Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(deps): update module helm.sh/helm/v3 to v3.14.1 [security] (#2307)
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [helm.sh/helm/v3](https://togithub.com/helm/helm) | `v3.14.0` -> `v3.14.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. ### GitHub Vulnerability Alerts #### [CVE-2024-25620](https://togithub.com/helm/helm/security/advisories/GHSA-v53g-5gjp-272r) A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time. ### Impact When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. ### Patches This issue has been resolved in Helm v3.14.1. ### Workarounds Check all charts used by Helm for path changes in their name as found in the `Chart.yaml` file. This includes dependencies. ### Credits Disclosed by Dominykas Blyžė at Nearform Ltd. --- ### Release Notes <details> <summary>helm/helm (helm.sh/helm/v3)</summary> ### [`v3.14.1`](https://togithub.com/helm/helm/releases/tag/v3.14.1): Helm v3.14.1 [Compare Source](https://togithub.com/helm/helm/compare/v3.14.0...v3.14.1) Helm v3.14.1 is a security (patch) release. Users are strongly recommended to update to this release. A Helm contributor discovered a path traversal vulnerability when Helm saves a chart including at download time. [Dominykas Blyžė](https://togithub.com/dominykas) with [Nearform Ltd.](https://www.nearform.com/) discovered the vulnerability. #### Installation and Upgrading Download Helm v3.14.1. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.14.1-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-darwin-amd64.tar.gz.sha256sum) / 67928236b37c4e780b9fb5e614fb3b9aece90d60f0b1b4cb7406ee292c2dae3b) - [MacOS arm64](https://get.helm.sh/helm-v3.14.1-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-darwin-arm64.tar.gz.sha256sum) / 96468f927cc6efb4a2b92fd9419f40ed21d634af2f3e84fb8efa59526c7a003b) - [Linux amd64](https://get.helm.sh/helm-v3.14.1-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-linux-amd64.tar.gz.sha256sum) / 75496ea824f92305ff7d28af37f4af57536bf5138399c824dff997b9d239dd42) - [Linux arm](https://get.helm.sh/helm-v3.14.1-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-linux-arm.tar.gz.sha256sum) / f50c00c262b74435530e677bcec07637aaeda1ed92ef809b49581a4e6182cbbe) - [Linux arm64](https://get.helm.sh/helm-v3.14.1-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-linux-arm64.tar.gz.sha256sum) / f865b8ad4228fd0990bbc5b50615eb6cb9eb31c9a9ca7238401ed897bbbe9033) - [Linux i386](https://get.helm.sh/helm-v3.14.1-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-linux-386.tar.gz.sha256sum) / 3c94ed0601e0e62c195a7e9b75262b18128c8284662aa0e080bb548dc6d47bcd) - [Linux ppc64le](https://get.helm.sh/helm-v3.14.1-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-linux-ppc64le.tar.gz.sha256sum) / 4d853ab8fe3462287c7272fbadd5f73531ecdd6fa0db37d31630e41ae1ae21de) - [Linux s390x](https://get.helm.sh/helm-v3.14.1-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-linux-s390x.tar.gz.sha256sum) / 19bf07999c7244bfeb0fd27152919b9faa1148cf43910edbb98efa9150058a98) - [Linux riscv64](https://get.helm.sh/helm-v3.14.1-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.14.1-linux-riscv64.tar.gz.sha256sum) / 2660bd8eb37aafc071599b788a24bfe244e5d3ffa42da1599da5a5041dafa214) - [Windows amd64](https://get.helm.sh/helm-v3.14.1-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.14.1-windows-amd64.zip.sha256sum) / 8a6c78a23a4e497ad8bd288138588adb3e5b49be8dbe82a3200fe7b297dac184) This release was signed with ` 672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E ` and can be found at [@​mattfarina](https://togithub.com/mattfarina) [keybase account](https://keybase.io/mattfarina). Please use the attached signatures for verifying this release using `gpg`. The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 3.14.2 will contain only bug fixes and be released on March 13, 2024. - 3.15.0 is the next feature release and will be on May 08, 2024. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/defenseunicorns/zarf). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNzMuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE3My4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
](https://renovatebot.com){kind=link}
- Loading branch information
1 parent
7e91d3b
commit 0cc2328