio-go/v7 v7.4.1
go: downloading k8s.io/api v0.37.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/dustin/go-humanize v1.0.1
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/klauspost/compress v1.19.2
go: downloading github.com/klauspost/crc32 v1.3.0
go: downloading github.com/minio/crc64nvme v1.1.1
go: downloading github.com/minio/md5-simd v1.1.2
go: downloading github.com/zeebo/xxh3 v1.1.0
go: downloading go.yaml.in/yaml/v3 v3.0.5
go: downloading golang.org/x/net v0.60.0
go: downloading helm.sh/helm/v3 v3.20.2
go: downloading k8s.io/cli-runtime v0.35.3
go: downloading k8s.io/client-go v0.35.3
go: downloading k8s.io/apiextensions-apiserver v0.35.3
go: downloading k8s.io/apimachinery v0.37.1
go: downloading github.com/vmware-tanzu/velero v1.17.0
go: downloading sigs.k8s.io/controller-runtime v0.23.3
go: downloading github.com/labstack/echo/v4 v4.15.1
go: downloading k8s.io/klog/v2 v2.140.0
go: downloading golang.org/x/sys v0.48.0
go: downloading github.com/klauspost/cpuid/v2 v2.4.0
go: downloading gopkg.in/ini.v1 v1.67.3
go: downloading golang.org/x/crypto v0.57.0
go: downloading github.com/rs/xid v1.6.0
go: downloading github.com/tinylib/msgp v1.6.4
go: downloading github.com/joho/godotenv v1.5.1
go: downloading github.com/Masterminds/semver/v3 v3.5.0
go: downloading github.com/Masterminds/sprig/v3 v3.3.0
go: downloading github.com/gosuri/uitable v0.0.4
go: downloading github.com/pkg/errors v0.9.1
go: downloading golang.org/x/term v0.46.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading github.com/spf13/pflag v1.0.10
go: downloading github.com/spf13/cobra v1.10.2
go: downloading gopkg.in/evanphx/json-patch.v4 v4.13.0
go: downloading k8s.io/utils v0.0.0-20260626114624-be93311217bd
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading github.com/evanphx/json-patch/v5 v5.9.11
go: downloading github.com/evanphx/json-patch v5.9.11+incompatible
go: downloading github.com/labstack/gommon v0.4.2
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.4.2
go: downloading github.com/go-logr/logr v1.4.3
go: downloading github.com/philhofer/fwd v1.2.0
go: downloading golang.org/x/text v0.42.0
go: downloading dario.cat/mergo v1.0.1
go: downloading github.com/Masterminds/goutils v1.1.1
go: downloading github.com/huandu/xstrings v1.5.0
go: downloading github.com/mitchellh/copystructure v1.2.0
go: downloading github.com/shopspring/decimal v1.4.0
go: downloading github.com/spf13/cast v1.7.0
go: downloading github.com/fatih/color v1.19.0
go: downloading github.com/cyphar/filepath-securejoin v0.6.1
go: downloading github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
go: downloading github.com/BurntSushi/toml v1.6.0
go: downloading github.com/gobwas/glob v0.2.3
go: downloading github.com/hashicorp/go-multierror v1.1.1
go: downloading k8s.io/kubectl v0.35.1
go: downloading github.com/containerd/containerd v1.7.30
go: downloading github.com/opencontainers/image-spec v1.1.1
go: downloading oras.land/oras-go/v2 v2.6.0
go: downloading github.com/Masterminds/squirrel v1.5.4
go: downloading github.com/jmoiron/sqlx v1.4.0
go: downloading github.com/lib/pq v1.10.9
go: downloading github.com/rubenv/sql-migrate v1.8.1
go: downloading github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de
go: downloading github.com/moby/term v0.5.2
go: downloading github.com/google/gnostic-models v0.7.0
go: downloading go.yaml.in/yaml/v2 v2.4.4
go: downloading golang.org/x/sync v0.23.0
go: downloading sigs.k8s.io/kustomize/api v0.21.1
go: downloading sigs.k8s.io/kustomize/kyaml v0.21.1
go: downloading google.golang.org/protobuf v1.36.12
go: downloading github.com/inconshreveable/mousetrap v1.1.0
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
go: downloading github.com/peterbourgon/diskv v2.0.1+incompatible
go: downloading github.com/fxamacker/cbor/v2 v2.9.1
go: downloading golang.org/x/oauth2 v0.34.0
go: downloading golang.org/x/time v0.15.0
go: downloading github.com/mattn/go-colorable v0.1.15
go: downloading github.com/mattn/go-isatty v0.0.22
go: downloading github.com/valyala/fasttemplate v1.2.2
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/mitchellh/reflectwalk v1.0.2
go: downloading github.com/mattn/go-runewidth v0.0.24
go: downloading github.com/hashicorp/errwrap v1.1.0
go: downloading k8s.io/component-base v0.35.3
