Skip to content

build(deps): Bump the all-go-mod-patch-and-minor group across 1 directory with 4 updates#1033

Merged
github-actions[bot] merged 1 commit intomainfrom
dependabot/go_modules/all-go-mod-patch-and-minor-c64d7d6140
Apr 9, 2026
Merged

build(deps): Bump the all-go-mod-patch-and-minor group across 1 directory with 4 updates#1033
github-actions[bot] merged 1 commit intomainfrom
dependabot/go_modules/all-go-mod-patch-and-minor-c64d7d6140

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 9, 2026

Bumps the all-go-mod-patch-and-minor group with 4 updates in the / directory: github.com/aws/aws-sdk-go-v2/service/ecr, helm.sh/helm/v4, k8s.io/apimachinery and sigs.k8s.io/controller-runtime.

Updates github.com/aws/aws-sdk-go-v2/service/ecr from 1.56.2 to 1.57.0

Commits

Updates helm.sh/helm/v4 from 4.1.3 to 4.1.4

Release notes

Sourced from helm.sh/helm/v4's releases.

Helm v4.1.4 is a security fix patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
  • GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
  • GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

A big thank you to the reporters of these issues (@​maru1009, @​1seal).

Installation and Upgrading

Download Helm v4.1.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Plugin missing provenance bypass 05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)
  • fix: Chart dot-name path bug 4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)
  • ignore error plugin loads (cli, getter) 25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)
  • fix: Plugin version path traversal 36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)
Commits
  • 05fa379 fix: Plugin missing provenance bypass
  • 4e7994d fix: Chart dot-name path bug
  • 2581943 ignore error plugin loads (cli, getter)
  • 36c8539 fix: Plugin version path traversal
  • c61e086 fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow
  • See full diff in compare view

Updates k8s.io/apimachinery from 0.35.1 to 0.35.3

Commits

Updates sigs.k8s.io/controller-runtime from 0.23.1 to 0.23.3

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.23.3

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.2...v0.23.3

v0.23.2

What's Changed

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.1...v0.23.2

Commits
  • f9589b9 Merge pull request #3469 from k8s-infra-cherrypick-robot/cherry-pick-3468-to-...
  • 25615ad Ensure DefaulterRemoveUnknownOrOmitableFields is still working even if object...
  • 8122a62 Merge pull request #3467 from k8s-infra-cherrypick-robot/cherry-pick-3463-to-...
  • 35093c6 Reduce memory usage of default webhooks
  • 4dbfa5c [release-0.23] 🐛 Fix fake client's SSA status patch resource version check (#...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…tory with 4 updates

Bumps the all-go-mod-patch-and-minor group with 4 updates in the / directory: [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2), [helm.sh/helm/v4](https://github.com/helm/helm), [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) and [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime).


Updates `github.com/aws/aws-sdk-go-v2/service/ecr` from 1.56.2 to 1.57.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.56.2...service/s3/v1.57.0)

Updates `helm.sh/helm/v4` from 4.1.3 to 4.1.4
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v4.1.3...v4.1.4)

Updates `k8s.io/apimachinery` from 0.35.1 to 0.35.3
- [Commits](kubernetes/apimachinery@v0.35.1...v0.35.3)

Updates `sigs.k8s.io/controller-runtime` from 0.23.1 to 0.23.3
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.23.1...v0.23.3)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: helm.sh/helm/v4
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-mod-patch-and-minor
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.23.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-mod-patch-and-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 9, 2026
@github-actions github-actions bot enabled auto-merge (squash) April 9, 2026 10:31
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 9, 2026

Unit test results

129 tests  ±0   129 ✅ ±0   0s ⏱️ ±0s
 27 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit 987f5aa. ± Comparison against base commit 71ccf19.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 9, 2026

e2e test results

50 tests  ±0   50 ✅ ±0   3m 45s ⏱️ +34s
 2 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 987f5aa. ± Comparison against base commit 71ccf19.

@github-actions github-actions bot merged commit c9c1991 into main Apr 9, 2026
19 checks passed
@github-actions github-actions bot deleted the dependabot/go_modules/all-go-mod-patch-and-minor-c64d7d6140 branch April 9, 2026 10:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant