Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
23 changes: 16 additions & 7 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ require (
google.golang.org/protobuf v1.36.11
gopkg.in/yaml.v2 v2.4.0
gopkg.in/yaml.v3 v3.0.1
helm.sh/helm/v3 v3.20.1
helm.sh/helm/v4 v4.1.4
k8s.io/api v0.35.4
k8s.io/apiextensions-apiserver v0.35.4
k8s.io/apimachinery v0.35.4
Expand All @@ -61,15 +61,15 @@ require (
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
github.com/Masterminds/squirrel v1.5.4 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/ProtonMail/go-crypto v1.1.6 // indirect
github.com/ProtonMail/go-crypto v1.3.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/chai2010/gettext-go v1.0.2 // indirect
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
github.com/cloudflare/circl v1.6.1 // indirect
github.com/cloudflare/circl v1.6.3 // indirect
github.com/containerd/containerd v1.7.32 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/log v0.1.0 // indirect
Expand All @@ -83,16 +83,19 @@ require (
github.com/docker/docker-credential-helpers v0.9.7 // indirect
github.com/docker/go-connections v0.7.0 // indirect
github.com/docker/go-metrics v0.0.1 // indirect
github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a // indirect
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
github.com/emirpasic/gods v1.18.1 // indirect
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
github.com/extism/go-sdk v1.7.1 // indirect
github.com/fatih/color v1.18.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fluxcd/cli-utils v0.37.2-flux.1 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/go-errors/errors v1.4.2 // indirect
github.com/go-errors/errors v1.5.1 // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-git/go-billy/v5 v5.7.0 // indirect
github.com/go-git/go-git/v5 v5.16.4 // indirect
Expand All @@ -116,6 +119,7 @@ require (
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
github.com/gobwas/glob v0.2.3 // indirect
github.com/gofrs/flock v0.13.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
github.com/google/btree v1.1.3 // indirect
Expand All @@ -135,6 +139,7 @@ require (
github.com/hashicorp/go-version v1.6.0 // indirect
github.com/helm/chart-testing/v3 v3.10.1 // indirect
github.com/huandu/xstrings v1.5.0 // indirect
github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
github.com/jmoiron/sqlx v1.4.0 // indirect
Expand Down Expand Up @@ -188,6 +193,8 @@ require (
github.com/spf13/pflag v1.0.10 // indirect
github.com/spf13/viper v1.20.1 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect
github.com/tetratelabs/wazero v1.11.0 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xanzy/ssh-agent v0.3.3 // indirect
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
Expand All @@ -199,6 +206,7 @@ require (
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.podman.io/image/v5 v5.40.0 // indirect
go.podman.io/storage v1.63.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
Expand All @@ -212,13 +220,14 @@ require (
golang.org/x/term v0.43.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/time v0.14.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
helm.sh/helm/v3 v3.17.1 // indirect

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) Inspect go.mod around the referenced line
echo "=== go.mod lines 200-260 ==="
nl -ba go.mod | sed -n '200,260p'

# 2) Find all helm v3/v4 references in go.mod/go.sum
echo
echo "=== helm v3 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v3" go.mod go.sum || true

echo
echo "=== helm v4 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v4" go.mod go.sum || true

# 3) Search code for helm v3 imports/uses
echo
echo "=== Search for helm v3 imports in repo ==="
rg -n "helm\.sh/helm/v3" -S --hidden --glob '!.git/*' . || true

echo
echo "=== Search for helm v4 imports in repo ==="
rg -n "helm\.sh/helm/v4" -S --hidden --glob '!.git/*' . || true

# 4) Check which module pulls in helm/v3 by looking for helm v3 in go.mod dependency graph textually
#    (no go command dependency on tools; best-effort: search go.mod for indirect requirements)
echo
echo "=== Any explicit require for helm v3 besides the snippet? (show full require blocks) ==="
awk '
  BEGIN{inreq=0}
  /^require \(/ {inreq=1; print ">> require block starts: " NR; next}
  inreq && /^\)/ {inreq=0; print ">> require block ends: " NR; next}
  inreq {print}
' go.mod | rg -n "helm\.sh/helm/v(3|4)" || true