go: downloading github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f
go: downloading github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
go: downloading k8s.io/apiserver v0.35.3
go: downloading github.com/containerd/log v0.1.0
go: downloading github.com/containerd/platforms v0.2.1
go: downloading github.com/opencontainers/go-digest v1.0.0
go: downloading github.com/lann/builder v0.0.0-20180802200727-47ae307949d0
go: downloading github.com/go-gorp/gorp/v3 v3.1.0
go: downloading github.com/go-openapi/swag v0.27.1
go: downloading github.com/go-openapi/jsonreference v1.0.0
go: downloading github.com/google/btree v1.1.3
go: downloading github.com/x448/float16 v0.8.4
go: downloading github.com/valyala/bytebufferpool v1.0.0
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading github.com/clipperhouse/uax29/v2 v2.7.0
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/chai2010/gettext-go v1.0.2
go: downloading github.com/MakeNowJust/heredoc v1.0.0
go: downloading github.com/mitchellh/go-wordwrap v1.0.1
go: downloading github.com/russross/blackfriday/v2 v2.1.0
go: downloading github.com/containerd/errdefs v0.3.0
go: downloading google.golang.org/grpc v1.78.0
go: downloading github.com/sirupsen/logrus v1.10.2
go: downloading github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0
go: downloading github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c
go: downloading github.com/go-openapi/jsonpointer v1.0.0
go: downloading github.com/go-openapi/swag/cmdutils v0.27.1
go: downloading github.com/go-openapi/swag/conv v0.27.1
go: downloading github.com/go-openapi/swag/fileutils v0.27.1
go: downloading github.com/go-openapi/swag/jsonutils v0.27.1
go: downloading github.com/go-openapi/swag/loading v0.27.1
go: downloading github.com/go-openapi/swag/mangling v0.27.1
go: downloading github.com/go-openapi/swag/netutils v0.27.1
go: downloading github.com/go-openapi/swag/stringutils v0.27.1
go: downloading github.com/go-openapi/swag/typeutils v0.27.1
go: downloading github.com/go-openapi/swag/yamlutils v0.27.1
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading github.com/go-errors/errors v1.5.1
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409
go: downloading github.com/emicklei/go-restful/v3 v3.13.0
go: downloading github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00
go: downloading github.com/xlab/treeprint v1.2.0
go: downloading github.com/go-openapi/swag/pools v0.27.1
go: complete-example imports
	github.com/taking/kubemigrate/pkg/client/velero imports
	k8s.io/client-go/kubernetes/scheme imports
	k8s.io/api/autoscaling/v2beta1: cannot find module providing package k8s.io/api/autoscaling/v2beta1
go: complete-example imports
	github.com/taking/kubemigrate/pkg/client/velero imports
	k8s.io/client-go/kubernetes/scheme imports
	k8s.io/api/autoscaling/v2beta2: cannot find module providing package k8s.io/api/autoscaling/v2beta2
go: complete-example imports
	github.com/taking/kubemigrate/pkg/client/velero imports
	k8s.io/client-go/kubernetes/scheme imports
	k8s.io/api/scheduling/v1alpha1: cannot find module providing package k8s.io/api/scheduling/v1alpha1

File name: example/kubernetes/go.sum

go: module k8s.io/api@v0.37.1 requires go >= 1.26.0; switching to go1.26.10
go: downloading golang.org/x/net v0.57.0
go: downloading golang.org/x/term v0.45.0
go: downloading golang.org/x/crypto v0.54.0
go: downloading google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
go: downloading golang.org/x/sys v0.47.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading golang.org/x/text v0.40.0
go: kubernetes-example imports
	github.com/taking/kubemigrate/pkg/client/kubernetes imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1 imports
	k8s.io/api/autoscaling/v2beta1: cannot find module providing package k8s.io/api/autoscaling/v2beta1
go: kubernetes-example imports
	github.com/taking/kubemigrate/pkg/client/kubernetes imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2 imports
	k8s.io/api/autoscaling/v2beta2: cannot find module providing package k8s.io/api/autoscaling/v2beta2
go: kubernetes-example imports
	github.com/taking/kubemigrate/pkg/client/kubernetes imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1 imports
	k8s.io/api/scheduling/v1alpha1: cannot find module providing package k8s.io/api/scheduling/v1alpha1