What changed in Helm from 3 to 4

6 releases numbered after v3.21.4 up to and including v4.2.4, stable releases only. v3.21.4 and v4.2.4 are the newest stable releases of 3 and 4 we track; this page follows them as new ones ship.

27 changes across 6 releases

Added 1

v4.2.0

  • Add mustToToml template function
Changed 4

v4.2.3

  • Bump golang.org/x/crypto from 0.53.0 to 0.54.0

v4.2.1

  • Upgraded dependencies: cli-utils to 1.2.1, controller-runtime to 0.24.1 and k8s to 1.36.1

v4.2.0

  • Switch to goreleaser for release builds
  • Update Kubernetes client libraries to v1.36
Fixed 16

v4.2.4

  • Improve error reporting for helm template --debug with --show-only
  • Fetch logs from all containers in test pods
  • Check error return in Digest and encodeRelease
  • Fix panic on repeated IsReachable calls
  • Set [pull,push] scope when helm push to a registry using token auth
  • Fix missing conflict retry with server-side apply
  • Properly format the extra field in gzipped packages
  • Fix vanishing empty lines
  • Pass registry client to downloader.Manager in upgrade
  • Bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158

v4.2.2

  • Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite

v4.2.1

  • Data race detected by -race flag when concurrent goroutines both call GetWaiterWithOptions on the same FailingKubeClient instance
  • Helm command success messages writing to stderr instead of stdout
  • Helm 4 emitting "unable to find exact version" when using version range constraints
  • Race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite

v4.2.0

  • Make --dry-run=server respect generateName:
Deprecated 1

v4.2.0

  • Deprecate unused --hide-notes and --render-subchart-notes flags
Security 5

v4.2.4

  • Bump google.golang.org/grpc from 1.80.0 to 1.82.1 for GO-2026-6061

v4.2.1

  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026

v4.1.4

  • Fix Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
  • Fix plugin verification fails open when .prov is missing, allowing unsigned plugin install
  • Fix path traversal in plugin metadata version that enables arbitrary file write outside Helm plugin directory

Original release notes, newest first

The list above is our reading of these notes; the originals from Helm are here, one fold per release.

v4.2.4Helm v4.2.4

Helm v4.2.4 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Notable Changes
  • fix: Improve error reporting for helm template --debug with --show-only- #31185 by @kyokuping
  • fix: fetch logs from all containers in test pods- #32099 by @SebTardif
  • fix(provenance): check error return in Digest and encodeRelease- #32136 by @SebTardif
  • fix panic on repeated IsReachable calls- #32184 by @atkrad
  • fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211 by @kimsungmin1
  • Fix missing conflict retry with server-side apply- #32088 by @Kajot-dev
  • Properly format the extra field in gzipped packages- #31884 by @ouillie
  • Fix vanishing empty lines- #32327 by @matheuscscp
  • fix: pass registry client to downloader.Manager in upgrade- #32400 by @SetagGnaw
  • chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1- for GO-2026-6061 #32450
  • fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158- #32521 by @TerryHowe
Installation and Upgrading

