fix(deps): update go major updates (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/labstack/echo/v4	v4.15.1 → v5.3.1
helm.sh/helm/v3	v3.20.2 → v4.3.0

---

Release Notes

labstack/echo (github.com/labstack/echo/v4)

v5.3.1

Compare Source

Fixes

• fix(static): preserve matched handler 404s by @​JSap0914 in #​3043
• fix(group): Implicitly registered group routes should be allowed overwritten in default routes by @​aldas in #​3049

Enhancements

• docs: update HTTP badge URLs to HTTPS by @​KeloYuan in #​2968
• docs: correct Any godoc to reflect true arbitrary-method matching by @​hyorimitsu in #​3046
• refactor: use range-over-integer loops by @​zxysilent in #​3042
• docs: add llms.txt and llms-full.txt for v5 documentation by @​tamish560 in #​3041
• Update deps to latest versions by @​aldas in #​3050

v5.3.0

Compare Source

Logic changes
PR #​2996 revert back to v4 behavior for a group registering implicit 404 handlers.

If you do not want this behavior, can do not want implicit 404 handlers for groups, use:

e :=  echo.NewWithConfig(echo.Config{NoGroupAutoRegister404Routes: true})
g := e.Group("/api")

some other noteworthy echancements:

• Adds first-class support for the QUERY HTTP method RFC 10008 in #​3038

e.QUERY("/", func(c *Context) error {
  return c.String(http.StatusTeapot, "OK")
})

• Router: automatically handle HEAD request by GET handlers in labtack#2949

e := echo.NewWithConfig(echo.Config{
  Router: echo.NewRouter(echo.RouterConfig{
    AutoHandleHEAD: true,
  }),
})

Enhancements

• perf(json): pooled-buffer JSON deserialize by @​vishr in #​3023
• perf(router): cache-friendly static child lookup by @​vishr in #​3024
• update golang.org/x deps to latest versions by @​aldas in #​3034
• pin GitHub Actions to full commit SHAs and rework actions SHAs to own variables by @​aldas in #​3035
• docs(csrf): fix godoc typo in Generator default (tp -> to) by @​DucMinhNe in #​3026
• docs(cors): note reverse-proxy header duplication by @​vishr in #​3027
• feat: add support for HTTP QUERY method by @​thdxg in #​3038
• docs: fix typos in API_CHANGES_V5.md by @​maxtaran2010 in #​3039
• Router: auto HEAD to GET by @​aldas in #​2949
• Revert back to v4 behavior for group registering implicit 404 handler… by @​aldas in #​2996

v5.2.1

Compare Source

Security

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

---

• revert PR #​3009 changes to just disabling path escaping by default in static methods/middleware by @​aldas in #​3016

Closes GHSA-vfp3-v2gw-7wfq more completely: the previous fix (#​3009) rejected explicitly encoded
separators at the handler level; this patch makes the no-unescape behavior the default so new configurations are safe without extra opt-out steps.

What changed: DisablePathUnescaping (on StaticConfig and StaticDirectoryHandlerConfig) is deprecated and replaced by EnablePathUnescaping (default false). Path unescaping is now opt-in.

What this protects: With EnablePathUnescaping: false (new default), encoded separators (%2F, %5C) are never decoded before routing or file lookup, so they cannot
bypass route-level authentication or other middleware guards.

What this does NOT protect: Serving a directory with Static, StaticFS, or StaticDirectoryHandler exposes its entire subtree. Sibling routes are not a reliable
ACL boundary — attach authorization middleware directly to the static mount, or serve sensitive sub-trees under separate guarded routes.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

// Static middleware
e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
    EnablePathUnescaping: true, // only safe when NOT relying on route-based ACL guards
    ...
}))

// StaticDirectoryHandler
middleware.StaticDirectoryHandler(fs, &middleware.StaticDirectoryHandlerConfig{
    EnablePathUnescaping: true,
})

Full Changelog: labstack/echo@v5.2.0...v5.2.1

v5.2.0

Compare Source

Security

• fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in #​3009
• fix(middleware/static): don't double-unescape request path (#​2599) by @​vishr in #​3006

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler/StaticFS and the Static middleware are affected. Thanks to @​a-tt-om and @​oran-gugu for reporting.

Enhancements

• feat(middleware): optional RateLimiterStoreContext for response headers (#​2961) by @​vishr in #​3007
• perf: optimize core hot paths (chain, context, binding, responses) by @​vishr in #​3008
• fix(binder): include field name in bind conversion errors (#​2629) by @​vishr in #​3005
• fix(binder): serialize BindingError to structured JSON (#​2771) by @​vishr in #​3004
• fix(binder): MustUnixTime docs say time.Time, not time.Duration by @​c-tonneslan in #​2988
• fix(middleware): reset ContentLength after gzip decompression by @​shblue21 in #​3000
• fix(middleware/proxy): append RealIP to X-Forwarded-For for WebSocket requests by @​kawaway in #​2994
• Fix proxy panic when balancer has no targets by @​shblue21 in #​2977
• fix(middleware): correct documented KeyAuth KeyLookup default by @​leestana01 in #​2992
• test: lock in v5 group route method-handling (405 + OPTIONS) by @​vishr in #​3003
• docs: liveness signals in README + public ROADMAP by @​vishr in #​3002
• Fix typos in CSRFConfig comments by @​shblue21 in #​2979
• refactor: modernize code usage using gofix by @​kumapower17 in #​2970
• refactor: replace Split in loops with more efficient SplitSeq by @​box4wangjing in #​2969
• refactor: use the built-in max/min to simplify the code by @​criciss in #​2966
• Update GitHub actions deps versions by @​aldas in #​2971

New Contributors

• @​criciss made their first contribution in #​2966
• @​box4wangjing made their first contribution in #​2969
• @​shblue21 made their first contribution in #​2977
• @​c-tonneslan made their first contribution in #​2988
• @​leestana01 made their first contribution in #​2992
• @​kawaway made their first contribution in #​2994

Full Changelog: labstack/echo@v5.1.1...v5.2.0

v5.1.1

Compare Source

Security

• Context.Scheme() should validate values taken from header by @​aldas in #​2953

Thanks to @​shblue21 for reporting this issue.

Enhancements

• Add golangci linter configuration by @​aldas in #​2930
• Make StartConfig listener creation context-aware by @​EricGusmao in #​2936
• fix(lint): resolve staticcheck issues and improve code quality by @​itsllyaz in #​2941
• Context.Scheme should validate values taken from header by @​aldas in #​2953
• chore: fix typos in httperror.go by @​tisonkun in #​2958
• Context.Json should not unwrap response by @​aldas in #​2964

v5.1.0

Compare Source

Security

This change does not break the API contract, but it does introduce breaking changes in logic/behavior.
If your application is using c.RealIP() beware and read https://echo.labstack.com/docs/ip-address

v4 behavior can be restored with:

e := echo.New()
e.IPExtractor = echo.LegacyIPExtractor()

• Remove legacy IP extraction logic from context.RealIP method by @​aldas in #​2933

Enhancements

• Add echo-opentelemetry to the README.md by @​aldas in #​2908
• fix: correct spelling mistakes in comments and field name by @​crawfordxx in #​2916
• Add https://github.com/labstack/echo-prometheus to the middleware list in README.md by @​aldas in #​2919
• Add StartConfig.Listener so server with custom Listener is easier to create by @​aldas in #​2920
• Fix rate limiter documentation for default burst value by @​karesansui-u in #​2925
• Add doc comments to clarify usage of File related methods and leading slash handling by @​aldas in #​2928
• Add NewDefaultFS function to help create filesystem that allows absolute paths by @​aldas in #​2931
• Do not set http.Server.WriteTimeout in StartConfig by @​aldas in #​2932

v5.0.4

Compare Source

Enhancements

• Remove unused import 'errors' from README example by @​kumapower17 in #​2889
• Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @​aldas in #​2898
• Update location of oapi-codegen in README by @​mromaszewicz in #​2896
• Add Go 1.26 to CI flow by @​aldas in #​2899
• Add new function echo.StatusCode by @​suwakei in #​2892
• CSRF: support older token-based CSRF protection handler that want to render token into template by @​aldas in #​2894
• Add echo.ResolveResponseStatus function to help middleware/handlers determine HTTP status code and echo.Response by @​aldas in #​2900

v5.0.3

Compare Source

Security

• Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @​shblue21.

