Skip to content

chore(deps): update tools#583

Merged
cert-manager-prow[bot] merged 1 commit intomainfrom
renovate/tools
Apr 11, 2026
Merged

chore(deps): update tools#583
cert-manager-prow[bot] merged 1 commit intomainfrom
renovate/tools

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 8, 2026

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Update
github.com/anchore/syft v1.42.3v1.42.4 age adoption passing confidence patch
github.com/google/go-containerregistry v0.21.4v0.21.5 age adoption passing confidence patch
golang.org/x/tools v0.43.0v0.44.0 age adoption passing confidence minor
helm/helm v4.1.3v4.1.4 age adoption passing confidence patch
rclone/rclone v1.73.3v1.73.4 age adoption passing confidence patch

Release Notes

anchore/syft (github.com/anchore/syft)

v1.42.4

Compare Source

Bug Fixes
Additional Changes

(Full Changelog)

google/go-containerregistry (github.com/google/go-containerregistry)

v0.21.5

Compare Source

What's Changed

Full Changelog: google/go-containerregistry@v0.21.4...v0.21.5

helm/helm (helm/helm)

v4.1.4: Helm v4.1.4

Compare Source

Helm v4.1.4 is a security fix patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages
Security fixes
  • GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via Chart.yaml name dot-segment
  • GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov is missing, allowing unsigned plugin install
  • GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

A big thank you to the reporters of these issues (@​maru1009, @​1seal).

Installation and Upgrading

Download Helm v4.1.4. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next
  • 4.1.5 and 3.20.3 are the next patch (bug fix) releases and will be on April 8, 2026
  • 4.2.0 and 3.21.0 are the next minor (feature) releases and will be on May 13, 2026
Changelog
  • fix: Plugin missing provenance bypass 05fa379 (George Jenkins)
  • fix: Chart dot-name path bug 4e7994d (George Jenkins)
  • ignore error plugin loads (cli, getter) 2581943 (George Jenkins)
  • fix: Plugin version path traversal 36c8539 (George Jenkins)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow c61e086 (Terry Howe)
rclone/rclone (rclone/rclone)

v1.73.4: rclone v1.73.4

Compare Source

This is the v1.73.4 release of rclone.

Full details of the changes can be found in the changelog.


Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies Pull requests that update a dependency file ok-to-test labels Apr 8, 2026
@cert-manager-prow cert-manager-prow bot added dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Apr 8, 2026
@renovate renovate bot changed the title chore(deps): update dependency rclone/rclone to v1.73.4 chore(deps): update tools Apr 8, 2026
@renovate renovate bot force-pushed the renovate/tools branch 3 times, most recently from 8f94bec to b986372 Compare April 10, 2026 00:35
Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/tools branch from b986372 to fa1900b Compare April 11, 2026 04:27
Copy link
Copy Markdown
Member

@erikgb erikgb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@cert-manager-prow cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Apr 11, 2026
@cert-manager-prow
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cert-manager-prow cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 11, 2026
@cert-manager-prow cert-manager-prow bot merged commit c805d7d into main Apr 11, 2026
5 checks passed
@renovate renovate bot deleted the renovate/tools branch April 11, 2026 11:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates that all commits in the pull request have the valid DCO sign-off message. dependencies Pull requests that update a dependency file lgtm Indicates that a PR is ready to be merged. ok-to-test size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant