Accepting request 1291506 from Virtualization:containers

- Update to version 3.18.4 (bsc#1246152, CVE-2025-53547):
  * Disabling linter due to unknown issue f20a4ad (Matt Farina)
  * build(deps): bump the k8s-io group with 7 updates 563b094
    (dependabot[bot])
  * Updating link handling 00de613 (Matt Farina)

OBS-URL: https://build.opensuse.org/request/show/1291506
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/helm?expand=0&rev=85

_service

@@ -5,7 +5,7 @@
     <param name="exclude">.git</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">v(.*)</param>
-    <param name="revision">v3.15.4</param>
+    <param name="revision">v3.18.4</param>
     <param name="changesgenerate">enable</param>
   </service>
   <service name="set_version" mode="manual">

_servicedata

@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/helm/helm.git</param>
-              <param name="changesrevision">fa9efb07d9d8debbb4306d72af76a383895aa8c4</param></service></servicedata>
+              <param name="changesrevision">d80839cf37d860c8aa9a0503fe463278f26cd5e2</param></service></servicedata>

helm-3.15.4.obscpio

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:60d60b563999f69dc77909b277aa0339b1812ed5cf313326241ba036ee98751d
-size 2897420

helm.changes

@@ -1,3 +1,287 @@
+-------------------------------------------------------------------
+Wed Jul 09 04:44:40 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- Update to version 3.18.4 (bsc#1246152, CVE-2025-53547):
+  * Disabling linter due to unknown issue f20a4ad (Matt Farina)
+  * build(deps): bump the k8s-io group with 7 updates 563b094
+    (dependabot[bot])
+  * Updating link handling 00de613 (Matt Farina)
+
+-------------------------------------------------------------------
+Tue Jun 17 04:30:30 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- Update to version 3.18.3:
+  * build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0
+    6838ebc (dependabot[bot])
+  * fix: user username password for login 5b9e2f6 (Terry Howe)
+  * Update pkg/registry/transport.go 2782412 (Terry Howe)
+  * Update pkg/registry/transport.go e66cf6a (Terry Howe)
+  * fix: add debug logging to oci transport 191f05c (Terry Howe)
+
+-------------------------------------------------------------------
+Tue Jun 10 08:14:00 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- remove flaky test
+  * cmd/helm/dependency_build_test.go
+  * cmd/helm/dependency_update_test.go
+  * cmd/helm/pull_test.go
+  * cmd/helm/registry_login_test.go
+
+-------------------------------------------------------------------
+Mon Jun 02 15:44:48 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- Update to version 3.18.2:
+  * fix: legacy docker support broken for login 04cad46 (Terry
+    Howe)
+  * Handle an empty registry config file. bc9f8a2 (Matt Farina)
+
+-------------------------------------------------------------------
+Sat May 31 05:20:36 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- Update to version 3.18.1:
+  * Notes:
+    - This release fixes regressions around template generation and
+      OCI registry interaction in 3.18.0
+    - There are at least 2 known regressions unaddressed in this
+      release. They are being worked on.
+      - Empty registry configuration files. When the file exists
+        but it is empty.
+      - Login to Docker Hub on some domains fails.
+  * Changelog
+    - fix(client): skipnode utilization for PreCopy
+    - fix(client): layers now returns manifest - remove duplicate
+      from descriptors
+    - fix(client): return nil on non-allowed media types
+    - Prevent fetching newReference again as we have in calling
+      method
+    - Prevent failure when resolving version tags in oras memory
+      store
+    - Update pkg/plugin/plugin.go
+    - Update pkg/plugin/plugin.go
+    - Wait for Helm v4 before raising when platformCommand and
+      Command are set
+    - Fix 3.18.0 regression: registry login with scheme
+    - Revert "fix (helm) : toToml` renders int as float [ backport
+      to v3 ]"
+
+-------------------------------------------------------------------
+Thu May 22 18:13:21 UTC 2025 - Andreas Schwab <schwab@suse.de>
+
+- Don't disable CGO on riscv64
+
+-------------------------------------------------------------------
+Tue May 20 19:29:23 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- reduce parallelism even more on tests
+
+-------------------------------------------------------------------
