Sandbox::https://github.com/silence-coding/helm/pull/1

silence-coding · 2026-10-21T12:58:31Z

Summary

Fixes helm#32218. Supersedes the stalled draft helm#32257 (upgrade-only).

The delete phase of Update (pkg/kube/client.go) is annotation-blind: a resource present in the original release but absent from the target is deleted without consulting meta.helm.sh/release-name. When a resource has been adopted by another release via --take-ownership, the source release still deletes it on its next upgrade/rollback, corrupting the adopter's state.

The uninstall path already guards against this via verifyOwnershipBeforeDelete (helm#31584). This PR extends the same principle to the shared update() delete loop, which is reached by upgrade, rollback, and install.

Changes

Add opt-in ClientUpdateOptionOwnership(releaseName) to pkg/kube/client.go. When set, the delete loop reads the live resource's meta.helm.sh/release-name annotation and skips deletion when it belongs to a different release. Resources owned by the operating release, or carrying no annotation, are deleted as before. When releaseName is empty the safeguard is disabled and behavior is unchanged.
Wire the option into all three Update call sites: upgrade.go (releasingUpgrade), rollback.go (performRollback), install.go (performInstall).
Export ReleaseNameAnnotation / ReleaseNamespaceAnnotation from pkg/kube so pkg/action reuses the constants instead of duplicating them.
Only release-name is checked (not namespace) to avoid edge-case false skips across namespaces.

Why opt-in via a ClientUpdateOption

The three action call sites always pass the release name, so the safeguard is always active in practice. Keeping it an explicit option preserves the pkg/kube API contract (HIP-0004): Update's option list is additive, and clientUpdateOptions.releaseName defaults to empty (disabled), so any direct caller of pkg/kube.Client.Update sees no behavior change.

Comparison with helm#32257

helm#32257 implements the same core check but only connects the upgrade path. This PR additionally covers rollback and install (they share the same update() delete loop) and drops the namespace check.

Test plan

go build ./... passes
go vet ./pkg/kube/ ./pkg/action/ passes
go test ./pkg/kube/... ./pkg/action/... passes
New unit test in pkg/kube/client_test.go:
- TestUpdateOwnershipCheck: foreign-owned resource skipped; owned + no-annotation resources deleted; option omitted → all deleted (regression)
Integration tests on k3s (v1.36.5), fixed vs. unmodified build:
- One-way transfer: A installs shared-cm, B adopts via --take-ownership, upgrade A removes it. Fixed build: shared-cm survives (owned by b). Unmodified: deleted.
- Regular upgrade (regression): A removes its own resource (no transfer). Fixed build: resource deleted as before; own resources retained.
- Bidirectional swap (A↔B, both via upgrade): cr1 from A→B, cr2 from B→A. Fixed build: both resources survive with correct ownership. Unmodified: the resource adopted by the first-upgrading release is deleted by the second-upgrading release.

Backward compatibility

The pkg/kube.Client.Update signature is unchanged; only a new ClientUpdateOption is added. Direct callers that do not pass ClientUpdateOptionOwnership see identical behavior. CLI flags and workflows are unchanged. This conforms to HIP-0004.

Notes

A true non-destructive transfer (adopt-before-delete, no delete/recreate) is a larger enhancement and is out of scope for this fix. This PR targets the correctness goal in helm#32218: a release must not delete a resource owned by another release.