Download Helm v4.2.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
Changelog
  • Minimal fix to build failure from #31211. 3900f434fd3ef2b84065dc04508df48f288dba00 (Scott Rigby)
  • fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#32521) f7c6e8f0f1e0e649e8d03b1535db4f3b8d0c9af2 (Terry Howe)
  • chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 035a2c38e9a75ca0988c8449c0b7257f30d04064 (dependabot[bot])
  • fix: pass registry client to downloader.Manager in upgrade f76a5f46a952f731cc1543f348121297c8b3f6cc (Gates Wang)
  • Apply suggestions 5a7c6c7c732b04ad6517b452d538da9e18993d67 (Will Noble)
  • Properly format the extra field in gzipped packages 22818486ce0fc18d92e01ba39faf65f70ffa8865 (Will Noble)
  • Fix missing conflict retry with server-side apply (#32088) 2c979a17ac6b6d7bfe2d6650b69fa9effe963d4d (Jakub Jaruszewski)
  • Potential fix for pull request finding 2bd2c66544634e419ede3cfa18952cce5a5acd08 (kimsungmin1)
  • fix(registry): resolve golangci-lint issues in token-auth tests 183a5402291c553898b9c404bc17c95c81ea1c6c (kimsm28)
  • chore: go mod tidy after rebase on main 08d8da1aa9080772e57ab5bf5b00b3c13364af00 (kimsm28)
  • fix(registry): use plain-http registry in token-auth scope test 9655b5aecc0d36142d0620ff5ed762065a997739 (kimsm28)
  • Update pkg/registry/client.go 430dfac3eeab03886f511761e3969f738f760364 (Terry Howe)
  • test: improve client_scope_test.go to avoid data races and brittle assertions 9569605eccf8318fe25bf78c46c4eb462ce8fc3f (kimsm28)
  • fix typos in withScopeHint function comment 63f2b6809919e5e8e3e04f52064a536a14f1ff9b (kimsm28)
  • fix registry test failures by adjusting DockerRegistryHost and auth server listener management f7488c0be8c65dd16386c215cac4332900667278 (kimsm28)
  • fix variable naming requestUrl -> requestURL 8fe78fbe46eb2db5c75ab1cc89699c750017dca6 (kimsm28)
  • fix typo, remove unnecessary code, fix to avoid to use the assertion in http hanlder d0670d2fb2c3426cde4b41927b5e9b8b4370df93 (kimsm28)
  • change suite.Nil, suite.NotNill to more proper function(suite.NoError, suite.Error) 804256ef659226f26b2222ccb8f9cf18ef1b1946 (kimsungmin1)
  • change client_scope_test.go to use httptest d79bceb807692512461d8007040c41bcd1547041 (kimsungmin1)
  • fix typo d34fcd9264225a1e6296c4b0ee124dc69f3b3ecc (kimsungmin1)
  • remove freeport dependency 9fbd190c30addb4786e4fe930a0fe98bf354116a (kimsungmin1)
  • add newline in license header 9275661357afdfe12b8ce561e8103673f16cca8d (kimsungmin1)
  • fix scope when helm push to a registry that use token auth fef91f3e6942a20148542461eaebfb24f2c09584 (kimsungmin1)
  • fix panic on repeated IsReachable calls e89ce68bc5fec430bc1e2f0aef1aca6a2e71f795 (Mohammad Abdolirad)
  • fix(provenance): check error return in Digest ff1ac83bfb1246cdf1b57a4db0042085cc8b265d (Sebastien Tardif)
  • fix: address review feedback 4b4dedb2bdcfac886c124a361a5126e3c5e3c5df (Sebastien Tardif)
  • fix: fetch logs from all containers in test pods 7c8010322b8639cdf7844ac1ae5f8d444db43935 (Sebastien Tardif)
  • chore: rename savedErr to clear its specific purpose ecc9cd2f1b5b53dadcd12395c032bc5b3ca02937 (Jeaeun Kim)
  • chore: fix lint f6211ba49bfbf5768ea44be3a1402869a4709b37 (Jeaeun Kim)
  • chore: store err separately for clarity 3507ea5bfdbad921684ac131896b6968c76e9ca6 (Jeaeun Kim)
  • chore: Improve error reporting for helm template --debug with --show-only 211ffae93d2d741a2dbcd74b4aa2a1bc2fc27d5f (Jeaeun Kim)
  • Address review comments 51a9837ba177812c381515886c4f0cd0b7a633e6 (Matheus Pimenta)
  • Fix vanishing empty lines 83a8b70ffc1bcf97bb293cf6b35bd3b5093e8c30 (Matheus Pimenta)

Full Changelog: https://github.com/helm/helm/compare/v4.2.3...v4.2.4

View originalPermalink

v4.2.3Helm v4.2.3

Helm v4.2.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Installation and Upgrading

Download Helm v4.2.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
Changelog
  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7feece8beb0fcba47059ec9b522fd929a64 (Terry Howe)

View originalPermalink

v4.2.2Helm v4.2.2

Helm v4.2.2 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Notable Changes
  • Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214
Installation and Upgrading

Download Helm v4.2.2. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
Changelog
  • Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881cf967a5a09e19866799d0edfd40675803a (George Jenkins)

Full Changelog: https://github.com/helm/helm/compare/v4.2.1...v4.2.2

View originalPermalink

v4.2.1Helm v4.2.1

Helm v4.2.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Notable Changes
  • Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925
  • Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056
  • Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757
  • Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32081
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32153
  • Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #32128
  • Dependency updates
Installation and Upgrading

Download Helm v4.2.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026
Changelog
  • fix: protect FailingKubeClient.RecordedWaitOptions from data race (#31925) d591a19b953bd9cfdf7d9ddd83c2f4ffdaeafb29 (Terry Howe)
  • fix: route registry client output to stdout instead of stderr (#32056) 2a9fcae29280472edec988c6bf0528e4ae79b33a (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd693eee68ba9c1ba42d160c69114eda962c (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf94008044a516cda4837565237306578a7 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891699ae9c8f2d0e06d5db3dd117649886a2 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2b7d4ed9ca3bb4be7562f76dd5f2fd8f71 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b0ef8882b062ba8f6b87261411309875b8 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586df3f2a79fca5202b6713f8675bb097a904 (dependabot[bot])
  • fix(version): avoid false range detection on prerelease x/X eabfae560459d1ffe1f7a3268d5441238e9f84b2 (Benoit Tigeot)
  • fix(version): version range || can has no space e3fd51f331e14fb4056951540d2f2ffde81b405c (Benoit Tigeot)
  • feat: report in debug the version we select with version range arg 1e47395a9566bcaaaf7ed9e31a8367eb1f95e0a3 (Benoit Tigeot)
  • fix: prevent warning when using version range constraints a33e23939a85ac60eb9a6bee818f2c5459fda576 (Benoit Tigeot)
  • fix(kube): always propagate context.Canceled in WaitForDelete fa06d4455724afe22bbe00af7925549a82d95e6c (Terry Howe)
  • fix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d4835df0fb8bd7cbde4cad0cbc79de01a6e93 (Terry Howe)
  • chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf21e31b5c33df82e67f23855d1358d021d (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e43f3620eb60ef3524527c1b2fceed90e9 (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a7461a524b87e5bb73ea5a0c4f82c72469 (Terry Howe)
  • chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c5751b1723239cbce042533db0d84b65c6bc1 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb364dbfb781059e628572d7177ba191cc4 (dependabot[bot])
  • chore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2a11b2e111acddcbc55d5a4733ba461f20 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb6263f59fe541acd75ce0b508034c65899e1 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16b58aa4cb9dbaf8c37055faa28b1b350ae (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de054b5ab1b59f60c790fad39861e294671f1 (dependabot[bot])
  • fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803bd4953d8ef9d51d927f492ecaaf5df9db (Matheus Pimenta)
  • chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02b9cd7fcba804391ab3d364739cb2a8780 (dependabot[bot])

Full Changelog: https://github.com/helm/helm/compare/v4.2.0...v4.2.1

View originalPermalink

v4.2.0Helm v4.2.0

Helm v4.2.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Notable Changes
  • Switch to goreleaser for release builds
  • Kubernetes client libraries to v1.36
  • Add mustToToml template function
  • deprecate unused --hide-notes and --render-subchart-notes flags
  • --dry-run=server now respects generateName:
Installation and Upgrading

Download Helm v4.2.0. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.2.1 will contain only bug fixes
  • 4.3.0 is the next feature release
Changelog
  • Bump to version v4.2 06468084e85c244c712834933d25ea232a4c2093 (George Jenkins)
  • build: Clean up Goreleaser change (#32098) e23bf3af53c52185123278e83b7023c102707778 (Scott Rigby)
  • fix: add -extldflags -static to dist target to match build-cross f60ab7c31c81a73b8e0aade5aff41bfc01c08820 (Terry Howe)
  • build: use goreleaser build with manual archive creation 64aa46f2f1cf239cf6535c5e847e14dcb933a847 (Terry Howe)
  • chore: remove build-cross dependency from test-acceptance d199a1a42c04bccb287f2c7d9c3f73b669412e5a (Terry Howe)
  • ci: add fetch-depth 0 to canary checkout for goreleaser 82899404a68f3826389bb38cf67bf75085db6b2c (Terry Howe)
  • fix: address goreleaser build issues flagged in review c075022ce16489f5f7afd45a37b679cf58fa36ea (Terry Howe)
  • fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd905b6f8a823733dbc9b9f5cb2843a975f (Terry Howe)
  • fix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce66cb6374d9d7b552802f53b21ea2c2dd1 (Terry Howe)
  • fix: use index for optional env var in version_template e49a1dc16eee526928d8928b8d96c01ee513ebd9 (Terry Howe)
  • fix: canary build file names eaa09100b9b18175d878b1e114cbe9df2a3f70c2 (Terry Howe)
  • Fix archive name 5a75279c1a017a60b97bd44986288af7399c6ff8 (Terry Howe)
  • fix goreleaser archive 37284a9211972f7f41a2acc3c3313517596dd4b0 (Terry Howe)
  • add support for loong64 45336ccd5b2621357e3f785c1fe93627c5990a6e (Terry Howe)
  • fix artifact directory a9659b07e3eec20ab5b964fddae05f51f478f704 (Terry Howe)
  • update configuration to v2 e368f170af8a200e672adac5f765b8101db0c8fa (Terry Howe)
  • remove GOTOOLCHAIN e7bea8513c30475664919f031774e18fecdf1f66 (Terry Howe)
  • chore: replace mitchellh/gox with goreleaser 075c096afec70155bc43ac3587a119df1ae5fcc6 (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 12f2c41c0d7a74739c58a5995cbbb3125d9247e5 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 58e8ffdc3302260b1b55718c9b72c6f169a76ee0 (dependabot[bot])
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 e61bbfbfff41958b0ba1984e4d6799fe131f325e (dependabot[bot])
  • Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6dff537087f52ec6e470d8986439e24e8e33 (Matheus Pimenta)
  • fix: adds topLevel permissions to improve openSSF scores 277d9702555532d13426119d31c70fffb389d589 (Gagan H R)
  • Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7a314d98456a2f23798a78e9ad05d96d0c (Matheus Pimenta)
  • fix(templating): hooks conflicting with templates in post-renderers (#32049) 8f56f24d638612a46f3e23265d06338c1f93bccb (Matheus Pimenta)
  • docs: fix grammar and spacing in CONTRIBUTING.md db40adb1d13573280b65bc2002df7d75c009235a (Mohit)
  • chore(deps): bump the k8s-io group with 7 updates 775e794319639f5c1e6b40448ce15ad3cc10d4e1 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 934ace35dfaef9eeb9997bf1ee385db0986daecc (dependabot[bot])
  • fix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#31952) 265c5eb530a36ec651e79ecf4d37ba2f098b7e59 (Matheus Pimenta)
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 48e2b7ddd4e960b768fe5daee34a33cb89852a6e (dependabot[bot])
  • Update pkg/chart/common/util/coalesce.go a8e249714f5311b9aff44c4bd2bfc433ab1ab952 (Evans Mungai)
  • test(values): Add test for nil cleanup in partially overridden subchart maps 52fc971da37cf34aa26e7d7c460f2430dfb01b26 (Johannes Lohmer)
  • fix(values): do not copy chart-default nils into coalesced values 00638773d1366dc962c785de3d297cf0279b9a0d (Johannes Lohmer)
  • test(values): add test for subchart nil producing %!s() 6eb4ebf0e1afb0c63d748bf116145a5b9e0842b7 (Johannes Lohmer)
  • test(values): add tests for subchart nil value regressions 5cb4e7d992d85d372f5d86c238330102d936bfe5 (Johannes Lohmer)
  • chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 b5c7c80de317643e383ca2926ebc0ad884021bba (dependabot[bot])
  • fix(templating): fix wrong YAML separator parsing for post-renderers (#31941) a27f1add79c6c02459413dbb60f8438d8051cf06 (Matheus Pimenta)