+Tue May 20 04:35:56 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- Update to version 3.18.0 (bsc#1241802, CVE-2025-22872):
+  * Notable Changes
+    - Add support for JSON Schema 2020
+    - Enabled cpu and memory profiling
+    - Add hook annotation to output hook logs to client on error
+  * Changelog
+    - build(deps): bump the k8s-io group with 7 updates
+    - fix: govulncheck workflow
+    - bump version to v3.18.0
+    - fix:add proxy support when mTLS configured
+    - docs: Note about http fallback for OCI registries
+    - Bump net package to avoid CVE on dev-v3
+    - Bump toml
+    - backport #30677to dev3
+    - build(deps): bump github.com/rubenv/sql-migrate from 1.7.2 to
+      1.8.0
+    - Add install test for TakeOwnership flag
+    - Fix --take-ownership
+    - build(deps): bump github.com/rubenv/sql-migrate from 1.7.1 to
+      1.7.2
+    - build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0
+    - build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0
+    - Testing text bump
+    - Permit more Go version and not only 1.23.8
+    - Bumps github.com/distribution/distribution/v3 from 3.0.0-rc.3
+      to 3.0.0
+    - Unarchiving fix
+    - Fix typo
+    - Report as debug log, the time spent waiting for resources
+    - build(deps): bump github.com/containerd/containerd from
+      1.7.26 to 1.7.27
+    - Update pkg/registry/fallback.go
+    - automatic fallback to http
+    - chore(oci): upgrade to ORAS v2
+    - Updating to 0.37.0 for x/net
+    - build(deps): bump the k8s-io group with 7 updates
+    - build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0
+    - build(deps): bump github.com/opencontainers/image-spec
+    - build(deps): bump github.com/containerd/containerd from
+      1.7.25 to 1.7.26
+    - build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0
+    - Fix cherry-pick helm.sh/helm/v4 -> helm.sh/helm/v3
+    - Refactor based on review comment
+    - Refactor based on review comment
+    - Add HookOutputFunc and generic yaml unmarshaller
+    - clarify fix error message
+    - fix err check
+    - remove comments about previous functionality
+    - add short circuit return
+    - Update based on review comments
+    - Update based on review comments
+    - Fix lint
+    - Tidy up imports
+    - Add hook annotations to output pod logs to client on success
+      and fail
+    - chore: use []error instead of []string
+    - Update cmd/helm/profiling.go
+    - chore: update profiling doc in CONTRIBUTING.md
+    - Update CONTRIBUTING guide
+    - Prefer environment variables to CLI flags
+    - Fix linter warning
+    - Move pprof paths to HELM_PPROF env variable
+    - Update CONTRIBUTING.md
+    - Update CONTRIBUTING.md
+    - Additional review fixes from PR
+    - feat: Add flags to enable CPU and memory profiling
+    - build(deps): bump github.com/distribution/distribution/v3
+    - build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1
+    - Moving to SetOut and SetErr for Cobra
+    - build(deps): bump the k8s-io group with 7 updates
+    - build(deps): bump golang.org/x/crypto from 0.32.0 to 0.33.0
+    - build(deps): bump golang.org/x/term from 0.28.0 to 0.29.0
+    - build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0
+    - build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6
+    - build(deps): bump github.com/cyphar/filepath-securejoin
+    - build(deps): bump github.com/evanphx/json-patch
+    - build(deps): bump the k8s-io group with 7 updates
+    - fix: check group for resource info match
+    - Bump github.com/cyphar/filepath-securejoin from 0.3.6 to
+      0.4.0
+    - add test for nullifying nested global value
+    - Ensuring the file paths are clean prior to passing to
+      securejoin
+    - Bump github.com/containerd/containerd from 1.7.24 to 1.7.25
+    - Bump golang.org/x/crypto from 0.31.0 to 0.32.0
+    - Bump golang.org/x/term from 0.27.0 to 0.28.0
+    - bump version to v3.17.0
+    - Bump github.com/moby/term from 0.5.0 to 0.5.2
+    - Add test case for removing an entire object
+    - Tests for bugfix: Override subcharts with null values #12879
+    - feat: Added multi-platform plugin hook support to v3
+    - This commit fixes the issue where the yaml.Unmarshaller
+      converts all int values into float64, this passes in option
+      to decoder, which enables conversion of int into .
+    - merge null child chart objects
+
+-------------------------------------------------------------------