Repository: openshift/console

Length of output: 151


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== go.mod lines 200-260 (with line numbers) ==="
awk 'NR>=200 && NR<=260 {printf "%d\t%s\n", NR, $0}' go.mod | sed -n '1,120p'

echo
echo "=== helm v3 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v3" go.mod go.sum || true

echo
echo "=== helm v4 references in go.mod/go.sum ==="
rg -n "helm\.sh/helm/v4" go.mod go.sum || true

echo
echo "=== Search for helm v3 imports in repo ==="
rg -n "helm\.sh/helm/v3" -S --hidden --glob '!.git/*' . || true

echo
echo "=== Search for helm v4 imports in repo ==="
rg -n "helm\.sh/helm/v4" -S --hidden --glob '!.git/*' . || true

echo
echo "=== Any explicit require for helm v3/v4 besides the snippet? (require blocks) ==="
awk '
  function printblock(bstart) {
    for (i=bstart;i<=NR;i++) print arr[i]
  }
  BEGIN{inreq=0}
  /^require \(/ {inreq=1}
  inreq {arr[NR]=$0}
  inreq && /^\)/ {inreq=0; # just continue; handled below
  }
  { }
' go.mod > /tmp/go.mod.req.tmp

# Print lines in go.mod containing helm v3/v4 plus a small neighborhood
rg -n "helm\.sh/helm/v(3|4)" -n go.mod -C 3 || true

Repository: openshift/console

Length of output: 50373


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Inspect pkg/helm/handlers/handlers.go imports ==="
if [ -f pkg/helm/handlers/handlers.go ]; then
  sed -n '1,120p' pkg/helm/handlers/handlers.go | nl -ba | sed -n '1,120p' 2>/dev/null || sed -n '1,120p' pkg/helm/handlers/handlers.go
else
  echo "Missing: pkg/helm/handlers/handlers.go"
  ls -R pkg/helm/handlers 2>/dev/null || true
fi

echo
echo "=== Non-vendor helm v3 imports ==="
rg -n "helm\.sh/helm/v3" --glob '!vendor/*' --glob '!.git/*' . || true

echo
echo "=== Non-vendor helm v4 imports ==="
rg -n "helm\.sh/helm/v4" --glob '!vendor/*' --glob '!.git/*' . || true

echo
echo "=== Non-vendor usage of chart-verifier (likely pulls helm v3) ==="
rg -n "redhat-certification/chart-verifier" --glob '!vendor/*' --glob '!.git/*' . || true

echo
echo "=== Non-vendor usage of helm-shaded chart-verifier packages (chartverifier) ==="
rg -n "chartverifier" --glob '!vendor/*' --glob '!.git/*' pkg . || true

Repository: openshift/console

Length of output: 19408


🌐 Web query:

OSV vulnerabilities for helm.sh/helm/v3 v3.17.1 (highest severity)

💡 Result:

As of June 12, 2026, version 3.17.1 of helm.sh/helm/v3 is affected by multiple vulnerabilities, including high-severity issues. The two most prominent vulnerabilities identified for this specific version are: 1. CVE-2025-32386 (GHSA-4hfp-h4cw-hj8p): A specially crafted chart archive can cause Out-Of-Memory (OOM) termination. A chart can be designed to expand to a significantly larger size when uncompressed, exhausting available memory during loading [1][2][3]. 2. CVE-2025-32387 (GHSA-5xqw-8hwv-wg92): A specially crafted JSON Schema within a chart can cause a stack overflow. Deeply nested chains of references in the schema can exceed the parser's stack size limit [4][5][6]. Both of these vulnerabilities have a severity rating of 6.5 (Medium, according to CVSS v3.1) and were resolved in Helm v3.17.3 [4][5][1][6][3]. Users running v3.17.1 are advised to upgrade to a patched version to mitigate these risks [6][3]. Additionally, version 3.17.1 is affected by CVE-2025-53547 (GHSA-557j-xg8c-q2mm), which involves potential local code execution when updating dependencies if a malicious Chart.lock symlink is present; this was resolved in Helm v3.17.4 and v3.18.4 [7].

