Bump the go_modules group across 1 directory with 7 updates

[dependabot]

Bumps the go_modules group with 1 update in the / directory: helm.sh/helm/v3.

Updates helm.sh/helm/v3 from 3.12.3 to 3.20.2

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.20.2

v3.20.2

Helm v3.20.2 is a security patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Security fixes

• GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment

Installation and Upgrading

Download Helm v3.20.2. The common platform binaries are here:

• MacOS amd64 (checksum / 7de04301f28b902a74f6286ed941cadc86ee5e6a9086a18f2ccf1f548e99d618)
• MacOS arm64 (checksum / 139c794c22f16b579d08ddd3008c8038b9bb2814f35b5bcca91f50a1f458978d)
• Linux amd64 (checksum / 258e830a9e613c8a7a302d6059b4bb3b9758f2f3e1bb8ea0d707ce10a9a72fea)
• Linux arm (checksum / a8a614c740399ff1ef32bcea6be6e4523f17e3376f9cf55c192cc48c8f2d1f19)
• Linux arm64 (checksum / 5ea2d6bc2cda3f8edf985e028809f5a9278f404fb8ab24044de9b7cb9b79a691)
• Linux i386 (checksum / 88e4c1834307cdbc9f3b80920e1a383e4ba50bb488fb0be1b1fbd4918bb6ae73)
• Linux ppc64le (checksum / 98bb26a2f3c0b0c1a50db3181dff192554e0c204a07427d98d6b01e259f23cbe)
• Linux s390x (checksum / 584dd77ef8096d6ef939a1822f72840e749fc8311b2b13ae94df5f786862a56b)
• Linux riscv64 (checksum / 957391d0710d72678acd09959b5dc77888cd007a78a4b99944d3b2fc7e1895ca)
• Windows amd64 (checksum / 24e8e5b71bab4ee17e6f989931ecf4fb144f9916cbe9990c0b6b2ec7b925c454)
• Windows arm64 (checksum / 7c940a73a6882f50b69aec3282549da4a49917669db18fc503db930fb74b9789)

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
• 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026

Changelog

• fix: Chart dot-name path bug 8fb76d6ab555577e98e23b7500009537a471feee (George Jenkins)
• fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 3a8927e275c50cecde273872dad2a5576bd46375 (Terry Howe)

Helm v3.20.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:

... (truncated)

Commits

• 8fb76d6 fix: Chart dot-name path bug
• 3a8927e fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow
• a2369ca chore(deps): bump the k8s-io group with 7 updates
• 90e1056 add image index test
• 911f2e9 fix pulling charts from OCI indices
• 76dad33 Remove refactorring changes from coalesce_test.go
• 45c12f7 Fix import
• 26c6f19 Update pkg/chart/common/util/coalesce_test.go
• 09f5129 Fix lint warning
• 417deb2 Preserve nil values in chart already
• Additional commits viewable in compare view

Updates github.com/containerd/containerd from 1.7.0 to 1.7.30

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.30

Welcome to the v1.7.30 release of containerd!

The thirtieth patch release for containerd 1.7 contains various fixes and updates.

Highlights

Container Runtime Interface (CRI)

• Fix NRI dropping requested CDI devices silently (#12650)
• Redact all query parameters in CRI error logs (#12551)

Runtime

• Update runc binary to v1.3.4 (#12619)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Derek McGowan
• Akihiro Suda
• Austin Vazquez
• Mike Brown
• Wei Fu
• Andrey Noskov
• CrazyMax
• Davanum Srinivas
• Jin Dong
• Krisztian Litkey
• Maksym Pavlenko
• Paweł Gronowski
• Phil Estes
• Samuel Karp

Changes

• Prepare release notes for v1.7.30 (#12652)
  • 3d0ca6d2e Prepare release notes for v1.7.30
• Fix NRI dropping requested CDI devices silently (#12650)
  • 0bc74f47e cri,nri: don't drop requested CDI devices silently.
• script/setup/install-cni: install CNI plugins v1.9.0 (#12660)
  • 7db16b562 script/setup/install-cni: install CNI plugins v1.9.0
• go.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) (#12640)
  • bca897b47 go.mod: golang.org/x/crypto v0.45.0
  • 37cbd2224 CI: drop Go 1.23

... (truncated)

