Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 5 commits
- 7 files changed
- 5 contributors
Commits on Aug 13, 2026
-
fix(engine): prevent Files.Lines panic on empty file
Files.Lines guards against a nil entry but an empty file inside a chart is stored as a non-nil zero-length byte slice, so the trailing newline check indexes s[-1] and panics. The engine recovers the panic into a render error, making every template/install/upgrade/lint that references the file fail. Extend the guard to len(f[path]) == 0 and return an empty slice, matching the behaviour for missing files. Fixes #32279 Signed-off-by: Mahesh Sadupalli <mahesh.sadupalli@gmail.com> (cherry picked from commit c02a9ae)
-
fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932
Backport of the openpgp migration already merged to main (7c9176a) to dev-v3. golang.org/x/crypto/openpgp is frozen and flagged by govulncheck as GO-2026-5932 with no fixed release, leaving the govulncheck check red on every Go PR targeting dev-v3. Replace it with the maintained drop-in fork github.com/ProtonMail/go-crypto in pkg/provenance, the only consumer on this branch. The only API difference is openpgp.CheckDetachedSignature, which now takes an io.Reader and a *packet.Config. Pin the indirect github.com/cloudflare/circl at v1.6.3, as v1.6.2 pulled in by default is itself flagged (GO-2026-4550, fixed in v1.6.3). Also backport the mixed RSA/ed25519 keyring sign/verify regression test from main, adapted to the v3 Signatory API, since keyrings with modern key algorithms are the main behavioral surface of this swap. govulncheck ./... now reports 0 vulnerabilities. Fixes #32361 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Karan V <karanvknarayanan@gmail.com> (cherry picked from commit bd392c6)
-
fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158
backport of #32521 see https://pkg.go.dev/vuln/GO-2026-5158 Signed-off-by: Scott Rigby <scott@r6by.com> (cherry picked from commit e77b253)
-
[dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-20…
…26-6061 backport of #32450 updated with: ``` go get google.golang.org/grpc@v1.82.1 go mod tidy ``` example actions failure: https://github.com/helm/helm/actions/runs/31733009013/job/94557780520 ``` Vulnerability #1: GO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc More info: https://pkg.go.dev/vuln/GO-2026-6061 Module: google.golang.org/grpc Found in: google.golang.org/grpc@v1.80.0 Fixed in: google.golang.org/grpc@v1.82.1 Example traces found: Error: #1: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Close Error: #2: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Header Error: #3: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Read Error: #4: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.RecvCompress Error: #5: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.TrailersOnly Error: #6: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.ClientStream.Write Error: #7: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.NewHTTP2Client Error: #8: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.Stream.ReadMessageHeader Error: #9: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.Close Error: #10: pkg/action/lazyclient.go:49:17: action.lazyClient.init calls sync.Once.Do, which eventually calls transport.http2Client.GracefulClose Error: #11: pkg/repo/repotest/server.go:128:32: repotest.NewOCIServer calls registry.NewRegistry, which eventually calls transport.http2Client.NewStream ``` Signed-off-by: Scott Rigby <scott@r6by.com> (cherry picked from commit 79062a6)
-
chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. - [Commits](golang/crypto@v0.53.0...v0.54.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 2c24490)
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v3.21.3...v3.21.4