Skip to content
Release Radar

Helm

GitOps & Delivery

The package manager for Kubernetes

helm/helmWebsiteDocumentation
v3.22.0same day as v4.3.0
View on GitHub

Release history

v3.22.0

CompareGitHub

Helm v3.22.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • primarily dependency updates and k8s-io group to 0.37.0

Installation and Upgrading

Download Helm v3.22.0. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.1 and 3.22.1 are the next patch releases scheduled for October 14, 2026
  • 4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

  • chore(deps): bump the k8s-io group across 1 directory with 6 updates 144ca65 (dependabot[bot])
  • bump version to 3.22 (#32606) b5de8bb (Scott Rigby)
  • fix: set [pull,push] scope when helm push to a registry(use token auth) (backport) (#32362) 9dbcb9f (kimsungmin1)
  • chore(deps): bump the github-actions group across 1 directory with 4 updates (#32575) 665ab55 (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates (#32573) 0841093 (dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32563) d0569c7 (dependabot[bot])
  • chore(deps): bump the github-actions group across 1 directory with 4 updates (#32557) bcbdb1e (dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32554) 6cdcc8f (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32542) 158719f (dependabot[bot])
  • [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 (#32536) a442b8c (Scott Rigby)
  • fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 (#32535) adab0ef (Scott Rigby)
  • chore(deps): bump the github-actions group with 4 updates (#32524) c068b54 (dependabot[bot])
  • chore(deps): bump the github-actions group with 4 updates 74271c4 (dependabot[bot])
  • chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 1c50d2f (dependabot[bot])
  • chore(deps): bump the github-actions group with 4 updates (#32509) 8821540 (dependabot[bot])
  • chore(deps): bump actions/stale in the github-actions group (#32488) 05a2798 (dependabot[bot])
  • chore(deps): bump ossf/scorecard-action in the github-actions group (#32461) c27e757 (dependabot[bot])
  • fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 bd392c6 (Karan V)
  • chore(deps): bump the k8s-io group with 7 updates 66a6f56 (dependabot[bot])
  • chore(deps): bump the github-actions group with 4 updates 7cd0125 (dependabot[bot])
  • chore(deps): bump github/codeql-action/upload-sarif (#32449) 79330fc (dependabot[bot])
  • chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 (#32446) b29c730 (dependabot[bot])
  • chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 973bb34 (dependabot[bot])
  • chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 e25efcf (dependabot[bot])
  • chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 98e547f (dependabot[bot])
  • chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#32412) 7f4b72a (dependabot[bot])
  • chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 (#32381) 2cf1437 (dependabot[bot])
  • chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#32383) 270f73b (dependabot[bot])
  • chore(deps): bump github/codeql-action/upload-sarif (#32382) 9e3a010 (dependabot[bot])
  • ci: auto-label PRs targeting dev-v3 (#32340) c9ed0ca (Benoit Tigeot)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#32331) b842ddf (dependabot[bot])
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 (#32332) f6047c9 (dependabot[bot])
  • chore(deps): bump github/codeql-action/analyze from 3.26.6 to 4.37.0 (#32357) f2f6bf6 (dependabot[bot])
  • chore(deps): bump actions/checkout from 4.2.2 to 7.0.0 (#32368) 69f70a8 (dependabot[bot])
  • chore(deps): bump actions/stale from 9.0.0 to 10.4.0 (#32369) c95222a (dependabot[bot])
  • chore(deps): bump actions/setup-go from 5.1.0 to 6.5.0 (#32358) fc71f51 (dependabot[bot])
  • chore(deps): bump github/codeql-action/upload-sarif (#32360) 6596318 (dependabot[bot])
  • chore(deps): bump github/codeql-action/init from 3.26.6 to 4.37.0 (#32359) 5d9943c (dependabot[bot])
  • chore(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#32356) a3d7a6c (dependabot[bot])
  • chore(deps): bump golangci/golangci-lint-action from 6.1.1 to 9.3.0 (#32354) 8e19970 (dependabot[bot])
  • chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#32353) 24ef09a (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 (#32310) 8082dd4 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308) 2c24490 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.

…(truncated)

Helm v4.3.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

Installation and Upgrading

Download Helm v4.3.0. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.1 and 3.22.1 are the next patch releases scheduled for October 14, 2026
  • 4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

  • chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 bec5b06 (dependabot[bot])
  • chore(deps): bump the k8s-io group across 1 directory with 6 updates d0d42e7 (dependabot[bot])
  • bump version to 4.3 (#32605) 7328f42 (Scott Rigby)
  • chore: Fix independent-merge lint issues ca6681c (George Jenkins)
  • refactor(repo): Use byte buffer to build index file (#32579) 37752b7 (Tom Wieczorek)
  • chore: fix gofumpt extra-rules (#32486) 28e64bd (Matthieu MOREL)
  • Remove deprecated internal/chart/v3/ code (#32365) 4dfbaa4 (George Jenkins)
  • fix(template): regression - route registry messages to stderr in template and show (#32217) 9a3c040 (Aaron Mark)
  • refactor: remove per-file decompression size limit (#31748) 11e2010 (Benoit Tigeot)
  • Updating the Go version b5b498b (Matt Farina)
  • Updating the Go version 6d1f67c (Matt Farina)
  • chore(deps): bump the github-actions group across 1 directory with 4 updates (#32574) 0f4decb (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates (#32572) fb19300 (dependabot[bot])
  • fix: correct 'doest not match' in readiness debug logs 6888b0a (MsfPablo)
  • fix(provenance): support GnuPG keybox (pubring.kbx) keyrings (#32281) 67d54fd (Ruslan Shaydullin)
  • chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#32562) e9b85e4 (dependabot[bot])
  • chore(deps): bump the github-actions group across 1 directory with 4 updates (#32556) c000a40 (dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#32555) bafdcde (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#32545) 2a29f17 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 (#32543) edb94f8 (dependabot[bot])
  • test(loader): cover 8192-byte EOF boundary for LoadValues fd4ed49 (Dean Chen)
  • fix(loader): do not drop values files ending at a 4096-byte boundary 601445e (Dean Chen)
  • chore(deps): bump the github-actions group with 4 updates (#32523) f3d68cd (dependabot[bot])
  • fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#32521) a0c2f6d (Terry Howe)
  • chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 (#32514) f8a308c (dependabot[bot])
  • chore(deps): bump the github-actions group with 4 updates 47eb219 (dependabot[bot])
  • chore(deps): bump the github-actions group with 4 updates (#32508) ae877c8 (dependabot[bot])
  • test(action): poll for the interrupted install goroutine instead of a zero-margin sleep (#32328) a8ab76e (Nikolaus Schuetz)
  • chore(deps): bump actions/stale in the github-actions group (#32487) ac1c687 (dependabot[bot])
  • test(package): fix errorlint + exact path match in lock test e923167 (Ilya Kiselev)
  • fix(chart): normalize StampModTimes timestamp + Chart.lock test 3c3be92 (Ilya Kiselev)
  • chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 ce27485 (dependabot[bot])
  • fix(scripts): clarify cache-busting behavior bc0114c (Solomon Wakhungu)
  • chore: fix gofumpt issues 24bbb46 (Matthieu MOREL)
  • fix(scripts): address cache-busting review feedback bbaf420 (Solomon Wakhungu)
  • Make golangci-li

…(truncated)

Helm v3.21.4 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • fix(engine): prevent Files.Lines panic on empty file (backport to v3)- #32303 by @mahesh-sadupalli
  • fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932- #32463 by @karan-vk
  • [dev-v3 backport] fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158- #32535 by @scottrigby
  • [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061- #32536 by @scottrigby
  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0- (includes golang.org/x/text v0.40.0 to fix GO-2026-5970) #32308

Installation and Upgrading

Download Helm v3.21.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308) 813176c (dependabot[bot])
  • [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 b6aa8b1 (Scott Rigby)
  • fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 57ce7ae (Scott Rigby)
  • fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 ab71449 (Karan V)
  • fix(engine): prevent Files.Lines panic on empty file 955dfab (Mahesh Sadupalli)

Full Changelog: https://github.com/helm/helm/compare/v3.21.3...v3.21.4

Helm v4.2.4 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • fix: Improve error reporting for helm template --debug with --show-only- #31185 by @kyokuping
  • fix: fetch logs from all containers in test pods- #32099 by @SebTardif
  • fix(provenance): check error return in Digest and encodeRelease- #32136 by @SebTardif
  • fix panic on repeated IsReachable calls- #32184 by @atkrad
  • fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211 by @kimsungmin1
  • Fix missing conflict retry with server-side apply- #32088 by @Kajot-dev
  • Properly format the extra field in gzipped packages- #31884 by @ouillie
  • Fix vanishing empty lines- #32327 by @matheuscscp
  • fix: pass registry client to downloader.Manager in upgrade- #32400 by @SetagGnaw
  • chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1- for GO-2026-6061 #32450
  • fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158- #32521 by @TerryHowe

Installation and Upgrading

Download Helm v4.2.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Minimal fix to build failure from #31211. 3900f43 (Scott Rigby)
  • fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#32521) f7c6e8f (Terry Howe)
  • chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 035a2c3 (dependabot[bot])
  • fix: pass registry client to downloader.Manager in upgrade f76a5f4 (Gates Wang)
  • Apply suggestions 5a7c6c7 (Will Noble)
  • Properly format the extra field in gzipped packages 2281848 (Will Noble)
  • Fix missing conflict retry with server-side apply (#32088) 2c979a1 (Jakub Jaruszewski)
  • Potential fix for pull request finding 2bd2c66 (kimsungmin1)
  • fix(registry): resolve golangci-lint issues in token-auth tests 183a540 (kimsm28)
  • chore: go mod tidy after rebase on main 08d8da1 (kimsm28)
  • fix(registry): use plain-http registry in token-auth scope test 9655b5a (kimsm28)
  • Update pkg/registry/client.go 430dfac (Terry Howe)
  • test: improve client_scope_test.go to avoid data races and brittle assertions 9569605 (kimsm28)
  • fix typos in withScopeHint function comment 63f2b68 (kimsm28)
  • fix registry test failures by adjusting DockerRegistryHost and auth server listener management f7488c0 (kimsm28)
  • fix variable naming requestUrl -> requestURL 8fe78fb (kimsm28)
  • fix typo, remove unnecessary code, fix to avoid to use the assertion in http hanlder d0670d2 (kimsm28)
  • change suite.Nil, suite.NotNill to more proper function(suite.NoError, suite.Error) 804256e (kimsungmin1)
  • change client_scope_test.go to use httptest d79bceb (kimsungmin1)
  • fix typo d34fcd9 (kimsungmin1)
  • remove freeport dependency 9fbd190 (kimsungmin1)
  • add newline in license header 9275661 (kimsungmin1)
  • fix scope when helm push to a registry that use token auth fef91f3 (kimsungmin1)
  • fix panic on repeated IsReachable calls e89ce68 (Mohammad Abdolirad)
  • fix(provenance): check error return in Digest ff1ac83 (Sebastien Tardif)
  • fix: address review feedback 4b4dedb (Sebastien Tardif)
  • fix: fetch logs from all containers in test pods 7c80103 (Sebastien Tardif)
  • chore: rename savedErr to clear its specific purpose ecc9cd2 (Jeaeun Kim)
  • chore: fix lint f6211ba (Jeaeun Kim)
  • chore: store err separately for clarity 3507ea5 (Jeaeun Kim)
  • chore: Improve error reporting for helm template --debug with --show-only 211ffae (Jeaeun Kim)
  • Address review comments 51a9837 (Matheus Pimenta)
  • Fix vanishing empty lines 83a8b70 (Matheus Pimenta)

Full Changelog: https://github.com/helm/helm/compare/v4.2.3...v4.2.4

Helm v3.21.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.21.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Apply suggestions from code review 1ad6e68 (Benoit Tigeot)
  • fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e (Benoit Tigeot)
  • chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178b (dependabot[bot])

Helm v4.2.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v4.2.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe)

Helm v3.21.2 is a patch release to correct bump the Kubernetes client libraries (client-go, etc) to match the expected Kubernetes v1.36 release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Update Kubernetes client libraries to v1.36

Installation and Upgrading

Download Helm v3.21.2. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739 Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.21.3 will contain only bug fixes.
  • 3.22.0 is the next (and final) Helm 3 feature release

Changelog

  • chore(deps): bump the k8s-io group with 2 updates 1259634 (dependabot[bot])
  • fixes b52e276 (Matheus Pimenta)
  • chore(deps): bump the k8s-io group across 1 directory with 2 updates 3342dbf (dependabot[bot])

Full Changelog: https://github.com/helm/helm/compare/v3.21.1...v3.21.2

Helm v4.2.2 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214

Installation and Upgrading

Download Helm v4.2.2. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739 Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881c (George Jenkins)

Full Changelog: https://github.com/helm/helm/compare/v4.2.1...v4.2.2

Helm v4.2.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925
  • Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056
  • Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757
  • Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32081
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32153
  • Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #32128
  • Dependency updates