  • fix: add debug logging to HTTP getter for helm pull c26be60d81e5cb6a147d6088477cf86fd5aaf1f0 (Cairon)
  • chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 953f5f031bb7fa8f3eccdea6520e09fd44fe3923 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0 10fc5f335b5fbb09f5d04cb0450839790ae15634 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0 d89e7c60762910204044c4215c7bb2f43ac3ef8f (dependabot[bot])
  • chore: Update release notes script for Helm v4 8a954619255a82890a08b7d1fa9e86a437c4cebb (George Jenkins)
  • refactor(cli): share RetryingRoundTripper via pkg/kubeenv 213c869a988f2c7390c65673e3d677970d6220fd (Sumit Solanki)
  • chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3 bd5027a9cf07993d7bfe4b60702b1a489fe8783e (dependabot[bot])
  • fix: unnecessary-format lint issues from merge 087736b66e97393ccaa0bdf1e5df13dcc9d88340 (George Jenkins)
  • fix: Plugin missing provenance bypass 586eb57338d848e65686a3a9616e2776e87cfd1e (George Jenkins)
  • chore(deps): bump github.com/fluxcd/cli-utils c8c5dfad630cd7b238236c619c466488a547725c (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 998466cfcfee189ce7e3df5be8ffe79ed5f1f097 (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp b0cec589f50a7e16d942ad3385598a6dda2b0a20 (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 6ebfb29dbf006ce78e9af8878008bda3578dcd3e (dependabot[bot])
  • test(kube): fix flaky WaitForDelete test by avoiding informer sync race a7f84439aacd3864b40055b60a3c3e54292d1646 (Terry Howe)
  • test(kube): fix flaky WaitForDelete timing in status wait tests 4c0d21f53f2ca78b525e31dbbf9cc9cfb818a2e3 (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 08dea9c140084b5d9fecb59a45a05f417415b591 (dependabot[bot])
  • Minor nit: fix import instructions to comply with canonical import paths de58531ca7ff557342acaa2c906082e58521ef47 (Anmol Virdi)
  • chore(deps): bump github.com/distribution/distribution/v3 9b1ad4cf027452b828affb07318db2e931e734a5 (dependabot[bot])
  • fix(action): return correct error variable in prepareUpgrade 8ef2d45934ba1b9ca341818f1157112fcf7cdf1d (Rhys McNeill)
  • chore(deps): bump github.com/lib/pq from 1.12.1 to 1.12.2 cd7cf76a174e856fd171b391995d9a65f97a79d3 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.30.7 to 4.35.1 45ee55b83f8ad23798c84560ff65686e2ab298af (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.12.0 to 1.12.1 9a0674188412d1dcb2e7f018730aaa71781bd03b (dependabot[bot])
  • chore(deps): bump actions/setup-go from 6.2.0 to 6.4.0 d1e31ca507412d770a602e722060e6d7379f4f1a (dependabot[bot])
  • fix(kube): clarify server-side apply patch errors f257c95c783f5595e36cb5a7dcc862cc1f6266b5 (abhay1999)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 7025480397d8b6b7fd8cdb5e083dc37b62dbd3d8 (Terry Howe)
  • refactor(cli): decouple EnvSettings from pkg/kube 64f1d0af5b53f0a9292af2ba1efc42a46a57ed00 (Sumit Solanki)
  • docs(registry): fix incorrect and improve clarity of comments in client.go 85bf56ea82fd21452e53cae91b380b0afb3e8b83 (Debasish Mohanty)
  • refactor(cli): decouple EnvSettings from pkg/kube to avoid import cycles 154993723aadf45601d124c6750e8f4ae3b9f2fd (Sumit Solanki)
  • chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.1 c7a75b16cb8b0859bf32bf74ae98300e5b55361b (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0 3a7573a81ed5be2e00dfb74fa8d95c0cbe1c4f0d (dependabot[bot])
  • chore(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0 0229da1803a29671b1becc4561c77f85db609aac (dependabot[bot])
  • docs(engine): fix misleading toTOML doc comment c1a5a6e260bd070bce9a8299795400340e10c468 (Ilya Kiselev)
  • feat(engine): add mustToToml template function b075f7a35d25ec0a4414b011142744f8f1821b47 (Ilya Kiselev)
  • chore: fix unnecessary-format issues from revive 7edfff33ebcb0f5d961afec34393c222de92de12 (Matthieu MOREL)
  • chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 37185d2ea6a091b93d2e71cc55ab16b2c0f3f9e9 (dependabot[bot])
  • chore: fix bool-compare issues from testifylint 071558d69ffbb408dcb56403d387a1aa90a7d3a8 (Matthieu MOREL)
  • chore: enable perfsprint linter 62494896e9a105b63df2c76c638c53304a37121e (Matthieu MOREL)