Commits

• 71c1c86 Merge pull request #12652 from dmcgowan/prepare-1.7.30
• 3d0ca6d Prepare release notes for v1.7.30
• a8ce78b Merge pull request #12650 from klihub/fixes/1.7.x/nri-cdi-device-injection
• ba2b3a2 Merge pull request #12660 from AkihiroSuda/cni-1.9.0-1.7
• 0bc74f4 cri,nri: don't drop requested CDI devices silently.
• 7db16b5 script/setup/install-cni: install CNI plugins v1.9.0
• 3b655c2 Merge pull request #12640 from AkihiroSuda/dev-1.7
• bca897b go.mod: golang.org/x/crypto v0.45.0
• 37cbd22 CI: drop Go 1.23
• ee49d17 Update Go requirements in BUILDING
• Additional commits viewable in compare view

Updates github.com/cyphar/filepath-securejoin from 0.2.3 to 0.6.1

Release notes

Sourced from github.com/cyphar/filepath-securejoin's releases.

v0.6.0 -- "By the Power of Greyskull!"

While quite small code-wise, this release marks a very key point in the development of filepath-securejoin.

filepath-securejoin was originally intended (back in 2017) to simply be a single-purpose library that would take some common code used in container runtimes (specifically, Docker's FollowSymlinksInScope) and make it more general-purpose (with the eventual goals of it ending up in the Go stdlib).

Of course, I quickly discovered that this problem was actually far more complicated to solve when dealing with racing attackers, which lead to me developing openat2(2) and libpathrs. I had originally planned for libpathrs to completely replace filepath-securejoin "once it was ready" but in the interim we needed to fix several race attacks in runc as part of security advisories. Obviously we couldn't require the usage of a pre-0.1 Rust library in runc so it was necessary to port bits of libpathrs into filepath-securejoin. (Ironically the first prototypes of libpathrs were originally written in Go and then rewritten to Rust, so the code in filepath-securejoin is actually Go code that was rewritten to Rust then re-rewritten to Go.)

It then became clear that pure-Go libraries will likely not be willing to require CGo for all of their builds, so it was necessary to accept that filepath-securejoin will need to stay. As such, in v0.5.0 we provided more pure-Go implementations of features from libpathrs but moved them into pathrs-lite subpackage to clarify what purpose these helpers serve.

This release finally closes the loop and makes it so that pathrs-lite can transparently use libpathrs (via a libpathrs build-tag). This means that upstream libraries can use the pure Go version if they prefer, but downstreams (either downstream library users or even downstream distributions) are able to migrate to libpathrs for all usages of pathrs-lite in an entire Go binary.

I should make it clear that I do not plan to port the rest of libpathrs to Go, as I do not wish to maintain two copies of the same codebase. pathrs-lite already provides the core essentials necessary to operate on paths safely for most modern systems. Users who want additional hardening or more ergonomic APIs are free to use cyphar.com/go-pathrs (libpathrs's Go bindings).

Breaking

• The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

• pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to

... (truncated)

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.6.1] - 2025-11-19

At last up jumped the cunning spider, and fiercely held her fast.

Fixed

• Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
• A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

[0.5.2] - 2025-11-19

"Will you walk into my parlour?" said a spider to a fly.

Fixed

• Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
• A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

[0.6.0] - 2025-11-03

By the Power of Greyskull!

Breaking

• The deprecated MkdirAll, MkdirAllHandle, OpenInRoot, OpenatInRoot and Reopen wrappers have been removed. Please switch to using pathrs-lite directly.

Added

• pathrs-lite now has support for using libpathrs as a backend. This is opt-in and can be enabled at build time with the libpathrs build tag. The intention is to allow for downstream libraries and other projects to make use of the pure-Go github.com/cyphar/filepath-securejoin/pathrs-lite package and distributors can then opt-in to using libpathrs for the entire binary if they wish.

[0.5.1] - 2025-10-31

Spooky scary skeletons send shivers down your spine!

... (truncated)

Commits

• 9c4135b VERSION: release 0.6.1
• d952bef merge v0.5.x branch into main
• deb72a4 CHANGELOG: fix unreleased links
• 336bf8f merge #87 into cyphar/filepath-securejoin:v0.5.x
• 23c6e21 VERSION: back to development
• 6311ca8 VERSION: release v0.5.2
• 91da803 merge #86 into cyphar/filepath-securejoin:v0.5.x
• 4dbce7c gopathrs: close the fd after dup in openat2
• 1eaadd6 merge #85 into cyphar/filepath-securejoin:main
• c1c2a53 gopathrs: close the fd after dup in openat2
• Additional commits viewable in compare view