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Signed-off-by: Akanksha Trehun <akankshatrehun@gmail.com>

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>

Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go) from 2.6.1 to 2.6.2. - [Release notes](https://github.com/oras-project/oras-go/releases) - [Commits](oras-project/oras-go@v2.6.1...v2.6.2) --- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

helm#32334) Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords) from 1.0.13 to 1.0.14. - [Commits](mattn/go-shellwords@v1.0.13...v1.0.14) --- updated-dependencies: - dependency-name: github.com/mattn/go-shellwords dependency-version: 1.0.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/stale](https://github.com/actions/stale) from 10.3.0 to 10.4.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@eb5cf3a...1e223db) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Dependabot reads its config only from the default branch, and the github-actions ecosystem was configured for main only. As a result, Action version bumps never flowed to dev-v3, leaving its workflows (e.g. govulncheck-action) frozen and drifting from main. Add a github-actions update block targeting dev-v3 so Action bumps are opened there too, matching the existing gomod/dev-v3 arrangement. Signed-off-by: Terry Howe <terrylhowe@gmail.com>

golang/govulncheck-action published v1.1.0 on 2026-07-10, tagging the master commit (032d455) the govulncheck step was already pinned to. Update the pin comment to # pin@v1.1.0 so it matches the repo's pin@<tag> convention and Dependabot can track the action by semver again. The pinned SHA is unchanged; v1.1.0 points to that commit, so CI behavior is identical and only the trailing comment changes. Closes: helm#32301 Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

…rt 1 refactor: convert tests to testify assert/require in internal/chart/v3/lint/rules Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

…rt 2 refactor: convert tests to testify assert/require in internal/chart/v3/util Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

…t-internal-1 chore(internal): refactor: convert tests to testify assert/require part 1

refactor: enable several checks from gocritic

fix(linters): update golangci-lint to 2.12.2

feat(linters): add new revive rules for better code quality

* chore: fix elseif and ifElseChain issues from gocritic Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com> * test: enhance assertions in OCIInstaller and list tests using testify Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com> --------- Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

…t-internal-2 chore(internal): refactor: convert tests to testify assert/require part 2

…actions-dev-v3 ci: track GitHub Actions updates on dev-v3 via Dependabot

* Fix missing conflict retry with server-side apply Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl> * Only retry on resourcequota transient conflict Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl> * Use isServerSideRetryable + naming nitpick Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl> --------- Signed-off-by: Jakub Jaruszewski <jjaruszewski@man.poznan.pl>

Properly format the extra field in gzipped packages

* feat: honor SOURCE_DATE_EPOCH for chart archives Add StampModTimes() on Chart struct to recursively set ModTime on all chart file entries. CLI reads SOURCE_DATE_EPOCH env var and wires through all 5 commands: package, install, upgrade, dep build, dep update. Removes unused v3 duplicate source_date_epoch.go (YAGNI). Inlines env var parsing to CLI layer from chart util. Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com> * docs: document SOURCE_DATE_EPOCH in environment variables help Add a short entry for $SOURCE_DATE_EPOCH to the env var table shown in 'helm help'. The variable is honored by 'helm package', 'install', 'upgrade', 'dep build', and 'dep update' to produce reproducible chart archives. Full documentation belongs in helm-www. Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com> * fix: adapt SourceDateEpoch to upstream refactored dep check Upstream/main restructured the dependency error handling in install.go and upgrade.go from a nested-if block (if DependencyUpdate) to an early-return pattern (if !DependencyUpdate). Adapt the feature's Manager construction to match the new code structure. Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com> --------- Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

…rt 3 refactor: convert tests to testify assert/require in internal/chart/v3/lint/rules Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Fix vanishing empty lines

…t-internal-3 chore(internal): refactor: convert tests to testify assert/require part 3

Signed-off-by: George Jenkins <gvjenkins@gmail.com>

…_lint_fixes fix: 'gocritic: filepathJoin path seperator' lint error

Mirrors the dev-v3 labeling workflow from helm#32340, reusing the existing v4.x label since main tracks the upcoming v4 release. Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>

* feat(storage): add internal/storage/driver for release v2 Copy of pkg/storage/driver operating on internal/release/v2, with the storage object Type field set to helm.sh/release.v2. The sh.helm.release.v1 name prefix is unchanged. Signed-off-by: Evans Mungai <mbuevans@gmail.com> * feat(storage): mark configmap release schema with a label ConfigMaps have no Type field to record it in, unlike Secrets. Absence of the label means v1. Also documents why the sh.helm.release.v1 name prefix is decoupled from Type. Signed-off-by: Evans Mungai <mbuevans@gmail.com> * Update internal/storage/driver/sql.go Co-authored-by: Terry Howe <terrylhowe@gmail.com> Signed-off-by: Evans Mungai <mbuevans@gmail.com> * Update test Signed-off-by: Evans Mungai <mbuevans@gmail.com> * PR comment fixes - Add comment to explain sql driver update behaviour when it comes to updating custom labels - Apply custom labels in memory driver Signed-off-by: Evans Mungai <mbuevans@gmail.com> * Update internal/storage/driver/records.go Co-authored-by: Terry Howe <terrylhowe@gmail.com> Signed-off-by: Evans Mungai <mbuevans@gmail.com> --------- Signed-off-by: Evans Mungai <mbuevans@gmail.com> Co-authored-by: Terry Howe <terrylhowe@gmail.com>

otel/log v0.21.0 removed log.Kind, log.Value and log.KeyValue, so the otlploghttp and stdoutlog exporters must move to the matching release or they fail to compile. Signed-off-by: Terry Howe <thowe@nvidia.com>

…telemetry.io/otel/exporters/otlp/otlplog/otlploggrpc-0.21.0 chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc from 0.18.0 to 0.21.0

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `github/codeql-action/autobuild` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `github/codeql-action/analyze` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `github/codeql-action/upload-sarif` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…elm#32681) In (*Client).Login(), credentials.ServerAddressFromHostname(key) was originally added in commit 6ab7aa3 as a workaround for oras-go v2.6.0 where ServerAddressFromRegistry("registry-1.docker.io") did not return the canonical https://index.docker.io/v1/. Since oras-go was bumped to v2.6.2 (which incorporates oras-project/oras-go#966), ServerAddressFromRegistry already normalizes both "docker.io" and "registry-1.docker.io" properly, making this second call redundant. Closes helm#32681 Signed-off-by: abdouladieng <diengabdoulaziz110@gmail.com>

…helm#32690) Bumps [github.com/ProtonMail/go-crypto](https://github.com/ProtonMail/go-crypto) from 1.4.1 to 1.5.0. - [Release notes](https://github.com/ProtonMail/go-crypto/releases) - [Commits](ProtonMail/go-crypto@v1.4.1...v1.5.0) --- updated-dependencies: - dependency-name: github.com/ProtonMail/go-crypto dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github.com/distribution/distribution/v3](https://github.com/distribution/distribution) from 3.1.1 to 3.1.2. - [Release notes](https://github.com/distribution/distribution/releases) - [Commits](distribution/distribution@v3.1.1...v3.1.2) --- updated-dependencies: - dependency-name: github.com/distribution/distribution/v3 dependency-version: 3.1.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…helm#32699) Bumps [github.com/ProtonMail/go-crypto](https://github.com/ProtonMail/go-crypto) from 1.5.0 to 1.5.2. - [Release notes](https://github.com/ProtonMail/go-crypto/releases) - [Commits](ProtonMail/go-crypto@v1.5.0...v1.5.2) --- updated-dependencies: - dependency-name: github.com/ProtonMail/go-crypto dependency-version: 1.5.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…updates (helm#32701) Bumps the github-actions group with 4 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.1 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@1c5b675...2892aa5) Updates `github/codeql-action/autobuild` from 4.38.1 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@1c5b675...2892aa5) Updates `github/codeql-action/analyze` from 4.38.1 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@1c5b675...2892aa5) Updates `github/codeql-action/upload-sarif` from 4.38.1 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@1c5b675...2892aa5) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Abdullah Kaya <abdullah.kaya@libredb.org>

…ndant-key-normalization fix(registry): remove redundant ServerAddressFromHostname in Login (helm#32681)