Citations:


🌐 Web query:

osv.dev helm.sh/helm/v3 3.17.1 advisory

💡 Result:

Helm version 3.17.1 is affected by several security vulnerabilities that have been addressed in subsequent releases. Users are advised to upgrade to a newer version to mitigate these risks. Key vulnerabilities affecting Helm 3.17.1 include: 1. Stack Overflow via JSON Schema (CVE-2025-32387): A vulnerability exists where a specially crafted JSON Schema within a chart can lead to parser recursion, exceeding stack size limits and causing a stack overflow [1][2][3]. This was resolved in Helm v3.17.3 [1][2][3]. 2. Out-of-Memory (OOM) Termination via Chart Archive (CVE-2025-32386): Helm is vulnerable to OOM termination if a specially crafted chart archive is loaded, where the uncompressed size is significantly larger than the compressed size [4][5][6]. This issue was resolved in Helm v3.17.3 [4][5][6]. 3. Local Code Execution during Dependency Updates (CVE-2025-53547): A vulnerability involving malicious Chart.yaml content and symbolic links in Chart.lock files can lead to local code execution during dependency updates [7][8]. This was resolved in Helm v3.17.4 and v3.18.4 [7][8]. Given these vulnerabilities, upgrading to the latest available version of Helm is recommended to ensure all security patches are applied [7][2][5][8]. You can verify vulnerability statuses and associated advisories through the official OSV.dev database or the Helm GitHub repository security advisories page [1][9][7][2][5][8].

Citations:


Remove or patch the leftover Helm v3 module

go.mod still pins helm.sh/helm/v3 v3.17.1 // indirect, and this version is pulled into the vendored build via github.com/redhat-certification/chart-verifier (while the console’s own Helm handler code imports Helm v4). OSV reports multiple vulnerabilities for v3.17.1 (notably CVE-2025-32386, CVE-2025-32387, CVE-2025-53547), with fixes in v3.17.3/v3.17.4/v3.18.4. Update the transitive Helm v3 dependency by bumping the chart-verifier dependency (or pinning helm.sh/helm/v3 to the patched version via replace) so the module graph/vendor no longer uses v3.17.1.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm

(GO-2025-3601)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm

(GO-2025-3602)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

(GO-2025-3802)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm

(GO-2025-3887)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm May Panic Due To Incorrect YAML Content in helm.sh/helm

(GO-2025-3888)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

(GHSA-4hfp-h4cw-hj8p)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm vulnerable to Code Injection through malicious chart.yaml content

(GHSA-557j-xg8c-q2mm)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

(GHSA-5xqw-8hwv-wg92)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

(GHSA-9h84-qmv7-982p)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm May Panic Due To Incorrect YAML Content

(GHSA-f9f8-9pmf-xv68)


[HIGH] 230-230: helm.sh/helm/v3 3.17.1: Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

(GHSA-hr2v-4r36-88hr)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 230, The go.mod currently pulls helm.sh/helm/v3 v3.17.1
(transitively via github.com/redhat-certification/chart-verifier) which is
vulnerable; update the dependency graph by either (A) bumping
github.com/redhat-certification/chart-verifier to a newer version that itself
depends on a patched helm v3 (so the transitive helm.sh/helm/v3 resolves to >=
v3.17.3/v3.18.4), or (B) add a go.mod replace directive to pin helm.sh/helm/v3
to a patched release (e.g., v3.17.3 or v3.18.4) to override the transitive
v3.17.1; locate references to github.com/redhat-certification/chart-verifier and
helm.sh/helm/v3 in go.mod and update the chart-verifier module version or add
the replace line, then run go mod tidy && go mod vendor (if vendored) and verify
the module graph no longer contains helm.sh/helm/v3 v3.17.1.

Sources: Coding guidelines, Linters/SAST tools

@sowmya-sl sowmya-sl Jun 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

gh issue view 623 --repo redhat-certification/chart-verifier --json number,title,state,body,createdAt,updatedAt,comments | jq '{number, title, state, createdAt, updatedAt, bodyPreview: .body[:500], commentCount: (.comments | length), lastComments: (.comments[-3:] | map({author: .author.login, body: .body[:300]}) )}'

Length of output: 988



@sowmya-sl Thanks for filing redhat-certification/chart-verifier#623 to track the upstream upgrade. Since that issue is freshly opened and has no timeline yet, the transitive helm.sh/helm/v3 v3.17.1 will remain in the module graph for some time.

As a short-term mitigation until chart-verifier upgrades, consider adding a replace directive in go.mod to pin the transitive v3 dependency to a patched release:

// Temporary: pin transitive helm v3 (via chart-verifier) to patched release until
// redhat-certification/chart-verifier#623 is resolved.
replace helm.sh/helm/v3 => helm.sh/helm/v3 v3.17.4

Note: v3.17.4 fixes all currently known HIGH CVEs (CVE-2025-32386, CVE-2025-32387, CVE-2025-53547, and the additional ones flagged by OSV). You would then run go mod tidy && go mod vendor to apply it. Once chart-verifier ships a version that pulls in a patched helm v3 (or upgrades to v4), the replace can be removed.