Updates github.com/sirupsen/logrus from 1.9.0 to 1.9.3

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.9.3

• Fix a potential denial of service vulnerability in logrus.Writer() that could be triggered by logging text longer than 64kb without newlines sirupsen/logrus@f9291a5 (re-apply sirupsen/logrus#1376)
• Fix panic in Writer sirupsen/logrus@d40e25c

Full Changelog: sirupsen/logrus@v1.9.2...v1.9.3

v1.9.2

• Revert sirupsen/logrus#1376, which introduced a regression in v1.9.1

Full Changelog: sirupsen/logrus@v1.9.1...v1.9.2

v1.9.1

What's Changed

• Fix data race in hooks.test package by @​FrancoisWagner in sirupsen/logrus#1362
• Add instructions to use different log levels for local and syslog by @​tommyblue in sirupsen/logrus#1372
• This commit fixes a potential denial of service vulnerability in logrus.Writer() that could be triggered by logging text longer than 64kb without newlines. by @​ozfive in sirupsen/logrus#1376
• Use text when shows the logrus output by @​xieyuschen in sirupsen/logrus#1339

New Contributors

• @​FrancoisWagner made their first contribution in sirupsen/logrus#1362
• @​tommyblue made their first contribution in sirupsen/logrus#1372
• @​ozfive made their first contribution in sirupsen/logrus#1376
• @​xieyuschen made their first contribution in sirupsen/logrus#1339

Full Changelog: sirupsen/logrus@v1.9.0...v1.9.1

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.9.3

Fixes:

• Re-apply fix for potential denial of service in logrus.Writer() when logging >64KB single-line payloads without newlines (#1376)
• Fix panic in Writer

1.9.2

Fixes:

• Revert Writer DoS fix (#1376) due to regression

1.9.1

Fixes:

• Fix potential denial of service in logrus.Writer() when logging >64KB single-line payloads without newlines (#1376)

Commits

• d40e25c fix panic in Writer
• f9291a5 Revert "Revert "Merge pull request #1376 from ozfive/master""
• 352781d Revert "Merge pull request #1376 from ozfive/master"
• b30aa27 Merge pull request #1339 from xieyuschen/patch-1
• 6acd903 Merge pull request #1376 from ozfive/master
• 105e63f Merge pull request #1 from ashmckenzie/ashmckenzie/fix-writer-scanner
• c052ba6 Scan text in 64KB chunks
• e59b167 Merge pull request #1372 from tommyblue/syslog_different_loglevels
• 766cfec This commit fixes a potential denial of service vulnerability in logrus.Write...
• 70234da Add instructions to use different log levels for local and syslog
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.11.0 to 0.46.0

Commits

• 19acf81 go.mod: update golang.org/x dependencies
• 3a1c6b4 x509roots/fallback: update bundle
• f4602e4 ssh/agent: fix flaky test by ensuring a writeable home directory
• 4e0068c go.mod: update golang.org/x dependencies
• e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
• f91f7a7 ssh/agent: prevent panic on malformed constraint
• 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
• bcf6a84 acme: pass context to request
• b4f2b62 ssh: fix error message on unsupported cipher
• 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.10.0 to 0.48.0

Commits

• 35e1306 go.mod: update golang.org/x dependencies
• 7c36036 http2, webdav, websocket: fix %q verb uses with wrong type
• ec11ecc trace: fix data race in RenderEvents
• bff14c5 http2: don't PING a responsive server when resetting a stream
• 88a6421 dns/dnsmessage: avoid use of "strings" and "math" in dns/dnsmessage
• 123d099 http2: support net/http.Transport.NewClientConn
• 346cc61 webdav: relax test to check for any redirect status, not just 301
• 9a29643 go.mod: update golang.org/x dependencies
• 07cefd8 context: deprecate
• 5ac9dac publicsuffix: don't treat ip addresses as domain names
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.5.0 to 0.30.0

Commits

• cf14319 oauth2: fix expiration time window check
• 32d34ef internal: include clientID in auth style cache key
• 2d34e30 oauth2: replace a magic number with AuthStyleUnknown
• 696f7b3 all: modernize with doc links and any
• 471209b oauth2: drop dependency on go-cmp
• 6968da2 oauth2: sync Token.ExpiresIn from internal Token
• d2c4e0a oauth2: context instead of golang.org/x/net/context in doc
• 883dc3c endpoints: add various endpoints from stale CLs
• 1c06e87 all: make use of oauth.Token.ExpiresIn
• 65c15a3 oauth2: remove extra period
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.