…elm#32715) Bumps [sigs.k8s.io/kustomize/kyaml](https://github.com/kubernetes-sigs/kustomize) from 0.21.1 to 0.21.2. - [Release notes](https://github.com/kubernetes-sigs/kustomize/releases) - [Commits](kubernetes-sigs/kustomize@api/v0.21.1...api/v0.21.2) --- updated-dependencies: - dependency-name: sigs.k8s.io/kustomize/kyaml dependency-version: 0.21.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

helm#32726) Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.25.1 to 0.25.2. - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/controller-runtime@v0.25.1...v0.25.2) --- updated-dependencies: - dependency-name: sigs.k8s.io/controller-runtime dependency-version: 0.25.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

helm#32727) Bumps [github.com/mattn/go-shellwords](https://github.com/mattn/go-shellwords) from 1.0.15 to 1.0.16. - [Release notes](https://github.com/mattn/go-shellwords/releases) - [Commits](mattn/go-shellwords@v1.0.15...v1.0.16) --- updated-dependencies: - dependency-name: github.com/mattn/go-shellwords dependency-version: 1.0.16 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…elm#32728) Bumps [github.com/foxcpp/go-mockdns](https://github.com/foxcpp/go-mockdns) from 1.2.0 to 1.3.0. - [Release notes](https://github.com/foxcpp/go-mockdns/releases) - [Commits](foxcpp/go-mockdns@v1.2.0...v1.3.0) --- updated-dependencies: - dependency-name: github.com/foxcpp/go-mockdns dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…32672) * fix(action): wait for CRD establishment under HookOnlyStrategy Motivation: installCRDs() selected its CRD-establishment waiter using the release's WaitStrategy. Under kube.HookOnlyStrategy, that waiter's Wait() is a no-op by design, intended to skip waiting on general chart resources such as Deployments. That no-op also silently skipped the unrelated CRD establishment check, which exists so custom resources depending on freshly-installed CRDs aren't processed before the API server recognizes the new CRD types. Helm 3 performed this CRD establishment wait unconditionally, regardless of the release's wait flag/strategy. Under HookOnlyStrategy this can intermittently produce an install failure such as: no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1" when a chart installs CRDs and dependent custom resources in the same release, if the CRDs have not finished being established by the time Helm processes the custom resources. Approach: In installCRDs(), compute a local crdWaitStrategy that substitutes kube.StatusWatcherStrategy for the CRD-establishment wait only when i.WaitStrategy is HookOnlyStrategy. i.WaitStrategy itself is left untouched, so every other waiter-selection call site (the general-resource wait later in Install.RunWithContext, and the equivalents in rollback.go/upgrade.go) keeps HookOnlyStrategy's existing no-op behavior for general resources. This mirrors the promotion to StatusWatcherStrategy already used elsewhere in this file for HookOnlyStrategy combined with RollbackOnFailure. Validation: - go build ./... - go test ./pkg/action/... ./pkg/kube/... - golangci-lint run ./pkg/action/... ./pkg/kube/... (0 issues) - go vet ./pkg/action/... ./pkg/kube/... (clean) - go mod tidy -diff (empty) - make build && make test-coverage PKG="./pkg/action/... ./pkg/kube/..." - Added TestInstallCRDs_HookOnlyStrategyStillWaitsForEstablishment, a targeted unit test with a fake kube.Interface that mimics the real no-op hookOnlyWaiter versus a genuine wait attempt. Verified via git stash that this test fails on the pre-fix code ("An error is expected but got nil") and passes after the fix. This was validated at the unit level with a fake Kubernetes client, not against a live cluster. Report: helm#32671 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Assisted-by: claude-sonnet-5 (via Claude Code) * test(action): reuse FailingKubeClient for the CRD wait strategy test Drop the test-only strategyAwareWaitKubeClient/strategyAwareWaiter fakes and use kubefake.FailingKubeClient instead. FailingKubeClient now records the WaitStrategy passed to GetWaiter/GetWaiterWithOptions in RecordedWaitStrategies, alongside the existing RecordedWaitOptions, so the test can assert installCRDs() asks for a StatusWatcherStrategy waiter under HookOnlyStrategy. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Assisted-by: claude-opus-5-5 (via Claude Code) --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

The golangci-lint job now gets Go 1.27.2 from setup-go, and golangci-lint v2.13.1 cannot read its export data, so typecheck fails on files that were not changed: could not load export data: internal error in importing "internal/goarch" (cannot decode "internal/goarch", export data version 5 is greater than maximum supported version 4) v2.14.0 works with Go 1.27.2 and reports no issues on main. Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com>

Resolves govulncheck failures for GO-2026-6603, GO-2026-6610 and related HTTP/2 vulnerabilities fixed in golang.org/x/net v0.60.0. golang.org/x/net is an indirect dependency, so Dependabot version updates do not cover it. Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Bumps the k8s-io group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [k8s.io/api](https://github.com/kubernetes/api) | `0.37.0` | `0.37.1` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.37.0` | `0.37.1` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.37.0` | `0.37.1` | | [k8s.io/apiserver](https://github.com/kubernetes/apiserver) | `0.37.0` | `0.37.1` | | [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) | `0.37.0` | `0.37.1` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.37.0` | `0.37.1` | | [k8s.io/kubectl](https://github.com/kubernetes/kubectl) | `0.37.0` | `0.37.1` | Updates `k8s.io/api` from 0.37.0 to 0.37.1 - [Commits](kubernetes/api@v0.37.0...v0.37.1) Updates `k8s.io/apiextensions-apiserver` from 0.37.0 to 0.37.1 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.37.0...v0.37.1) Updates `k8s.io/apimachinery` from 0.37.0 to 0.37.1 - [Commits](kubernetes/apimachinery@v0.37.0...v0.37.1) Updates `k8s.io/apiserver` from 0.37.0 to 0.37.1 - [Commits](kubernetes/apiserver@v0.37.0...v0.37.1) Updates `k8s.io/cli-runtime` from 0.37.0 to 0.37.1 - [Commits](kubernetes/cli-runtime@v0.37.0...v0.37.1) Updates `k8s.io/client-go` from 0.37.0 to 0.37.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.37.0...v0.37.1) Updates `k8s.io/kubectl` from 0.37.0 to 0.37.1 - [Commits](kubernetes/kubectl@v0.37.0...v0.37.1) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apimachinery dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/cli-runtime dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/client-go dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com>

…s-io-24cde91f38 chore(deps): bump the k8s-io group across 1 directory with 7 updates

…updates (helm#32756) Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/autobuild` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@2d11466...fa7117d) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

--- updated-dependencies: - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Gerard Louis Recinto <gerardrecinto@gmail.com>