This applies to cases when:

• Windows is used as OS
• middleware.StaticConfig.Filesystem is nil (default)
• echo.Filesystem is has not been set explicitly (default)

Exposure is restricted to the active process working directory and its subfolders.

v5.0.2

Compare Source

Security

• Fix Static middleware with config.Browse=true lists all files/subfolders from config.Filesystem root and not starting from config.Root in #​2887

v5.0.1

Compare Source

• Panic MW: will now return a custom PanicStackError with stack trace by @​aldas in #​2871
• Docs: add missing err parameter to DenyHandler example by @​cgalibern in #​2878
• improve: improve websocket checks in IsWebSocket() [per RFC 6455] by @​raju-mechatronics in #​2875
• fix: Context.Json() should not send status code before serialization is complete by @​aldas in #​2877

v5.0.0

Compare Source

Echo v5 is maintenance release with major breaking changes

• Context is now struct instead of interface and we can add method to it in the future in minor versions.
• Adds new Router interface for possible new routing implementations.
• Drops old logging interface and uses moderm log/slog instead.
• Rearranges alot of methods/function signatures to make them more consistent.

Upgrade notes and v4 support:

• Echo v4 is supported with security* updates and bug fixes until 2026-12-31
• If you are using Echo in a production environment, it is recommended to wait until after 2026-03-31 before upgrading.
• Until 2026-03-31, any critical issues requiring breaking v5 API changes will be addressed, even if this violates semantic versioning.

See API_CHANGES_V5.md for public API changes between v4 and v5, notes on upgrading.

Upgrading TLDR:

If you are using Linux you can migrate easier parts like that:

find . -type f -name "*.go" -exec sed -i 's/ echo.Context/ *echo.Context/g' {} +
find . -type f -name "*.go" -exec sed -i 's/echo\/v4/echo\/v5/g' {} +

macOS

find . -type f -name "*.go" -exec sed -i '' 's/ echo.Context/ *echo.Context/g' {} +
find . -type f -name "*.go" -exec sed -i '' 's/echo\/v4/echo\/v5/g' {} +

or in your favorite IDE

Replace all:

1. echo.Context -> *echo.Context
2. echo/v4 -> echo/v5

This should solve most of the issues. Probably the hardest part is updating all the tests.

v4.15.4

Compare Source

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3016, released in v5.2.1). Thanks to @​a-tt-om and @​oran-gugu for reporting.

---

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

Full Changelog: labstack/echo@v4.15.3...v4.15.4

v4.15.3: - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)

Compare Source

Security

• fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in #​3011

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3009, released in v5.2.0). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Full Changelog: labstack/echo@v4.15.2...v4.15.3

v4.15.2: - Context.Scheme() header validation

Compare Source

Security

• Context.Scheme() should validate values taken from header by @​aldas in #​2962

Thanks to @​shblue21 for reporting this issue.

Full Changelog: labstack/echo@v4.15.1...v4.15.2

helm/helm (helm.sh/helm/v3)

v4.3.0: Helm v4.3.0

Compare Source

Helm v4.3.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• feat: Add duration functions by @​aeroyorch in #​31695
• feat(engine): add debug logging when lookup returns empty by @​ogulcanaydogan in #​32205
• feat: add ownership verification before deleting resources during uni… by @​banjoh in #​31584
• feat: honor SOURCE_DATE_EPOCH for chart archives by @​lohitkolluri in #​32162
• feat(rollback): add --description flag to provide rollback reason by @​biagiopietro in #​31580
• fix (internal/plugin): remove zero-width spaces from plugin name comment by @​lexfrei in #​32134
• fix(loader): do not drop values files ending at a 4096-byte boundary by @​locker95 in #​32525
• fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test by @​Mentigen in #​32485
• fix(provenance): support GnuPG keybox (pubring.kbx) keyrings by @​ruslan-shaydullin in #​32281
• fix(template): regression - route registry messages to stderr in template and show by @​amarkdotdev in #​32217
• refactor: lower resync period from one hour to 3 minutes by @​AustinAbro321 in #​31944
• perf: enable concurrent status computation to prevent multi-minute delays by @​mapleeit in #​32043
• chore(deps): bump the k8s-io group to 0.37.0 - #​32598

