Release RadarDevOps/SRE release tracker

Helm

Delivery & GitOpsstable

The package manager for Kubernetes

Latest v3.21.3 on Jul 9, 2026 · same day as v4.2.3

helm/helmWebsiteDocumentation
kubernetespackaging

Release historylast 10 releases

v3.21.3

stableJul 9, 2026Compare v4.2.3 → v3.21.3
Release notes

Helm v3.21.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.21.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Apply suggestions from code review 1ad6e68924fdf6fb0c7dcef8e9e1dfc0f36eaed6 (Benoit Tigeot)
  • fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e7d51b08e30a0233bd546c345ab3ea3bba (Benoit Tigeot)
  • chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178ba06a8a1eeacaab1df9162b658b1e07fe9 (dependabot[bot])

v4.2.3

stableJul 9, 2026Compare v3.21.2 → v4.2.3
Release notes

Helm v4.2.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v4.2.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7feece8beb0fcba47059ec9b522fd929a64 (Terry Howe)

v3.21.2

stableJun 20, 2026Compare v4.2.2 → v3.21.2
Release notes

Helm v3.21.2 is a patch release to correct bump the Kubernetes client libraries (client-go, etc) to match the expected Kubernetes v1.36 release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Update Kubernetes client libraries to v1.36

Installation and Upgrading

Download Helm v3.21.2. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.21.3 will contain only bug fixes.
  • 3.22.0 is the next (and final) Helm 3 feature release

Changelog

  • chore(deps): bump the k8s-io group with 2 updates 125963406833fe0525be91f46c8b5b0f22fb9e32 (dependabot[bot])
  • fixes b52e27609b4420d206c1874ce9b0c75e271665e7 (Matheus Pimenta)
  • chore(deps): bump the k8s-io group across 1 directory with 2 updates 3342dbfec8f39776a9accd50fa91a52d68673af1 (dependabot[bot])

Full Changelog: https://github.com/helm/helm/compare/v3.21.1...v3.21.2

v4.2.2

stableJun 17, 2026Compare v4.2.1 → v4.2.2
Release notes

Helm v4.2.2 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214

Installation and Upgrading

Download Helm v4.2.2. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881cf967a5a09e19866799d0edfd40675803a (George Jenkins)

Full Changelog: https://github.com/helm/helm/compare/v4.2.1...v4.2.2

v4.2.1

stableJun 12, 2026Compare v3.21.1 → v4.2.1
Release notes

Helm v4.2.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925
  • Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056
  • Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757
  • Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32081
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32153
  • Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #32128
  • Dependency updates

Installation and Upgrading

Download Helm v4.2.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • fix: protect FailingKubeClient.RecordedWaitOptions from data race (#31925) d591a19b953bd9cfdf7d9ddd83c2f4ffdaeafb29 (Terry Howe)
  • fix: route registry client output to stdout instead of stderr (#32056) 2a9fcae29280472edec988c6bf0528e4ae79b33a (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd693eee68ba9c1ba42d160c69114eda962c (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf94008044a516cda4837565237306578a7 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891699ae9c8f2d0e06d5db3dd117649886a2 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2b7d4ed9ca3bb4be7562f76dd5f2fd8f71 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b0ef8882b062ba8f6b87261411309875b8 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586df3f2a79fca5202b6713f8675bb097a904 (dependabot[bot])
  • fix(version): avoid false range detection on prerelease x/X eabfae560459d1ffe1f7a3268d5441238e9f84b2 (Benoit Tigeot)
  • fix(version): version range || can has no space e3fd51f331e14fb4056951540d2f2ffde81b405c (Benoit Tigeot)
  • feat: report in debug the version we select with version range arg 1e47395a9566bcaaaf7ed9e31a8367eb1f95e0a3 (Benoit Tigeot)
  • fix: prevent warning when using version range constraints a33e23939a85ac60eb9a6bee818f2c5459fda576 (Benoit Tigeot)
  • fix(kube): always propagate context.Canceled in WaitForDelete fa06d4455724afe22bbe00af7925549a82d95e6c (Terry Howe)
  • fix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d4835df0fb8bd7cbde4cad0cbc79de01a6e93 (Terry Howe)
  • chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf21e31b5c33df82e67f23855d1358d021d (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e43f3620eb60ef3524527c1b2fceed90e9 (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a7461a524b87e5bb73ea5a0c4f82c72469 (Terry Howe)
  • chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c5751b1723239cbce042533db0d84b65c6bc1 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb364dbfb781059e628572d7177ba191cc4 (dependabot[bot])
  • chore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2a11b2e111acddcbc55d5a4733ba461f20 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb6263f59fe541acd75ce0b508034c65899e1 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16b58aa4cb9dbaf8c37055faa28b1b350ae (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de054b5ab1b59f60c790fad39861e294671f1 (dependabot[bot])
  • fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803bd4953d8ef9d51d927f492ecaaf5df9db (Matheus Pimenta)
  • chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02b9cd7fcba804391ab3d364739cb2a8780 (dependabot[bot])