  • ignore error plugin loads (cli, getter) 47a084091eeb1c5de221e061866b319f5b5f99f5 (George Jenkins)
  • chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0 3d06fd1feb37f11d050e78f7c17df3c713fcd344 (dependabot[bot])
  • fix(kube): remove legacy import comments from test files e64d628a139fab8c876a1d2f4c2928096b286bed (Terry Howe)
  • pkg/kube: remove legacy import comments d7cdc9e8fb20c42d19a2371f37ee719be6be6b94 (abhay1999)
  • fix: Plugin version path traversal 36dcc27ca3c0cd6d0d08713b03dca82f43d7c5f9 (George Jenkins)
  • chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0 c4be7af2a14c1a01f21231ebb5dd41806fcb0797 (dependabot[bot])
  • chore: fix some minor issues in the comments 259f181808f267493d56eccd7f6191f78225a6fa (tsinglua)
  • fix: Chart dot-name path bug 60184996e5332d26e0b6390cefbf86776829dc46 (George Jenkins)
  • chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.1 to 0.23.3 74e7cf877a4a674b65f7b7894d2dfde2832e39b1 (dependabot[bot])
  • fix: insert newline after doc separators glued to content by template trimming af94abf976ce69dd635aaf086a0bb4b17bd95bc1 (Matheus Pimenta)
  • chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 16073b1e3c7b90cda41ed70c8192eb6d16816723 (dependabot[bot])
  • chore: enable modernize linter (#31860) e31a078e6e0667dde72ff3bf4b5dfb625127076f (Matthieu MOREL)
  • Restored --atomic flag on install command 16573f87f5aebf8c2f9c40e67cc3cbe5eb93e733 (Travis Leeden)
  • fix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394 b550ce90946b3b47cecd290fc5d0eee637ddb531 (Terry Howe)
  • fix: bump fluxcd/cli-utils to v0.37.2-flux.1 1dfa77ed8ba6f9e26542064248bc9eab40c1a662 (Terry Howe)
  • Update pkg/cmd/status.go 5d40f17011a477620841edb740d381a012716ae8 (Matthieu MOREL)
  • chore(internal): enable perfsprint linter (#31871) d4f6193a7ec7ae9ea479da3372eeaf22b445ebcc (Matthieu MOREL)
  • chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 82d9bedea7d3e342011d82e2e11ff83b396dffbe (dependabot[bot])
  • chore(pkg): fix perfsprint linter issues part 6 dc0e3f10c3ba8f25aa71c523d2e273690d338a17 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter e3c74fd9fae52c85899ee0ca9a0c1422d59e2bc2 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 1d2d63cc4330fcac786e70926f805b69c0b49ca2 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 63f03c0f5c41b53de3d432b446da9430da99f5bd (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter c25c988cfb7bbe3b139dec39cad1db4be33b13c6 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 0fecfd04c2f9a748046a8421595f3b9da6c895c7 (Matthieu MOREL)
  • chore(internal): enable perfsprint linter 6524162a0e39bed187a16b692243703d78735471 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 6c2cb2f54784b5ef6158dca0660f428a3baf75f5 (Matthieu MOREL)
  • chore(internal): enable perfsprint linter 9409226e15b26d05621f0b263f4ad6f597dfb7aa (Matthieu MOREL)
  • Replace unneeded use of t.Fatalf with t.Fatal 36cb3a2fe92a4564d2d7d79141f209af19b45d40 (Mads Jensen)
  • fix: enable nolinlint linter 5b6c6bbfc7ca9850c69d3823ca1e21b445e75c0d (Matthieu MOREL)
  • fixup strings.Cut variables b6673174220a2633fe97b5cd70a8386b79103464 (George Jenkins)
  • chore: Improve AGENTS.md 956c7245c346fc304c24ace930dada5f2c99f2b1 (George Jenkins)
  • chore: fixes 92b64e87ad6245d64d5b49bbbbf8dead83faac22 (George Jenkins)
  • fix: correct import comment in statuswait.go from v3 to v4 c59c140ce07ce973f16fe50c0c5e991e1d6308a6 (rohansood10)
  • fix: handle OCI digest algorithm prefix in chart downloader (#31601) ee018608f6fbf381fac1bae9759164a65c6a0b1f (Evans Mungai)
  • chore(deps): bump actions/stale from 10.1.1 to 10.2.0 304d25ffd34fafccbcb81713cb3cfff1be595ae5 (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates 0b134362f442fec44ace35e9cfae6760a6b4e005 (dependabot[bot])
  • feat(release): add internal/release/v2 package for chart v3 support (#31709) 4a91f3ad5cc0c1521f6d4dcb5681e2da4baaa157 (Evans Mungai)
  • chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 782385397ce1871f4c8a4d2e3c857937bd8988c9 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0 aec7aced38d053a2df5d0973abdf21848778a722 (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2 a23b6388ac74984460fd4055de5120d2fc03d841 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 5cddc95bed0572b8d63a910843f0a70477a4ce33 (dependabot[bot])
  • chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.21.0 to 0.21.1 2e266c3ec9d70a6e656f8041bb31475e25e9eb22 (dependabot[bot])
  • fix(pkg): errorlint linter 259f76a849391e6ff60a9a2e95ce7310d958c602 (Matthieu MOREL)
  • fix(internal): errorlint linter 025418291a7911441e7962895ba4bc24b72b55b3 (Matthieu MOREL)
  • fix(pkg): errorlint linter 6d1490ed1ea5968235087658d03bb440e4014a36 (Matthieu MOREL)
  • fix(pkg): errorlint linter 4d0ae7f33a09093f8f52d02b952e3822c87b8c5f (Matthieu MOREL)
  • fix(internal): errorlint linter abecafa0f507a69888877b9ddb714095714b64c8 (Matthieu MOREL)
  • fix(pkg): errorlint linter 4330bdea0409f428e75145f15532bfa0e2bc945c (Matthieu MOREL)
  • fix(pkg): errorlint linter c8989d984ff69e8ad21b27d6ac6193dd3150b1a7 (Matthieu MOREL)
  • fix(cmd): errorlint linter edbd705bd034246700cc0998016caa303cff42dc (Matthieu MOREL)
  • chore: new KEYS entry for George Jenkins 5638c35399464b6432ba81b92a341218991efa5c (George Jenkins)
  • fix(downloader): safely handle concurrent file writes on Windows 76eb37c01aaece271343039f44d7803017dd5c81 (Orgad Shaneh)
  • fix(install): check nil for restClientGetter and fix tests 9817a68618245370e98e09d7f06c7cc1cefe8a62 (Manuel Alonso)
  • feat(create): add --chart-api-version flag (when HELM_EXPERIMENTAL_CHART_V3 env var is set) (#31592) 5aac32077f87ed8cd80da1648abbd323320d4a0b (Evans Mungai)
  • chore(pkg): fix modernize linter 0d75d8611d3daa6b820d94fc95347a069b062f72 (Matthieu MOREL)
  • chore(internal): fix modernize linter 859292e31bd4ceb170050eaa49e727bcd69572e2 (Matthieu MOREL)
  • chore(pkg): fix modernize linter 5cc2e55714d20e6d1bd2663878a00571c084d6c2 (Matthieu MOREL)
  • chore(pkg): fix modernize linter ba38159313d4f09280591ba7f860ef0523716220 (Matthieu MOREL)
  • chore(internal): fix modernize linter e2d184c79e9049c19bcc466bfe1289ccc6b73717 (Matthieu MOREL)
  • chore(pkg): fix modernize linter 111d4e6e0e86af6ba25a355be1a7599f5258ee58 (Matthieu MOREL)
  • add image index test e8f386b5aac232c114a036598c2e3015fe296edc (Pedro Tôrres)
  • fix pulling charts from OCI indices d983696e354a9e0605cbb3034937dc84af42995c (Pedro Tôrres)
  • chore(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1 9c9c3a6b5c0f1cd1e4c4e9f002aa411c58dd656a (dependabot[bot])
  • Revert "Consider GroupVersionKind when matching resources" 787b61cedb933d22011e1da1368d0e615ea60ffe (Matheus Pimenta)
  • chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1 becf9bf7e33867a3f26affac34e9d51e277767bf (dependabot[bot])
  • fix(template): deprecate unused --hide-notes and --render-subchart-notes flags 6d5f56fa6e7c8e4462d80895fcce87b926e4b8ce (Scott Rigby)
  • chore(deps): bump github.com/fluxcd/cli-utils b53198e7eee04dab651c15cb7b3b6b77dd92553c (dependabot[bot])
  • chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 b59e533b7675122631e0733adbfd6b35dd3515a6 (dependabot[bot])
  • whitespace ec0726523e52448eb05c8b5b3faae969e3a79266 (Austin Abro)
  • fix(copystructure): handle nil elements in slice copying e3829ebbbb833e159926c6193e474eb9d067ef75 (Philipp Born)
  • use logger with waiter 63b40a7a5e0d3f00ef2b4c1de9f50fb7d6df4ead (Austin Abro)
  • feat(kstatus): fine-grained context options for waiting b0b35f1231b0b885b1624c5586938cfa69d30995 (Matheus Pimenta)
  • Apply suggestions from code review 26e28e846af1ceaf63e16c4f2e52bbfbab411ba1 (George Jenkins)
  • Remove legacy sync-repo.sh script 97fd00786f16ebc3b68164bff7133592f19f70b6 (Jeevan Yewale)
  • chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0 52620076e21ad6afd0f48df6772001b1466c966b (dependabot[bot])
  • docs: document uninstall using cascade foreground flag e70d59de7cd7ea2a501d809b3245ebfa0412e0ec (Evans Mungai)
  • bugfix(kstatus): do not wait forever on failed resources bbec77c1f762c4d92678e7f455951757a2e036a3 (Matheus Pimenta)
  • Modernize Helm v3 CONTRIBUTING.md 443a2a6924fc384e87ff4251e5ac9c077d607f0f (George Jenkins)