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...6f2ac81) Updates `github/codeql-action/autobuild` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...6f2ac81) Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...6f2ac81) Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...6f2ac81) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feature: automated OCI end-to-end tests Signed-off-by: Terry Howe <terrylhowe@gmail.com> * test: address review feedback on OCI e2e tests Move the OCI end-to-end tests out of package cmd into a dedicated test/e2e package behind an 'e2e' build tag, and drive a real helm binary rather than executeActionCommand. - Parameterize the registry, namespace, and credentials so the tests run against any OCI registry, not a hard-coded personal GHCR namespace. - Isolate each run's repositories and namespace with a random run ID. - Fail rather than skip when required configuration is missing, since the build tag is already an explicit opt-in. - Pass the registry password over stdin so credentials never reach argv or test output. - Assert an authentication-specific failure in the invalid credential test instead of accepting any error. - Install through a real helm binary against the ambient kubecontext, so the Kubernetes test no longer runs against the fake kube client. - Stop dereferencing the os.Stat result after a stat error. - Add a 'make test-e2e' target and test/e2e/README.md. Signed-off-by: Terry Howe <thowe@nvidia.com> * test: address second round of review feedback on OCI e2e tests - Verify pulled chart contents against the source fixture instead of only checking that a path of the expected name exists, so a registry serving a different artifact under the same tag fails the test. - Skip the invalid-credential test against a registry that serves anonymous access, where there is no authentication to exercise. - Delete the namespace the Kubernetes test creates, and wait for it to go, so runs do not accumulate namespaces. A caller-supplied HELM_E2E_NAMESPACE is left in place. Signed-off-by: Terry Howe <thowe@nvidia.com> * test: run OCI e2e tests across registry implementations The suite has no registry-specific behavior, so covering a new registry is a matter of pointing it at one. Add the CI wiring to do that, and make the repository paths suitable for shared registries. - Repository paths are now stable rather than per-run. The fixtures are immutable, so re-running overwrites each tag with identical content. This bounds the repositories a shared registry accumulates and lets registries that require repositories to exist before a push (ECR) have them created ahead of time. HELM_E2E_ISOLATE restores per-run paths. - Add HELM_E2E_REPO to set the repository path under the registry. - Add e2e.yml: local authenticated registry plus kind, no secrets, so it runs on pull requests from forks. - Add e2e-registries.yml: nightly matrix over GHCR, Quay, and ECR with fail-fast disabled. A registry with no secrets configured is skipped, so they can be wired up one at a time. Signed-off-by: Terry Howe <thowe@nvidia.com> * test: address review feedback on e2e harness and workflow - Build the helm binary by relative package path instead of the v4 module path, so the harness also works on branches where the module carries a different major version suffix. - Scope Kubernetes release names to the run. A caller-supplied HELM_E2E_NAMESPACE may already hold releases, and a fixed name could collide with one that cleanup would then uninstall. - Fail a partially configured registry leg in the nightly workflow instead of reporting it as configured and failing later in the harness or the AWS CLI. A leg with no registry set is still skipped. Signed-off-by: Terry Howe <thowe@nvidia.com> * test: honor HELM_KUBECONTEXT when deleting the e2e namespace Helm subprocesses inherit HELM_KUBECONTEXT from the environment, but the cleanup client loaded the kubeconfig's current-context. When the two differ, releases are installed into one cluster while the namespace delete is sent to another, where it returns NotFound and is treated as success, leaking the namespace it was meant to remove. Apply the same context override when building the cleanup client. Signed-off-by: Terry Howe <thowe@nvidia.com> * test: build e2e cleanup client from helm's own settings Overriding only HELM_KUBECONTEXT still left the cleanup client able to diverge from the helm subprocesses, which also honor HELM_KUBEAPISERVER, HELM_KUBETOKEN, HELM_KUBECAFILE, HELM_KUBETLS_SERVER_NAME and HELM_KUBEINSECURE_SKIP_TLS_VERIFY. Any of those could send the namespace delete to a different endpoint, where NotFound reads as success and the namespace leaks. Resolve the client through cli.New().RESTClientGetter() instead, so it is built exactly the way the subprocesses build theirs and stays in step without mirroring each variable by hand. Signed-off-by: Terry Howe <thowe@nvidia.com> * test: run hosted e2e against docker hub in single-repository mode Replace the GHCR, Quay and ECR legs of e2e-registries with a Docker Hub job using the E2E_DOCKER_* secrets. Docker Hub does not nest repository paths and a scoped token can only write to one repository, so add HELM_E2E_SINGLE_REPO: each fixture is repackaged under that repository's name with its own prerelease version, e.g. 0.1.0-unicode-chart. Signed-off-by: Terry Howe <terrylhowe@gmail.com> * ci: read non-secret docker hub e2e settings from repository variables Signed-off-by: Terry Howe <terrylhowe@gmail.com> * ci: run e2e workflow on main only Signed-off-by: Terry Howe <terrylhowe@gmail.com> * ci: update kind, registry, httpd, checkout and setup-go in e2e workflows Signed-off-by: Terry Howe <terrylhowe@gmail.com> * ci: serialize e2e-registries runs that share docker hub tags Signed-off-by: Terry Howe <terrylhowe@gmail.com> --------- Signed-off-by: Terry Howe <terrylhowe@gmail.com> Signed-off-by: Terry Howe <thowe@nvidia.com>