Full Changelog: https://github.com/helm/helm/compare/v4.2.0...v4.2.1

v3.21.1

stableJun 12, 2026Compare v3.21.0 → v3.21.1
Release notes

Helm v3.21.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Fixed nil pointer panic that could happen with helm template in ClientOnly flows. Now correctly returns a template error https://github.com/helm/helm/pull/31920
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32152
  • Bumped Go from 1.25 to 1.26 #32168
  • Dependency version updates

Installation and Upgrading

Download Helm v3.21.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • fix(action): avoid nil REST client getter panic when installing CRDs c56dd0095fd76da5d7b30ecdf506103e7f26745e (sergiochan)
  • fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1 702529f90a0021e4d9df4880d6589198ec0e05f7 (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 178e120e16f5d61f769ee2c56a0d2a45ab7303bd (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 dcf35f86551322d93c1cb695f08435b3287e5ad0 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 44aff8bf51809ec9f8a906d050818776cd47b264 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 ae2f31f5a7d0cd789ca9fd83a6a2fe5fc7c3a1a3 (dependabot[bot])
  • Update .github/env 402225fffdc82a28a213af94ea269c4300f12700 (Terry Howe)
  • ci: bump golangci-lint to v2.11.3 for go 1.26 00eac21a89cd977868c0304917acd90220e07895 (Terry Howe)
  • chore: bump go to 1.26 bec346ac983fd0b860a13ef7750616e088143f01 (Terry Howe)
  • chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3 58b6ccffd3e3ade58543c50e76e6fb6c39393be5 (dependabot[bot])
  • chore(deps): bump github.com/distribution/distribution/v3 30b9f51d80b5853ef4031af168dd02491bbef9ab (dependabot[bot])
  • chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 858aa47b455f08516a6d977f93d609c24f985853 (dependabot[bot])
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 1af25d46939584205f0e3810fc547fcda727b1ec (dependabot[bot])
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 97e4bc30e57290d81b36972ce49f908d68fd9241 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 29bdd1bedd28bf816c7e26d356126489edf22945 (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 bad6cd478f5b3f3c96b795f4d6a010f04a89624f (Terry Howe)
  • chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0 75c2e9bf370eabf35a00e60cfceaee2b969ebe00 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0 cd4dac334caf38105aaae00ee8d4a9cb03de0b2c (dependabot[bot])

Full Changelog: https://github.com/helm/helm/compare/v3.21.0...v3.21.1

v3.21.0

stableMay 14, 2026Compare v4.2.0 → v3.21.0
Release notes

Helm v3.21.0 is a feature release. Users are encouraged to upgrade for the best experience.

[!WARNING] Helm v3 is approaching end-of-life. Please update to Helm v4.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Kubernetes client libraries to v1.36
  • notable changes here

Installation and Upgrading

Download Helm v3.21.0. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.21.1 will contain only bug fixes.
  • 3.22.0 is the next feature release for Kubernetes v1.37

Changelog

  • [v3] Bump to version v3.21 e0878d41b711792be60777fd65ad23a101e6b85f (George Jenkins)
  • fix: upgrade opentelemetry packages to patch CVEs 13d5fc4ae0e7222e1af8796ff4fa467b52208471 (Terry Howe)
  • fix: Chart dot-name path bug 2552884e3bc1b763c3901c5ea7240b59ef6791f1 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow ec05dd5f0481c2de3a41a554adf3c52a6a2a9bb6 (Terry Howe)
  • add image index test b0dfec5af4d7f642d8dea3b9058856541fe5017c (Pedro Tôrres)
  • fix pulling charts from OCI indices e629995c5d65ec2d5095ecd6d094bf85d02b3266 (Pedro Tôrres)
  • chore(deps): bump the k8s-io group with 7 updates 9c854fbd937ae0efe0e0a5063e7449d8973a85fd (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 a692247486fb6893f00af65fdfb05da538c7b1d5 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0 9f2a7f696a3e0be43ff9f55ade1dc89c76c6e903 (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2 79f039be716a0a48d354ffaaf97179bb4fae9d64 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 45210d597d7941ebe900bd8f317c0a62aa777395 (dependabot[bot])
  • Remove refactorring changes from coalesce_test.go e2df39fc0b3e713df923a7ae64412e327f6e1022 (Evans Mungai)
  • Fix import 97affe067aa1e39fe6552c0d46de749f02063183 (Evans Mungai)
  • Update pkg/chart/common/util/coalesce_test.go c264166ec6bbf61c400a3457fae87fa058487e76 (Evans Mungai)
  • Fix lint warning d409df87ff6c2cbe17cc465b93ce646003b71d28 (Evans Mungai)
  • Preserve nil values in chart already 6fdd1017cebc284f7d545c04dd2c8f2d350d69d2 (Evans Mungai)
  • fix(values): preserve nil values when chart default is empty map b13743c8d4ef5488f40148af1d6ccd35ee9b97e3 (Evans Mungai)
  • chore(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1 703999db8484985f4cafe000a610f10d688b2456 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 a04be9699efe5c26827397d7004b3490ad4ef029 (dependabot[bot])