+Thu Apr 10 04:56:46 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- Update to version 3.17.3:
+  Helm v3.17.3 is a security (patch) release. Users are strongly
+  recommended to update to this release.
+  * Changelog
+    - Unarchiving fix e4da497 (Matt Farina)
+
+-------------------------------------------------------------------
+Thu Mar 13 18:16:55 UTC 2025 - opensuse_buildservice@ojkastl.de
+
+- Update to version 3.17.2 (bsc#1238688, CVE-2025-22870):
+  * Updating to 0.37.0 for x/net
+  * build(deps): bump the k8s-io group with 7 updates
+
+-------------------------------------------------------------------
+Mon Mar 10 16:41:05 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- skip 32bit builds on SLFO
+
+-------------------------------------------------------------------
+Fri Feb 14 11:52:56 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- reduce test flakyness by limiting parallelism to what upstream
+  uses
+
+-------------------------------------------------------------------
+Thu Feb 13 06:16:05 UTC 2025 - opensuse_buildservice@ojkastl.de
+
+- Update to version 3.17.1:
+  * add test for nullifying nested global value
+  * Add test case for removing an entire object
+  * Tests for bugfix: Override subcharts with null values #12879
+  * merge null child chart objects
+  * build(deps): bump the k8s-io group with 7 updates
+  * fix: check group for resource info match
+
+-------------------------------------------------------------------
+Thu Jan 16 05:57:13 UTC 2025 - Johannes Kastl <opensuse_buildservice@ojkastl.de>
+
+- Update to 3.17.0 (bsc#1235318, CVE-2024-45338):
+  Full changelog:
+  https://github.com/helm/helm/releases/tag/v3.17.0
+  * Notable Changes
+    - Allow pulling and installation by OCI digest
+    - Annotations and dependencies are now in chart metadata output
+    - New --take-ownership flag for install and upgrade commands
+    - SDK: Authorizer and registry authorizer are now configurable
+    - Removed the Kubernetes configuration file permissions check
+    - Added username/password to helm push and dependency
+      build/update subcommands
+    - Added toYamlPretty template function
+
+-------------------------------------------------------------------
+Mon Dec 16 21:45:40 UTC 2024 - dmueller@suse.com
+
+- Update to version 3.16.4 (bsc#1234482, CVE-2024-45337):
+  * Bump golang.org/x/crypto from 0.30.0 to 0.31.0
+  * Bump the k8s-io group with 7 updates
+
+-------------------------------------------------------------------
+Thu Nov 14 13:05:38 UTC 2024 - dmueller@suse.com
+
+- Update to version 3.16.3:
+  * fix: fix label name
+  * Fix typo in pkg/lint/rules/chartfile_test.go
+  * Increasing the size of the runner used for releases.
+  * fix(hooks): correct hooks delete order
+  * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23
+
+-------------------------------------------------------------------
+Fri Oct 11 08:24:54 UTC 2024 - opensuse_buildservice@ojkastl.de
+
+- Update to version 3.16.2:
+  * Revering change unrelated to issue #13176
+  * adds tests for handling of Helm index with broken chart
+    versions #13176
+  * improves handling of Helm index with broken helm chart versions
+    #13176
+  * Bump the k8s-io group with 7 updates
+  * adding check-latest:true
+  * Grammar fixes
+  * Fix typos
+
+-------------------------------------------------------------------
+Sat Sep 14 14:00:08 UTC 2024 - opensuse_buildservice@ojkastl.de
+
+- Update to version 3.16.1:
+  * bumping version to 1.22.7
+  * Merge pull request #13327 from mattfarina/revert-11726
+
+-------------------------------------------------------------------
+Sat Sep 14 13:55:08 UTC 2024 - opensuse_buildservice@ojkastl.de
+
+- Update to version 3.16.0:
+  Helm v3.16.0 is a feature release. Users are encouraged to
+  upgrade for the best experience.
+  * Notable Changes
+    - added sha512sum template function
+    - added ActiveHelp for cmds that don't take any more args
+    - drops very old Kubernetes versions support in helm create
+    - add --skip-schema-validation flag to helm 'install',
+      'upgrade' and 'lint'
+    - fixed bug to now use burst limit setting for discovery
+    - Added windows arm64 support
+  * Full changelog see
+    https://github.com/helm/helm/releases/tag/v3.16.0
+
 -------------------------------------------------------------------
 Wed Aug 14 16:54:27 UTC 2024 - opensuse_buildservice@ojkastl.de
 