The delete phase of Update (pkg/kube/client.go) is annotation-blind: a resource present in the original release but absent from the target is deleted without consulting meta.helm.sh/release-name. When a resource has been adopted by another release (via --take-ownership), the source release still deletes it on its next upgrade/rollback, corrupting the adopter's state. This is helm#32218. The uninstall path already guards against this via verifyOwnershipBeforeDelete (helm#31584). This extends the same principle to the shared update() delete loop, which is reached by upgrade, rollback, and install. Add an opt-in ClientUpdateOptionOwnership(releaseName). When set, the delete loop reads the live resource's release-name annotation and skips deletion when it belongs to a different release. Resources owned by the operating release, or carrying no annotation, are deleted as before. When releaseName is empty the safeguard is disabled and behavior is unchanged. Wire the option into all three Update call sites: - pkg/action/upgrade.go (releasingUpgrade) - pkg/action/rollback.go (performRollback) - pkg/action/install.go (performInstall) Compared to the stalled draft helm#32257 (upgrade-only), this also covers rollback and install, and checks only release-name (not namespace) to avoid edge-case false skips across namespaces. Export ReleaseNameAnnotation / ReleaseNamespaceAnnotation from pkg/kube so pkg/action can reuse the constants instead of duplicating them. Verified on a k3s cluster with a cross-release transfer scenario: after release B adopts a resource from A via --take-ownership, upgrading A no longer deletes it. The unmodified build deletes it. A bidirectional swap (A->B and B->A via upgrade) keeps both resources alive with correct ownership on the fixed build; the unmodified build loses one. Regular upgrades that remove a release's own resources still delete them. Signed-off-by: silence-coding <32766901+silence-coding@users.noreply.github.com>

Restore the original debug-level log in the info.Get() failure branch of the delete loop so the change stays minimal: only the ownership check is added, no logging behavior is modified. Remove TestUpdateOwnershipCheckGetFails: it exercised the pre-existing info.Get() failure skip path, which is unchanged behavior unrelated to this fix. Signed-off-by: silence-coding <32766901+silence-coding@users.noreply.github.com>

silence-coding · 2026-10-21T13:06:31Z

Closing: this was mistakenly created against the fork's own main. The intended upstream PR is helm#32793.

mmorel-35 and others added 30 commits July 10, 2026 11:07

refactor: enable several checks from gocritic

9662fdd

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

feat(linters): add new revive rules for better code quality

16787d6

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

fix(Makefile): update outdated .sha256 comment for Helm v4 (helm#32323)

a91e9f6

Signed-off-by: Akanksha Trehun <akankshatrehun@gmail.com>

fix: remove trailing whitespace in .golangci.yml (helm#32325)

cfa3b24

Signed-off-by: Akanksha Trehun <akankshatrehun@gmail.com>

fix: add missing https:// to Oracle link in ADOPTERS.md (helm#32324)

7b9a5c8

Signed-off-by: Akanksha Trehun <akankshatrehun@gmail.com>

Fix vanishing empty lines

bfebbb7

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>

Address review comments

73c1fb2

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>

chore(internal): refactor: convert tests to testify assert/require pa…

d72b28e

…rt 1 refactor: convert tests to testify assert/require in internal/chart/v3/lint/rules Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

chore(internal): refactor: convert tests to testify assert/require pa…

f280d9c

…rt 2 refactor: convert tests to testify assert/require in internal/chart/v3/util Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Merge pull request helm#32341 from mmorel-35/testifylint-manual-asser…

c3b336a

…t-internal-1 chore(internal): refactor: convert tests to testify assert/require part 1

