Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bump helm.sh/helm/v3 from 3.11.0 to 3.11.1 (#5972)
Bumps [helm.sh/helm/v3](/~https://github.com/helm/helm) from 3.11.0 to 3.11.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="/~https://github.com/helm/helm/releases">helm.sh/helm/v3's releases</a>.</em></p> <blockquote> <p>Helm v3.11.1 is a security (patch) release. Users are strongly recommended to update to this release.</p> <p>The template function <code>getHostByName</code> can be used to disclose information. More details are available in the <a href="/~https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8">CVE</a>.</p> <p>This release introduces a breaking changes to Helm:</p> <ul> <li>When using the <code>helm</code> client for the <code>template</code>, <code>install</code>, and <code>upgrade</code> commands there is a new flag. <code>--enable-dns</code> needs to be set for the <code>getHostByName</code> template function to attempt to lookup an IP address for a given hostname. If the flag is not set the template function will return an empty string and skip looping up an IP address for the host.</li> <li>The Helm SDK has added the <code>EnableDNS</code> property to the install action, the upgrade action, and the <code>Engine</code>. This property must be set to true for the in order for the <code>getHostByName</code> template function to attempt to lookup an IP address.</li> </ul> <p>The default for both of these cases is false.</p> <p><a href="/~https://github.com/phil9909">Philipp Stehle</a> at SAP disclosed the vulnerability to the Helm project.</p> <h2>Installation and Upgrading</h2> <p>Download Helm v3.11.1. The common platform binaries are here:</p> <ul> <li><a href="https://get.helm.sh/helm-v3.11.1-darwin-amd64.tar.gz">MacOS amd64</a> (<a href="https://get.helm.sh/helm-v3.11.1-darwin-amd64.tar.gz.sha256sum">checksum</a> / 2548a90e5cc957ccc5016b47060665a9d2cd4d5b4d61dcc32f5de3144d103826)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-darwin-arm64.tar.gz">MacOS arm64</a> (<a href="https://get.helm.sh/helm-v3.11.1-darwin-arm64.tar.gz.sha256sum">checksum</a> / 43d0198a7a2ea2639caafa81bb0596c97bee2d4e40df50b36202343eb4d5c46b)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-linux-amd64.tar.gz">Linux amd64</a> (<a href="https://get.helm.sh/helm-v3.11.1-linux-amd64.tar.gz.sha256sum">checksum</a> / 0b1be96b66fab4770526f136f5f1a385a47c41923d33aab0dcb500e0f6c1bf7c)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-linux-arm.tar.gz">Linux arm</a> (<a href="https://get.helm.sh/helm-v3.11.1-linux-arm.tar.gz.sha256sum">checksum</a> / 77b797134ea9a121f2ede9d159a43a8b3895a9ff92cc24b71b77fb726d9eba6d)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-linux-arm64.tar.gz">Linux arm64</a> (<a href="https://get.helm.sh/helm-v3.11.1-linux-arm64.tar.gz.sha256sum">checksum</a> / 919173e8fb7a3b54d76af9feb92e49e86d5a80c5185020bae8c393fa0f0de1e8)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-linux-386.tar.gz">Linux i386</a> (<a href="https://get.helm.sh/helm-v3.11.1-linux-386.tar.gz.sha256sum">checksum</a> / 1581a4ce9d0014c49a3b2c6421f048d5c600e8cceced636eb4559073c335af0b)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-linux-ppc64le.tar.gz">Linux ppc64le</a> (<a href="https://get.helm.sh/helm-v3.11.1-linux-ppc64le.tar.gz.sha256sum">checksum</a> / 6ab8f2e253c115b17eda1e10e96d1637047efd315e9807bcb1d0d0bcad278ab7)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-linux-s390x.tar.gz">Linux s390x</a> (<a href="https://get.helm.sh/helm-v3.11.1-linux-s390x.tar.gz.sha256sum">checksum</a> / ab133e6b709c8107dc4f8f62838947350adb8e23d76b8c2c592ff4c09bc956ef)</li> <li><a href="https://get.helm.sh/helm-v3.11.1-windows-amd64.zip">Windows amd64</a> (<a href="https://get.helm.sh/helm-v3.11.1-windows-amd64.zip.sha256sum">checksum</a> / bc37d5d283e57c5dfa94f92ff704c8e273599ff8df3f8132cef5ca73f6a23d0a)</li> </ul> <p>This release was signed with <code>672C 657B E06B 4B30 969C 4A57 4614 49C2 5E36 B98E </code> and can be found at <a href="/~https://github.com/mattfarina"><code>@mattfarina</code></a> <a href="https://keybase.io/mattfarina">keybase account</a>. Please use the attached signatures for verifying this release using <code>gpg</code>.</p> <p>The <a href="https://helm.sh/docs/intro/quickstart/">Quickstart Guide</a> will get you going from there. For <strong>upgrade instructions</strong> or detailed installation notes, check the <a href="https://helm.sh/docs/intro/install/">install guide</a>. You can also use a <a href="https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3">script to install</a> on any system with <code>bash</code>.</p> <h2>What's Next</h2> <ul> <li>3.11.1 is the next patch/bug fix release and will be on March 08, 2023.</li> <li>3.12.0 is the next feature release and be on May 10, 2023.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="/~https://github.com/helm/helm/commit/293b50c65d4d56187cd4e2f390f0ada46b4c4737"><code>293b50c</code></a> Update to func handling</li> <li>See full diff in <a href="/~https://github.com/helm/helm/compare/v3.11.0...v3.11.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Loading branch information