k8s.io/apiserver v0.35.4 // indirect
k8s.io/component-base v0.35.4 // indirect
k8s.io/klog v1.0.0 // indirect
Expand All @@ -228,8 +237,8 @@ require (
oras.land/oras-go v1.2.6 // indirect
oras.land/oras-go/v2 v2.6.0 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/kustomize/api v0.20.1 // indirect
sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
sigs.k8s.io/kustomize/api v0.21.1 // indirect
sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 // indirect
)
Expand Down
44 changes: 30 additions & 14 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWSeaA=
github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
Expand Down Expand Up @@ -63,8 +63,8 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
github.com/cloudevents/sdk-go/v2 v2.16.0 h1:wnunjgiLQCfYlyo+E4+mFlZtAh7pKn7vT8MMD3lSwCg=
github.com/cloudevents/sdk-go/v2 v2.16.0/go.mod h1:5YWqklyhDSmGzBK/JENKKXdulbPq0JFf3c/KEnMLqgg=
github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
github.com/containerd/cgroups/v3 v3.1.2 h1:OSosXMtkhI6Qove637tg1XgK4q+DhR0mX8Wi8EhrHa4=
github.com/containerd/cgroups/v3 v3.1.2/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
Expand Down Expand Up @@ -142,6 +142,8 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4
github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4=
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a h1:UwSIFv5g5lIvbGgtf3tVwC7Ky9rmMFBp0RMs+6f6YqE=
github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a/go.mod h1:C8DzXehI4zAbrdlbtOByKX6pfivJTBiV9Jjqv56Yd9Q=
github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
Expand All @@ -154,10 +156,14 @@ github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjT
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
github.com/extism/go-sdk v1.7.1 h1:lWJos6uY+tRFdlIHR+SJjwFDApY7OypS/2nMhiVQ9Sw=
github.com/extism/go-sdk v1.7.1/go.mod h1:IT+Xdg5AZM9hVtpFUA+uZCJMge/hbvshl8bwzLtFyKA=
github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/fluxcd/cli-utils v0.37.2-flux.1 h1:tQ588ghtRN+E+kHq415FddfqA9v4brn/1WWgrP6rQR0=
github.com/fluxcd/cli-utils v0.37.2-flux.1/go.mod h1:LcWSu1NYET8d8U7O326RhEm5JkQXCMK6ITu4G1CT02c=
github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
Expand All @@ -168,8 +174,8 @@ github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sa
github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
github.com/go-git/go-billy/v5 v5.7.0 h1:83lBUJhGWhYp0ngzCMSgllhUSuoHP1iEWYjsPl9nwqM=
Expand Down Expand Up @@ -238,6 +244,8 @@ github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIx
github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
Expand Down Expand Up @@ -315,6 +323,8 @@ github.com/helm/chart-testing/v3 v3.10.1 h1:ByfJIFpvbau7u3Af1/Z2j01DdKGI4SBouSof
github.com/helm/chart-testing/v3 v3.10.1/go.mod h1:OFtBbzuUE1BhFY1LgG2WLhtG/+2b3VkBC8+SGzQAlDA=
github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca h1:T54Ema1DU8ngI+aef9ZhAhNGQhcRTrWxVeG07F+c/Rw=
github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
Expand Down Expand Up @@ -558,6 +568,10 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 h1:ZF+QBjOI+tILZjBaFj3HgFonKXUcwgJ4djLb6i42S3Q=
github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834/go.mod h1:m9ymHTgNSEjuxvw8E7WWe4Pl4hZQHXONY8wE6dMLaRk=
github.com/tetratelabs/wazero v1.11.0 h1:+gKemEuKCTevU4d7ZTzlsvgd1uaToIDtlQlmNbwqYhA=
github.com/tetratelabs/wazero v1.11.0/go.mod h1:eV28rsN8Q+xwjogd7f4/Pp4xFxO7uOGbLcD/LzB1wiU=
github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
Expand Down Expand Up @@ -723,8 +737,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
google.golang.org/genproto v0.0.0-20260202165425-ce8ad4cf556b h1:mJ7ODqDXbGE8alZwxCKWc9OTvpFQkXB6KRHvjnb9W8Q=
Expand Down Expand Up @@ -761,8 +775,10 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
helm.sh/helm/v3 v3.20.1 h1:T8PodUaH1UwNvE+imUA2mIKjJItY8g7CVvLVP5g4NzI=
helm.sh/helm/v3 v3.20.1/go.mod h1:Fl1kBaWCpkUrM6IYXPjQ3bdZQfFrogKArqptvueZ6Ww=
helm.sh/helm/v3 v3.17.1 h1:gzVoAD+qVuoJU6KDMSAeo0xRJ6N1znRxz3wyuXRmJDk=
helm.sh/helm/v3 v3.17.1/go.mod h1:nvreuhuR+j78NkQcLC3TYoprCKStLyw5P4T7E5itv2w=
helm.sh/helm/v4 v4.1.4 h1:zwTrNkalG4f7SYigRSdQnYrTj0QEz1qzetzAlYoDVSo=
helm.sh/helm/v4 v4.1.4/go.mod h1:5dSo8rRgn3OTkDAc/k0Ipw5/Q+BlqKIKZwa0XwSiINI=
k8s.io/api v0.35.4 h1:P7nFYKl5vo9AGUp1Z+Pmd3p2tA7bX2wbFWCvDeRv988=
k8s.io/api v0.35.4/go.mod h1:yl4lqySWOgYJJf9RERXKUwE9g2y+CkuwG+xmcOK8wXU=
k8s.io/apiextensions-apiserver v0.35.4 h1:HeP+Upp7ItdvnyGmub0yoix+2z5+ev4M5cE5TCgtOUU=
Expand Down Expand Up @@ -799,10 +815,10 @@ sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4i
sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
sigs.k8s.io/kustomize/api v0.20.1 h1:iWP1Ydh3/lmldBnH/S5RXgT98vWYMaTUL1ADcr+Sv7I=
sigs.k8s.io/kustomize/api v0.20.1/go.mod h1:t6hUFxO+Ph0VxIk1sKp1WS0dOjbPCtLJ4p8aADLwqjM=
sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A78=
sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 h1:2WOzJpHUBVrrkDjU4KBT8n5LDcj824eX0I5UKcgeRUs=
Expand Down
2 changes: 1 addition & 1 deletion pkg/helm/actions/auth.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ import (

configv1 "github.com/openshift/api/config/v1"
"github.com/openshift/api/helm/v1beta1"
"helm.sh/helm/v3/pkg/action"
"helm.sh/helm/v4/pkg/action"
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
)
Expand Down
2 changes: 1 addition & 1 deletion pkg/helm/actions/auth_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import (
configv1 "github.com/openshift/api/config/v1"
"github.com/openshift/api/helm/v1beta1"
"github.com/stretchr/testify/require"
"helm.sh/helm/v3/pkg/action"
"helm.sh/helm/v4/pkg/action"
v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
Expand Down
6 changes: 3 additions & 3 deletions pkg/helm/actions/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ package actions
import (
"net/http"

"helm.sh/helm/v3/pkg/action"
"helm.sh/helm/v3/pkg/cli"
"helm.sh/helm/v4/pkg/action"
"helm.sh/helm/v4/pkg/cli"
"k8s.io/cli-runtime/pkg/genericclioptions"
"k8s.io/client-go/rest"
"k8s.io/klog/v2"
Expand Down Expand Up @@ -49,7 +49,7 @@ func GetActionConfigurations(host, ns, token string, transport *http.RoundTrippe
confFlags.CAFile = &inClusterCfg.CAFile
}
conf := new(action.Configuration)
conf.Init(confFlags, ns, "secrets", klog.Infof)
conf.Init(confFlags, ns, "secrets")
registryClient, err := GetDefaultOCIRegistry()
if err != nil {
klog.V(4).Infof("Failed to get default OCI registry: %v", err)
Expand Down
6 changes: 3 additions & 3 deletions pkg/helm/actions/get_chart.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ import (
"os"

"github.com/openshift/api/helm/v1beta1"
"helm.sh/helm/v3/pkg/action"
"helm.sh/helm/v3/pkg/chart"
"helm.sh/helm/v3/pkg/chart/loader"
"helm.sh/helm/v4/pkg/action"
chart "helm.sh/helm/v4/pkg/chart/v2"
"helm.sh/helm/v4/pkg/chart/v2/loader"
Comment on lines +9 to +10

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This raises a red flag: the reason for upgrading to the v4 SDK is to get support for chart-v3 features, so simply replacing helm.sh/helm/v3/pkg/chart with helm.sh/helm/v4/pkg/chart/v2 may not be what we want (although, it might be OK as a first step to get to v4).


"k8s.io/client-go/dynamic"
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
Expand Down
19 changes: 8 additions & 11 deletions pkg/helm/actions/get_chart_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,11 @@ import (
"k8s.io/apimachinery/pkg/runtime/schema"

"github.com/stretchr/testify/require"
"helm.sh/helm/v3/pkg/action"
"helm.sh/helm/v3/pkg/chartutil"
kubefake "helm.sh/helm/v3/pkg/kube/fake"
"helm.sh/helm/v3/pkg/storage"
"helm.sh/helm/v3/pkg/storage/driver"
"helm.sh/helm/v4/pkg/action"
"helm.sh/helm/v4/pkg/chart/common"
kubefake "helm.sh/helm/v4/pkg/kube/fake"
"helm.sh/helm/v4/pkg/storage"
"helm.sh/helm/v4/pkg/storage/driver"
v1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/client-go/dynamic"
Expand Down Expand Up @@ -91,8 +91,7 @@ func TestGetChartWithoutTls(t *testing.T) {
RESTClientGetter: FakeConfig{},
Releases: store,
KubeClient: &kubefake.PrintingKubeClient{Out: io.Discard},
Capabilities: chartutil.DefaultCapabilities,
Log: func(format string, v ...interface{}) {},
Capabilities: common.DefaultCapabilities,
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
Expand Down Expand Up @@ -204,8 +203,7 @@ func TestGetChartWithTlsData(t *testing.T) {
RESTClientGetter: FakeConfig{},
Releases: store,
KubeClient: &kubefake.PrintingKubeClient{Out: io.Discard},
Capabilities: chartutil.DefaultCapabilities,
Log: func(format string, v ...interface{}) {},
Capabilities: common.DefaultCapabilities,
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
Expand Down Expand Up @@ -338,8 +336,7 @@ func TestGetChartBasicAuth(t *testing.T) {
RESTClientGetter: FakeConfig{},
Releases: store,
KubeClient: &kubefake.PrintingKubeClient{Out: io.Discard},
Capabilities: chartutil.DefaultCapabilities,
Log: func(format string, v ...interface{}) {},
Capabilities: common.DefaultCapabilities,
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
Expand Down
Loading