Merge pull request helm#32321 from mmorel-35/gocritic

66c1232

refactor: enable several checks from gocritic

Merge pull request helm#32320 from mmorel-35/gomodguard_v2

b46d116

fix(linters): update golangci-lint to 2.12.2

Merge pull request helm#32319 from mmorel-35/revive

7a7b328

feat(linters): add new revive rules for better code quality

Merge pull request helm#32342 from mmorel-35/testifylint-manual-asser…

9aa7778

…t-internal-2 chore(internal): refactor: convert tests to testify assert/require part 2

Merge pull request helm#32336 from TerryHowe/chore/dependabot-github-…

74b4128

…actions-dev-v3 ci: track GitHub Actions updates on dev-v3 via Dependabot

Merge pull request helm#31884 from ouillie/main

d0e56d4

Properly format the extra field in gzipped packages

chore(internal): refactor: convert tests to testify assert/require pa…

caac755

…rt 3 refactor: convert tests to testify assert/require in internal/chart/v3/lint/rules Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Merge pull request helm#32327 from fluxcd/fix-32326

9c373bf

Fix vanishing empty lines

Merge pull request helm#32343 from mmorel-35/testifylint-manual-asser…

1367d76

…t-internal-3 chore(internal): refactor: convert tests to testify assert/require part 3

fix: 'gocritic: filepathJoin path seperator' lint error

96a25ab

Signed-off-by: George Jenkins <gvjenkins@gmail.com>

Merge pull request helm#32370 from gjenkins8/gjenkins/darwin_gocritic…

7ed8959

…_lint_fixes fix: 'gocritic: filepathJoin path seperator' lint error

ci: auto-label PRs targeting main with v4.x

9f3c89a

Mirrors the dev-v3 labeling workflow from helm#32340, reusing the existing v4.x label since main tracks the upcoming v4 release. Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>

banjoh and others added 28 commits September 21, 2026 06:38

chore(deps): bump otlploghttp and stdoutlog to v0.21.0

4c8a1b2

otel/log v0.21.0 removed log.Kind, log.Value and log.KeyValue, so the otlploghttp and stdoutlog exporters must move to the matching release or they fail to compile. Signed-off-by: Terry Howe <thowe@nvidia.com>

Merge pull request helm#32661 from helm/dependabot/go_modules/go.open…

e9f1921

…telemetry.io/otel/exporters/otlp/otlplog/otlploggrpc-0.21.0 chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc from 0.18.0 to 0.21.0

docs: add LibreDB to ADOPTERS.md (helm#32704)

2b128dc

Signed-off-by: Abdullah Kaya <abdullah.kaya@libredb.org>

Merge pull request helm#32685 from aadieng100/fix-registry-login-redu…

53dfa52

…ndant-key-normalization fix(registry): remove redundant ServerAddressFromHostname in Login (helm#32681)

Merge pull request helm#32695 from helm/dependabot/go_modules/main/k8…

fa27c96

…s-io-24cde91f38 chore(deps): bump the k8s-io group across 1 directory with 7 updates

fixed: dead gnupg manual link in provenance docs (helm#32730)

306cdac

Signed-off-by: Gerard Louis Recinto <gerardrecinto@gmail.com>

fixed: dead k8s job utils link in job status reader (helm#32729)

30fd975

Signed-off-by: Gerard Louis Recinto <gerardrecinto@gmail.com>

silence-coding closed this Oct 21, 2026

Navigation Menu

Repository navigation

fix: check ownership before delete in upgrade/rollback/install (#32218) - #1

fix: check ownership before delete in upgrade/rollback/install (#32218)#1
silence-coding wants to merge 2272 commits into
mainfrom
fix/ownership-check-delete-path

silence-coding commented Oct 21, 2026

Uh oh!

silence-coding commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

silence-coding commented Oct 21, 2026

Summary

Changes

Why opt-in via a ClientUpdateOption

Comparison with helm#32257

Test plan

Backward compatibility

Notes

Uh oh!

silence-coding commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants