Skip to content

Commit

Permalink
Bump helm.sh/helm/v3 from 3.11.0 to 3.11.1 (#5972)
Browse files Browse the repository at this point in the history
Bumps [helm.sh/helm/v3](/~https://github.com/helm/helm) from 3.11.0 to
3.11.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="/~https://github.com/helm/helm/releases">helm.sh/helm/v3's
releases</a>.</em></p>
<blockquote>
<p>Helm v3.11.1 is a security (patch) release. Users are strongly
recommended to update to this release.</p>
<p>The template function <code>getHostByName</code> can be used to
disclose information. More details are available in the <a
href="/~https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8">CVE</a>.</p>
<p>This release introduces a breaking changes to Helm:</p>
<ul>
<li>When using the <code>helm</code> client for the
<code>template</code>, <code>install</code>, and <code>upgrade</code>
commands there is a new flag. <code>--enable-dns</code> needs to be set
for the <code>getHostByName</code> template function to attempt to
lookup an IP address for a given hostname. If the flag is not set the
template function will return an empty string and skip looping up an IP
address for the host.</li>
<li>The Helm SDK has added the <code>EnableDNS</code> property to the
install action, the upgrade action, and the <code>Engine</code>. This
property must be set to true for the in order for the
<code>getHostByName</code> template function to attempt to lookup an IP
address.</li>
</ul>
<p>The default for both of these cases is false.</p>
<p><a href="/~https://github.com/phil9909">Philipp Stehle</a> at SAP
disclosed the vulnerability to the Helm project.</p>
<h2>Installation and Upgrading</h2>
<p>Download Helm v3.11.1. The common platform binaries are here:</p>
<ul>
<li><a href="https://get.helm.sh/helm-v3.11.1-darwin-amd64.tar.gz">MacOS
amd64</a> (<a
href="https://get.helm.sh/helm-v3.11.1-darwin-amd64.tar.gz.sha256sum">checksum</a>
/ 2548a90e5cc957ccc5016b47060665a9d2cd4d5b4d61dcc32f5de3144d103826)</li>
<li><a href="https://get.helm.sh/helm-v3.11.1-darwin-arm64.tar.gz">MacOS
arm64</a> (<a
href="https://get.helm.sh/helm-v3.11.1-darwin-arm64.tar.gz.sha256sum">checksum</a>
/ 43d0198a7a2ea2639caafa81bb0596c97bee2d4e40df50b36202343eb4d5c46b)</li>
<li><a href="https://get.helm.sh/helm-v3.11.1-linux-amd64.tar.gz">Linux
amd64</a> (<a
href="https://get.helm.sh/helm-v3.11.1-linux-amd64.tar.gz.sha256sum">checksum</a>
/ 0b1be96b66fab4770526f136f5f1a385a47c41923d33aab0dcb500e0f6c1bf7c)</li>
<li><a href="https://get.helm.sh/helm-v3.11.1-linux-arm.tar.gz">Linux
arm</a> (<a
href="https://get.helm.sh/helm-v3.11.1-linux-arm.tar.gz.sha256sum">checksum</a>
/ 77b797134ea9a121f2ede9d159a43a8b3895a9ff92cc24b71b77fb726d9eba6d)</li>
<li><a href="https://get.helm.sh/helm-v3.11.1-linux-arm64.tar.gz">Linux
arm64</a> (<a
href="https://get.helm.sh/helm-v3.11.1-linux-arm64.tar.gz.sha256sum">checksum</a>
/ 919173e8fb7a3b54d76af9feb92e49e86d5a80c5185020bae8c393fa0f0de1e8)</li>
<li><a href="https://get.helm.sh/helm-v3.11.1-linux-386.tar.gz">Linux
i386</a> (<a
href="https://get.helm.sh/helm-v3.11.1-linux-386.tar.gz.sha256sum">checksum</a>
/ 1581a4ce9d0014c49a3b2c6421f048d5c600e8cceced636eb4559073c335af0b)</li>
<li><a
href="https://get.helm.sh/helm-v3.11.1-linux-ppc64le.tar.gz">Linux
ppc64le</a> (<a
href="https://get.helm.sh/helm-v3.11.1-linux-ppc64le.tar.gz.sha256sum">checksum</a>
/ 6ab8f2e253c115b17eda1e10e96d1637047efd315e9807bcb1d0d0bcad278ab7)</li>
<li><a href="https://get.helm.sh/helm-v3.11.1-linux-s390x.tar.gz">Linux
s390x</a> (<a