Installation and Upgrading

Download Helm v4.3.0. The common platform binaries are here:

• MacOS amd64 (checksum / 347a784877e0e20eac865e8d1c36a80f6bb0861d6f29abd34defb6570ef95d92)
• MacOS arm64 (checksum / d3870437e1e95b67f8edbde964156c84a26503f560821d40c542441658934fba)
• Linux amd64 (checksum / 86584a54def73570558f66f5111cc53dfed56689637ae32c1201205d494f54fb)
• Linux arm (checksum / 467c353e4a1ab57412dd00c6bfb1a6a2ab4a57d775506f8b38c58502c0ba6861)
• Linux arm64 (checksum / 31c5794dd55c66a51e6b7d2e2ac7a114ae8b1de41ff1d9ba51748ac973b06a08)
• Linux i386 (checksum / e969a9492ac128097069aef7eb63be3b2504a20b5377a240b4c5c9bfc4b51575)
• Linux loong64 (checksum / 4ffe485ef474d722699794851642e1c7037e4776233e77637c649f69f3e9a4ce)
• Linux ppc64le (checksum / 5ff7d5ea6f396c15f3cfda3fb8ecb0ecb1b11bc283785adeb55eefb2c62e0bda)
• Linux s390x (checksum / ab637a6a1c3d457b9975726c100d74e484e579d5462c4fd2e3bfcfa97df57cd7)
• Linux riscv64 (checksum / 5359f5544478de80de2dfd60bdc5e0c22f26255b3c44335483e0f9bd3ba6ec58)
• Windows amd64 (checksum / 304ea163cce4d9ad14e189c01846c6a34de9cfdfe48536ae54b2e8ba7884e67c)
• Windows arm64 (checksum / 4a9eefa30d26eb73900a9a0f16e97eae678582172204db60cbd454c68acea246)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.3.1 and 3.22.1 are the next patch releases scheduled for October 14, 2026
• 4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 bec5b06 (dependabot[bot])
• chore(deps): bump the k8s-io group across 1 directory with 6 updates d0d42e7 (dependabot[bot])
• bump version to 4.3 (#​32605) 7328f42 (Scott Rigby)
• chore: Fix independent-merge lint issues ca6681c (George Jenkins)
• refactor(repo): Use byte buffer to build index file (#​32579) 37752b7 (Tom Wieczorek)
• chore: fix gofumpt extra-rules (#​32486) 28e64bd (Matthieu MOREL)
• Remove deprecated internal/chart/v3/ code (#​32365) 4dfbaa4 (George Jenkins)
• fix(template): regression - route registry messages to stderr in template and show (#​32217) 9a3c040 (Aaron Mark)
• refactor: remove per-file decompression size limit (#​31748) 11e2010 (Benoit Tigeot)
• Updating the Go version b5b498b (Matt Farina)
• Updating the Go version 6d1f67c (Matt Farina)
• chore(deps): bump the github-actions group across 1 directory with 4 updates (#​32574) 0f4decb (dependabot[bot])
• chore(deps): bump the k8s-io group with 7 updates (#​32572) fb19300 (dependabot[bot])
• fix: correct 'doest not match' in readiness debug logs 6888b0a (MsfPablo)
• fix(provenance): support GnuPG keybox (pubring.kbx) keyrings (#​32281) 67d54fd (Ruslan Shaydullin)
• chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#​32562) e9b85e4 (dependabot[bot])
• chore(deps): bump the github-actions group across 1 directory with 4 updates (#​32556) c000a40 (dependabot[bot])
• chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#​32555) bafdcde (dependabot[bot])
• chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#​32545) 2a29f17 (dependabot[bot])
• chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 (#​32543) edb94f8 (dependabot[bot])
• test(loader): cover 8192-byte EOF boundary for LoadValues fd4ed49 (Dean Chen)
• fix(loader): do not drop values files ending at a 4096-byte boundary 601445e (Dean Chen)
• chore(deps): bump the github-actions group with 4 updates (#​32523) f3d68cd (dependabot[bot])
• fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#​32521) a0c2f6d (Terry Howe)
• chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 (#​32514) f8a308c (dependabot[bot])
• chore(deps): bump the github-actions group with 4 updates 47eb219 (dependabot[bot])
• chore(deps): bump the github-actions group with 4 updates (#​32508) ae877c8 (dependabot[bot])
• test(action): poll for the interrupted install goroutine instead of a zero-margin sleep (#​32328) a8ab76e (Nikolaus Schuetz)
• chore(deps): bump actions/stale in the github-actions group (#​32487) ac1c687 (dependabot[bot])
• test(package): fix errorlint + exact path match in lock test e923167 (Ilya Kiselev)
• fix(chart): normalize StampModTimes timestamp + Chart.lock test 3c3be92 (Ilya Kiselev)
• chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 ce27485 (dependabot[bot])
• fix(scripts): clarify cache-busting behavior bc0114c (Solomon Wakhungu)
• chore: fix gofumpt issues 24bbb46 (Matthieu MOREL)
• fix(scripts): address cache-busting review feedback bbaf420 (Solomon Wakhungu)
• Make golangci-lint happy f3edb83 (MrJack)
• Added missing import 94a3315 (MrJack)
• Readded "unicode/utf8" 500f02d (MrJack)
• Potential fix for pull request finding f1ede7c (MrJack)
• Apply suggestions from code review 4fcc4e4 (MrJack)
• refactor(rollback): validate description length before cluster reachability check 91520a7 (MrJack)
• refactor(test): reuse existing rollback.txt golden file e73dfab (MrJack)
• Removed extra space in rollback-with-description.txt b177a8e (MrJack)
• Enhance rune count in pkg/cmd/rollback.go and pkg/action/rollback.go a92611c (MrJack)
• Use rune count to count properly multi-byte UTF-8 characters 8a34f3b (MrJack)
• Enhanced rollback description length cb91040 (MrJack)
• Changed if construction e69e424 (MrJack)
• Set 256 as limit for maxDescriptionLength. 256 comes from MAX value for key and value b606955 (MrJack)
• feat(rollback): add --description flag to provide rollback reason f8180e6 (MrJack)
• Update resource_test.go 622f16b (Matthieu MOREL)
• Update labels_test.go 61d99a8 (Matthieu MOREL)
• Update chartrepo_test.go 532eabf (Matthieu MOREL)
• Update show_test.go bfca068 (Matthieu MOREL)
• Update rollback_test.go b59dfd3 (Matthieu MOREL)
• Potential fix for pull request finding a27f3a0 (Matthieu MOREL)
• chore(pkg): refactor: finer tests conversions to testify part 1 828d01a (Matthieu MOREL)
• chore(pkg): refactor: finer tests conversions to testify part 3 9a2be11 (Matthieu MOREL)
• chore(pkg): refactor: finer tests conversions to testify part 2 4d9c03f (Matthieu MOREL)
• chore(internal): refactor: finer tests conversions to testify part 1 5142ca8 (Matthieu MOREL)
• chore(deps): bump the k8s-io group across 1 directory with 7 updates (#​32459) 8f74dce (dependabot[bot])
• chore(deps): bump ossf/scorecard-action in the github-actions group (#​32458) 050d3e9 (dependabot[bot])
• chore(deps): bump the github-actions group with 4 updates ea7c838 (dependabot[bot])
• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 fe3f98b (dependabot[bot])
• chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 (#​32441) ed246e2 (dependabot[bot])
• chore(deps): bump github/codeql-action/upload-sarif (#​32440) 5223cea (dependabot[bot])
• chore(deps): bump github/codeql-action/autobuild from 4.37.1 to 4.37.2 a0f954e (dependabot[bot])
• chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.2 cdccef4 (dependabot[bot])
• chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.2 065d3a6 (dependabot[bot])
• chore: group github-actions dependabot updates cd4c5d3 (Terry Howe)
• chore(pkg): refactor: convert tests to testify assert/require part 19 33c2839 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 22 0b1aa55 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 21 a934b82 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 20 1d4665e (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 18 fb8a62b (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 16 0fa9f7d (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 17 4073566 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 15 7173365 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 14 dc66ee7 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 13 aae82bf (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 12 a3fa28a (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 11 dc3e3a5 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 10 2f5a33f (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 9 13d1edc (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 8 e5f0e07 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 7 ca1767b (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 2 0daa77f (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 1 d4ec8e9 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 6 0844b3b (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 5 3ff05c8 (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 4 658a8fa (Matthieu MOREL)
• chore(pkg): refactor: convert tests to testify assert/require part 3 df2d013 (Matthieu MOREL)
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#​32411) 8c7f3a1 (dependabot[bot])
• chore(internal): refactor: convert tests to testify assert/require part 4 (#​32408) 6c45810 (Matthieu MOREL)
• chore(internal): refactor: convert tests to testify assert/require part 3 668e7e5 (Matthieu MOREL)
• chore(internal): refactor: convert tests to testify assert/require part 5 f1d5979 (Matthieu MOREL)
• chore(internal): refactor: convert tests to testify assert/require part 6 f3402c1 (Matthieu MOREL)
• chore(internal): refactor: convert tests to testify assert/require part 1 ba31ca0 (Matthieu MOREL)
• chore(internal): refactor: convert tests to testify assert/require part 2 615a299 (Matthieu MOREL)
• fix: pass registry client to downloader.Manager in upgrade 0604d8f (Gates Wang)
• perf: enable concurrent status computation to prevent multi-minute delays (#​32043) 3bcf965 (Zhaofeng Miao)
• remove legacy import comments from remaining packages (#​31933) 82be04d (Abhay Chaurasiya)
• Potential fix for pull request finding c2fda5a (Terry Howe)
• fix: enhance error handling and improve test assertions (#​32352) a2b1a60 (Matthieu MOREL)
• fix(scripts): add cache-busting to get-helm-3 version check 5a30c7a (Solomon Wakhungu)
• chore(deps): bump github/codeql-action init and analyze to 4.37.1 0563162 (Terry Howe)
• chore(deps): bump github/codeql-action/upload-sarif (#​32378) 06b9586 (dependabot[bot])
• chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#​32376) a494169 (dependabot[bot])
• chore(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 eeb37ed (dependabot[bot])
• chore: Add AI Vendor specific paths to .gitignore 8cd3a48 (George Jenkins)
• ci: auto-label PRs targeting main with v4.x 9f3c89a (Benoit Tigeot)
• fix: 'gocritic: filepathJoin path seperator' lint error 96a25ab (George Jenkins)
• chore(internal): refactor: convert tests to testify assert/require part 3 caac755 (Matthieu MOREL)
• feat: honor SOURCE_DATE_EPOCH for chart archives (#​32162) ad93b7d (Lohit Kolluri)
• Fix missing conflict retry with server-side apply ([#​32088](h