@@ -37,7 +321,10 @@ Thu May 23 19:45:52 UTC 2024 - opensuse_buildservice@ojkastl.de
 -------------------------------------------------------------------
 Sat May 18 09:20:56 UTC 2024 - opensuse_buildservice@ojkastl.de
 
-- Update to version 3.15.0:
+- Update to version 3.15.0 (bsc#1220207, CVE-2024-26147,
+  bsc#1219969, CVE-2024-25620):
+  - obsoletes CVE-2024-26147.patch in older distributions
+  - obsoletes CVE-2024-25620.patch in odler distributions
   Helm v3.15.0 is a feature release. Users are encouraged to
   upgrade for the best experience.
   * Updating to k8s 1.30 c4e37b3 (Matt Farina)

helm.obsinfo

@@ -1,4 +1,4 @@
 name: helm
-version: 3.15.4
-mtime: 1723645632
-commit: fa9efb07d9d8debbb4306d72af76a383895aa8c4
+version: 3.18.4
+mtime: 1752004680
+commit: d80839cf37d860c8aa9a0503fe463278f26cd5e2

helm.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package helm
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 %define goipath helm.sh/helm/v3
 %define git_dirty clean
 Name:           helm
-Version:        3.15.4
+Version:        3.18.4
 Release:        0
 Summary:        The Kubernetes Package Manager
 License:        Apache-2.0
@@ -28,11 +28,16 @@ URL:            https://github.com/helm/helm
 Source0:        %{name}-%{version}.tar.gz
 Source1:        vendor.tar.gz
 BuildRequires:  golang-packaging
-BuildRequires:  golang(API) = 1.22
+%if 0%{?suse_version} == 1600
+# go is not available on Framework one for x86
+ExcludeArch:    %ix86
+%endif
+BuildRequires:  golang(API) = 1.24
 %{go_provides}
 
 %description
-Helm is a tool for managing Kubernetes charts. Charts are packages of pre-configured Kubernetes resources.
+Helm is a tool for managing Kubernetes charts. Charts are packages of
+pre-configured Kubernetes resources.
 
 %package bash-completion
 Summary:        Bash Completion for %{name}
@@ -71,7 +76,7 @@ Fish command line completion support for %{name}.
 %goprep %{goipath}
 export K8S_MINOR=$(grep k8s.io/client-go go.mod | cut -d. -f3)
 export GO111MODULE=on
-%ifnarch s390x
+%ifnarch %ix86 s390x riscv64
 export CGO_ENABLED=0
 %endif
 %gobuild -trimpath -tags '' -mod vendor -buildmode pie -ldflags \
@@ -98,7 +103,12 @@ mkdir -p %{buildroot}%{_datadir}/fish/vendor_completions.d
 # requires network
 rm -v pkg/plugin/installer/*installer_test.go
 rm -v pkg/engine/engine_test.go
-GO111MODULE=on go test ./...
+# skip flaky tests
+rm -v cmd/helm/dependency_build_test.go
+rm -v cmd/helm/dependency_update_test.go
+rm -v cmd/helm/pull_test.go
+rm -v cmd/helm/registry_login_test.go
+GO111MODULE=on go test -p 2 ./...
 
 %files
 %doc README.md