href="https://get.helm.sh/helm-v3.11.1-linux-s390x.tar.gz.sha256sum">checksum</a>
/ ab133e6b709c8107dc4f8f62838947350adb8e23d76b8c2c592ff4c09bc956ef)</li>
<li><a href="https://get.helm.sh/helm-v3.11.1-windows-amd64.zip">Windows
amd64</a> (<a
href="https://get.helm.sh/helm-v3.11.1-windows-amd64.zip.sha256sum">checksum</a>
/ bc37d5d283e57c5dfa94f92ff704c8e273599ff8df3f8132cef5ca73f6a23d0a)</li>
</ul>
<p>This release was signed with <code>672C 657B E06B 4B30 969C 4A57 4614
49C2 5E36 B98E </code> and can be found at <a
href="/~https://github.com/mattfarina"><code>@​mattfarina</code></a> <a
href="https://keybase.io/mattfarina">keybase account</a>. Please use the
attached signatures for verifying this release using
<code>gpg</code>.</p>
<p>The <a href="https://helm.sh/docs/intro/quickstart/">Quickstart
Guide</a> will get you going from there. For <strong>upgrade
instructions</strong> or detailed installation notes, check the <a
href="https://helm.sh/docs/intro/install/">install guide</a>. You can
also use a <a
href="https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3">script
to install</a> on any system with <code>bash</code>.</p>
<h2>What's Next</h2>
<ul>
<li>3.11.1 is the next patch/bug fix release and will be on March 08,
2023.</li>
<li>3.12.0 is the next feature release and be on May 10, 2023.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="/~https://github.com/helm/helm/commit/293b50c65d4d56187cd4e2f390f0ada46b4c4737"><code>293b50c</code></a>
Update to func handling</li>
<li>See full diff in <a
href="/~https://github.com/helm/helm/compare/v3.11.0...v3.11.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=helm.sh/helm/v3&package-manager=go_modules&previous-version=3.11.0&new-version=3.11.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • Loading branch information
dependabot[bot] authored Feb 8, 2023
1 parent 471936a commit e7a91bd
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
4 changes: 2 additions & 2 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ replace (
k8s.io/controller-manager => k8s.io/controller-manager v0.26.1
k8s.io/cri-api => k8s.io/cri-api v0.26.1
k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.26.1
k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.26.1
k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.26.1
k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.26.1
k8s.io/kube-proxy => k8s.io/kube-proxy v0.26.1
Expand All @@ -34,7 +35,6 @@ replace (
k8s.io/mount-utils => k8s.io/mount-utils v0.26.1
k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.26.1
k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.26.1
k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.26.1
)

require (
Expand Down Expand Up @@ -82,7 +82,7 @@ require (
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0
google.golang.org/protobuf v1.28.1
gopkg.in/yaml.v3 v3.0.1
helm.sh/helm/v3 v3.11.0
helm.sh/helm/v3 v3.11.1
k8s.io/api v0.26.1
k8s.io/apiextensions-apiserver v0.26.1
k8s.io/apimachinery v0.26.1
Expand Down
4 changes: 2 additions & 2 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -1560,8 +1560,8 @@ gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
helm.sh/helm/v3 v3.11.0 h1:F+peaCQYbycY1FIqIQ6dAortHd/VzV5FkhMciv4Kf+c=
helm.sh/helm/v3 v3.11.0/go.mod h1:z/Bu/BylToGno/6dtNGuSmjRqxKq5gaH+FU0BPO+AQ8=
helm.sh/helm/v3 v3.11.1 h1:cmL9fFohOoNQf+wnp2Wa0OhNFH0KFnSzEkVxi3fcc3I=
helm.sh/helm/v3 v3.11.1/go.mod h1:z/Bu/BylToGno/6dtNGuSmjRqxKq5gaH+FU0BPO+AQ8=
honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
Expand Down

0 comments on commit e7a91bd

Please sign in to comment.