New Contributors

Full Changelog: https://github.com/helm/helm/compare/v3.20.0...v3.21.0

v4.2.0

stableMay 14, 2026Compare v3.20.2 → v4.2.0
Release notes

Helm v4.2.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Switch to goreleaser for release builds
  • Kubernetes client libraries to v1.36
  • Add mustToToml template function
  • deprecate unused --hide-notes and --render-subchart-notes flags
  • --dry-run=server now respects generateName:

Installation and Upgrading

Download Helm v4.2.0. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.1 will contain only bug fixes
  • 4.3.0 is the next feature release

Changelog

  • Bump to version v4.2 06468084e85c244c712834933d25ea232a4c2093 (George Jenkins)
  • build: Clean up Goreleaser change (#32098) e23bf3af53c52185123278e83b7023c102707778 (Scott Rigby)
  • fix: add -extldflags -static to dist target to match build-cross f60ab7c31c81a73b8e0aade5aff41bfc01c08820 (Terry Howe)
  • build: use goreleaser build with manual archive creation 64aa46f2f1cf239cf6535c5e847e14dcb933a847 (Terry Howe)
  • chore: remove build-cross dependency from test-acceptance d199a1a42c04bccb287f2c7d9c3f73b669412e5a (Terry Howe)
  • ci: add fetch-depth 0 to canary checkout for goreleaser 82899404a68f3826389bb38cf67bf75085db6b2c (Terry Howe)
  • fix: address goreleaser build issues flagged in review c075022ce16489f5f7afd45a37b679cf58fa36ea (Terry Howe)
  • fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd905b6f8a823733dbc9b9f5cb2843a975f (Terry Howe)
  • fix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce66cb6374d9d7b552802f53b21ea2c2dd1 (Terry Howe)
  • fix: use index for optional env var in version_template e49a1dc16eee526928d8928b8d96c01ee513ebd9 (Terry Howe)
  • fix: canary build file names eaa09100b9b18175d878b1e114cbe9df2a3f70c2 (Terry Howe)
  • Fix archive name 5a75279c1a017a60b97bd44986288af7399c6ff8 (Terry Howe)
  • fix goreleaser archive 37284a9211972f7f41a2acc3c3313517596dd4b0 (Terry Howe)
  • add support for loong64 45336ccd5b2621357e3f785c1fe93627c5990a6e (Terry Howe)
  • fix artifact directory a9659b07e3eec20ab5b964fddae05f51f478f704 (Terry Howe)
  • update configuration to v2 e368f170af8a200e672adac5f765b8101db0c8fa (Terry Howe)
  • remove GOTOOLCHAIN e7bea8513c30475664919f031774e18fecdf1f66 (Terry Howe)
  • chore: replace mitchellh/gox with goreleaser 075c096afec70155bc43ac3587a119df1ae5fcc6 (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 12f2c41c0d7a74739c58a5995cbbb3125d9247e5 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 58e8ffdc3302260b1b55718c9b72c6f169a76ee0 (dependabot[bot])
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 e61bbfbfff41958b0ba1984e4d6799fe131f325e (dependabot[bot])
  • Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6dff537087f52ec6e470d8986439e24e8e33 (Matheus Pimenta)
  • fix: adds topLevel permissions to improve openSSF scores 277d9702555532d13426119d31c70fffb389d589 (Gagan H R)
  • Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7a314d98456a2f23798a78e9ad05d96d0c (Matheus Pimenta)
  • fix(templating): hooks conflicting with templates in post-renderers (#32049) 8f56f24d638612a46f3e23265d06338c1f93bccb (Matheus Pimenta)
  • docs: fix grammar and spacing in CONTRIBUTING.md db40adb1d13573280b65bc2002df7d75c009235a (Mohit)
  • chore(deps): bump the k8s-io group with 7 updates 775e794319639f5c1e6b40448ce15ad3cc10d4e1 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 934ace35dfaef9eeb9997bf1ee385db0986daecc (dependabot[bot])
  • fix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#31952) 265c5eb530a36ec651e79ecf4d37ba2f098b7e59 (Matheus Pimenta)
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 48e2b7ddd4e960b768fe5daee34a33cb89852a6e (dependabot[bot])
  • Update pkg/chart/common/util/coalesce.go a8e249714f5311b9aff44c4bd2bfc433ab1ab952 (Evans Mungai)
  • test(values): Add test for nil cleanup in partially overridden subchart maps 52fc971da37cf34aa26e7d7c460f2430dfb01b26 (Johannes Lohmer)
  • fix(values): do not copy chart-default nils into coalesced values 00638773d1366dc962c785de3d297cf0279b9a0d (Johannes Lohmer)
  • test(values): add test for subchart nil producing %!s() 6eb4ebf0e1afb0c63d748bf116145a5b9e0842b7 (Johannes Lohmer)
  • test(values): add tests for subchart nil value regressions 5cb4e7d992d85d372f5d86c238330102d936bfe5 (Johannes Lohmer)
  • chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 b5c7c80de317643e383ca2926ebc0ad884021bba (dependabot[bot])
  • fix(templating): fix wrong YAML separator parsing for post-renderers (#31941) a27f1add79c6c02459413dbb60f8438d8051cf06 (Matheus Pimenta)
  • fix: add debug logging to HTTP getter for helm pull c26be60d81e5cb6a147d6088477cf86fd5aaf1f0 (Cairon)
  • chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 953f5f031bb7fa8f3eccdea6520e09fd44fe3923 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0 10fc5f335b5fbb09f5d04cb0450839790ae15634 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0 d89e7c60762910204044c4215c7bb2f43ac3ef8f (dependabot[bot])
  • chore: Update release notes script for Helm v4 8a954619255a82890a08b7d1fa9e86a437c4cebb (George Jenkins)
  • refactor(cli): share RetryingRoundTripper via pkg/kubeenv 213c869a988f2c7390c65673e3d677970d6220fd (Sumit Solanki)
  • chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3 bd5027a9cf07993d7bfe4b60702b1a489fe8783e (dependabot[bot])
  • fix: unnecessary-format lint issues from merge 087736b66e97393ccaa0bdf1e5df13dcc9d88340 (George Jenkins)
  • fix: Plugin missing provenance bypass 586eb57338d848e65686a3a9616e2776e87cfd1e (George Jenkins)
  • chore(deps): bump github.com/fluxcd/cli-utils c8c5dfad630cd7b238236c619c466488a547725c (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 998466cfcfee189ce7e3df5be8ffe79ed5f1f097 (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp b0cec589f50a7e16d942ad3385598a6dda2b0a20 (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 6ebfb29dbf006ce78e9af8878008bda3578dcd3e (dependabot[bot])
  • test(kube): fix flaky WaitForDelete test by avoiding informer sync race a7f8443

…(truncated)

v3.20.2

stableApr 9, 2026Compare v4.1.4 → v3.20.2
Release notes

v3.20.2

Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

Installation and Upgrading

Download Helm v3.20.2. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Chart dot-name path bug 8fb76d6ab555577e98e23b7500009537a471feee (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e275c50cecde273872dad2a5576bd46375 (Terry Howe)

v4.1.4

stableApr 9, 2026
Release notes

Helm v4.1.4 is a security fix patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
  • GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
  • GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

A big thank you to the reporters of these issues (@maru1009, @1seal).

Installation and Upgrading

Download Helm v4.1.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Plugin missing provenance bypass 05fa37973dc9e42b76e1d2883494c87174b6074f (George Jenkins)
  • fix: Chart dot-name path bug 4e7994d4467182f535b6797c94b5b0e994a91436 (George Jenkins)
  • ignore error plugin loads (cli, getter) 25819432bf87ac0b54f0d3fa54982add2cac609e (George Jenkins)
  • fix: Plugin version path traversal 36c8539e99bc42d7aef9b87d136254662d04f027 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e0860ec797330a4c26a78dde7020cdc6743b1 (Terry Howe)