  • chore(defaults): server-side apply SDK defaults should always match the CLI defaults c1cc6253232d697ad2ae29957cc49de223306b62 (Matheus Pimenta)
  • chore: clarify --wait flag help text 828038a8fe2142599ec557da2d12bb88b76fa0dd (Evans Mungai)
  • chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 e22377124dbca4b032c55f522358def0415a0e8a (dependabot[bot])
  • chore(refactor): better testing and functionality for installing crd 6501ef490a45e9b7edfed1432702532c5b11c6d2 (Manuel Alonso)
  • bugfix(storage): fix storage not getting logger from driver a8eb5278478c940c615741312ca9f4fec0d84c1a (Matheus Pimenta)
  • chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 da1d68adea91ab13b308c059c39381d48045a73a (dependabot[bot])
  • fix(test): fix tests and check nil for restclient 0f949a92c149cf11e5bb19caf4d19d05567be6eb (Manuel Alonso)
  • fix(test): merge fix correctly 561410ae1d09c2aa289ff8d8cad5b7fa979cd135 (Manuel Alonso Gonzalez)
  • Remove refactorring changes from coalesce_test.go 0298b2ffd0823eead74c75e1b890b0bf47d0db62 (Evans Mungai)
  • Fix import b8937ad1922bca47be8bbf8e6274608ebc34a778 (Evans Mungai)
  • Update pkg/chart/common/util/coalesce_test.go a333bbaf273645bf53fb873228040ca8edde849a (Evans Mungai)
  • Fix rollback for missing resources 374aeb4b4e0463f72e3a0175138ed4bf7e87a156 (Feruzjon Muyassarov)
  • fix(install): add more tests and check nil file data 00f0a48a7dae379c2b6bd0dea43984d42b27a494 (Manuel Alonso)
  • fix(test): no check empty resources 0357e8d0f7eab074252ca49e1ca3aded834a001d (Manuel Alonso)
  • fix(install): check lenght and file nil, add tests 52235cc0bf7d0c8faf17c7dc8cddd77f93434aea (Manuel Alonso)
  • fix(action): crd resources can be empty 268593bf2e9769ef4b75328b33dfb4195e6e9e5a (Manuel Alonso)
  • fix: casing issue fixed 170911459bc4f2b5efea7e549e09bd45c7578cc4 (Mujib Ahasan)
  • fix: error handled correctly 94860626ce9c83a9227b5bce02a5c03a050816ac (Mujib Ahasan)
  • fix: doc string added 12e8b715aa0732b613c3a9896fa6af29b3201536 (Mujib Ahasan)
  • Fix lint warning 3416dd5f215a6421a70c6ab22340a96312ce8c0b (Evans Mungai)
  • Preserve nil values in chart already 679f0519804afeaa5ce8b930a30976ade2860fe0 (Evans Mungai)
  • fix(values): preserve nil values when chart default is empty map 292fe702193e8ba9ce4c8ffffdd90cdfa761501c (Evans Mungai)
  • update: test coverage added for helper function validateNameAndGenerateName 115409976b5c3fd94c893eabde114e655c01c573 (Mujib Ahasan)
  • update: helper function added for the business logic 522d2fe61508639cfe8f06a43235e7c3eaea3b9a (Mujib Ahasan)
  • generateName is also considered in logic 6769fb6fb6704e29fe1215c802ecf0ea62b39715 (Mujib Ahasan)
  • fxi: test concurrency download index 64bae717c58e80f05a60b84ddcd1f78387b4caee (Terry Howe)
  • update: business logic respected for skipping object missing name b357bcae8640508f110b7e63a8dfacd865c27b6e (Mujib Ahasan)
  • fixed: --dry-run=server now respect generateName 2820ebe8c97b7d7b8a447375b74c9cb3741a4ffa (Mujib Ahasan)
  • Make error message instructional for the case of lock file being out of date 1836c598f06377fd1571702fb2e0642f004cedef (Andreas Sommer)
New Contributors

Full Changelog: https://github.com/helm/helm/compare/v4.1.0...v4.2.0

View originalPermalink

v4.1.4Helm v4.1.4

Helm v4.1.4 is a security fix patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Security fixes
  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
  • GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
  • GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

A big thank you to the reporters of these issues (@maru1009, @1seal).

Installation and Upgrading

Download Helm v4.1.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026
Changelog
  • fix: Plugin missing provenance bypass 05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)
  • fix: Chart dot-name path bug 4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)
  • ignore error plugin loads (cli, getter) 25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)
  • fix: Plugin version path traversal 36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)

View originalPermalink