Installation and Upgrading

Download Helm v4.2.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • fix: protect FailingKubeClient.RecordedWaitOptions from data race (#31925) d591a19 (Terry Howe)
  • fix: route registry client output to stdout instead of stderr (#32056) 2a9fcae (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd6 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586d (dependabot[bot])
  • fix(version): avoid false range detection on prerelease x/X eabfae5 (Benoit Tigeot)
  • fix(version): version range || can has no space e3fd51f (Benoit Tigeot)
  • feat: report in debug the version we select with version range arg 1e47395 (Benoit Tigeot)
  • fix: prevent warning when using version range constraints a33e239 (Benoit Tigeot)
  • fix(kube): always propagate context.Canceled in WaitForDelete fa06d44 (Terry Howe)
  • fix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d483 (Terry Howe)
  • chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a (Terry Howe)
  • chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c575 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb (dependabot[bot])
  • chore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb62 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de05 (dependabot[bot])
  • fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803 (Matheus Pimenta)
  • chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02 (dependabot[bot])

Full Changelog: https://github.com/helm/helm/compare/v4.2.0...v4.2.1

Helm v3.21.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Fixed nil pointer panic that could happen with helm template in ClientOnly flows. Now correctly returns a template error https://github.com/helm/helm/pull/31920
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #32152
  • Bumped Go from 1.25 to 1.26 #32168
  • Dependency version updates

Installation and Upgrading

Download Helm v3.21.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • fix(action): avoid nil REST client getter panic when installing CRDs c56dd00 (sergiochan)
  • fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1 702529f (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 178e120 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 dcf35f8 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 44aff8b (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 ae2f31f (dependabot[bot])
  • Update .github/env 402225f (Terry Howe)
  • ci: bump golangci-lint to v2.11.3 for go 1.26 00eac21 (Terry Howe)
  • chore: bump go to 1.26 bec346a (Terry Howe)
  • chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.3 58b6ccf (dependabot[bot])
  • chore(deps): bump github.com/distribution/distribution/v3 30b9f51 (dependabot[bot])
  • chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.32 858aa47 (dependabot[bot])
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 1af25d4 (dependabot[bot])
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 97e4bc3 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 29bdd1b (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 bad6cd4 (Terry Howe)
  • chore(deps): bump k8s.io/klog/v2 from 2.130.1 to 2.140.0 75c2e9b (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.37.0 cd4dac3 (dependabot[bot])

Full Changelog: https://github.com/helm/helm/compare/v3.21.0...v3.21.1

Helm v3.21.0 is a feature release. Users are encouraged to upgrade for the best experience.

[!WARNING] Helm v3 is approaching end-of-life. Please update to Helm v4.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Kubernetes client libraries to v1.36
  • notable changes here

Installation and Upgrading

Download Helm v3.21.0. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739 Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.21.1 will contain only bug fixes.
  • 3.22.0 is the next feature release for Kubernetes v1.37

Changelog

  • [v3] Bump to version v3.21 e0878d4 (George Jenkins)
  • fix: upgrade opentelemetry packages to patch CVEs 13d5fc4 (Terry Howe)
  • fix: Chart dot-name path bug 2552884 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow ec05dd5 (Terry Howe)
  • add image index test b0dfec5 (Pedro Tôrres)
  • fix pulling charts from OCI indices e629995 (Pedro Tôrres)
  • chore(deps): bump the k8s-io group with 7 updates 9c854fb (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 a692247 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0 9f2a7f6 (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.1 to 1.11.2 79f039b (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.33.0 to 0.34.0 45210d5 (dependabot[bot])
  • Remove refactorring changes from coalesce_test.go e2df39f (Evans Mungai)
  • Fix import 97affe0 (Evans Mungai)
  • Update pkg/chart/common/util/coalesce_test.go c264166 (Evans Mungai)
  • Fix lint warning d409df8 (Evans Mungai)
  • Preserve nil values in chart already 6fdd101 (Evans Mungai)
  • fix(values): preserve nil values when chart default is empty map b13743c (Evans Mungai)
  • chore(deps): bump github.com/lib/pq from 1.10.9 to 1.11.1 703999d (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 a04be96 (dependabot[bot])

New Contributors

Full Changelog: https://github.com/helm/helm/compare/v3.20.0...v3.21.0

Helm v4.2.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Switch to goreleaser for release builds
  • Kubernetes client libraries to v1.36
  • Add mustToToml template function
  • deprecate unused --hide-notes and --render-subchart-notes flags
  • --dry-run=server now respects generateName:

Installation and Upgrading

Download Helm v4.2.0. The common platform binaries are here:

This release was signed by @gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739 Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.1 will contain only bug fixes
  • 4.3.0 is the next feature release

Changelog

  • Bump to version v4.2 0646808 (George Jenkins)
  • build: Clean up Goreleaser change (#32098) e23bf3a (Scott Rigby)
  • fix: add -extldflags -static to dist target to match build-cross f60ab7c (Terry Howe)
  • build: use goreleaser build with manual archive creation 64aa46f (Terry Howe)
  • chore: remove build-cross dependency from test-acceptance d199a1a (Terry Howe)
  • ci: add fetch-depth 0 to canary checkout for goreleaser 8289940 (Terry Howe)
  • fix: address goreleaser build issues flagged in review c075022 (Terry Howe)
  • fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd (Terry Howe)
  • fix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce (Terry Howe)
  • fix: use index for optional env var in version_template e49a1dc (Terry Howe)
  • fix: canary build file names eaa0910 (Terry Howe)
  • Fix archive name 5a75279 (Terry Howe)
  • fix goreleaser archive 37284a9 (Terry Howe)
  • add support for loong64 45336cc (Terry Howe)
  • fix artifact directory a9659b0 (Terry Howe)
  • update configuration to v2 e368f17 (Terry Howe)
  • remove GOTOOLCHAIN e7bea85 (Terry Howe)
  • chore: replace mitchellh/gox with goreleaser 075c096 (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 12f2c41 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 58e8ffd (dependabot[bot])
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 e61bbfb (dependabot[bot])
  • Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df (Matheus Pimenta)
  • fix: adds topLevel permissions to improve openSSF scores 277d970 (Gagan H R)
  • Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7 (Matheus Pimenta)
  • fix(templating): hooks conflicting with templates in post-renderers (#32049) 8f56f24 (Matheus Pimenta)
  • docs: fix grammar and spacing in CONTRIBUTING.md db40adb (Mohit)
  • chore(deps): bump the k8s-io group with 7 updates 775e794 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 934ace3 (dependabot[bot])
  • fix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#31952) 265c5eb (Matheus Pimenta)
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 48e2b7d (dependabot[bot])
  • Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai)
  • test(values): Add test for nil cleanup in partially overridden subchart maps 52fc971 (Johannes Lohmer)
  • fix(values): do not copy chart-default nils into coalesced values 0063877 (Johannes Lohmer)
  • test(values): add test for subchart nil producing %!s(<nil>) 6eb4ebf (Johannes Lohmer)
  • test(values): add tests for subchart nil value regressions 5cb4e7d (Johannes Lohmer)
  • chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 b5c7c80 (dependabot[bot])
  • fix(templating): fix wrong YAML separator parsing for post-renderers (#31941) a27f1ad (Matheus Pimenta)
  • fix: add debug logging to HTTP getter for helm pull c26be60 (Cairon)
  • chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 953f5f0 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0 10fc5f3 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0 d89e7c6 (dependabot[bot])
  • chore: Update release notes script for Helm v4 8a95461 (George Jenkins)
  • refactor(cli): share RetryingRoundTripper via pkg/kubeenv 213c869 (Sumit Solanki)
  • chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3 bd5027a (dependabot[bot])
  • fix: unnecessary-format lint issues from merge 087736b (George Jenkins)
  • fix: Plugin missing provenance bypass 586eb57 (George Jenkins)
  • chore(deps): bump github.com/fluxcd/cli-utils c8c5dfa (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 998466c (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp b0cec58 (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 6ebfb29 (dependabot[bot])
  • test(kube): fix flaky WaitForDelete test by avoiding informer sync race a7f8443

…(truncated)

v3.20.2

Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

Installation and Upgrading

Download Helm v3.20.2. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Chart dot-name path bug 8fb76d6 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e (Terry Howe)

Helm v4.1.4 is a security fix patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
  • GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
  • GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

A big thank you to the reporters of these issues (@maru1009, @1seal).

Installation and Upgrading

Download Helm v4.1.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

  • fix: Plugin missing provenance bypass 05fa379 (George Jenkins)
  • fix: Chart dot-name path bug 4e7994d (George Jenkins)
  • ignore error plugin loads (cli, getter) 2581943 (George Jenkins)
  • fix: Plugin version path traversal 36c8539 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e086 (Terry Howe)