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 3am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 44 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.1 -> 1.26.0
github.com/labstack/echo/v5	v5.3.1 -> v5.3.1
helm.sh/helm/v4	v4.3.0 -> v4.3.0
k8s.io/api	v0.35.3 -> v0.37.0
k8s.io/apiextensions-apiserver	v0.35.3 -> v0.37.0
k8s.io/apimachinery	v0.35.3 -> v0.37.0
k8s.io/cli-runtime	v0.35.3 -> v0.37.0
k8s.io/client-go	v0.35.3 -> v0.37.0
sigs.k8s.io/controller-runtime	v0.23.3 -> v0.24.1
github.com/Masterminds/semver/v3	v3.4.0 -> v3.5.0
github.com/cyphar/filepath-securejoin	v0.6.1 -> v0.7.0
github.com/emicklei/go-restful/v3	v3.12.2 -> v3.13.0
github.com/fatih/color	v1.18.0 -> v1.19.0
github.com/fxamacker/cbor/v2	v2.9.0 -> v2.9.1
github.com/go-openapi/jsonpointer	v0.21.1 -> v1.0.0
github.com/go-openapi/jsonreference	v0.21.0 -> v1.0.0
github.com/go-openapi/swag	v0.23.1 -> v0.27.1
github.com/klauspost/compress	v1.18.2 -> v1.19.0
github.com/lib/pq	v1.10.9 -> v1.12.3
github.com/moby/spdystream	v0.5.0 -> v0.5.1
github.com/santhosh-tekuri/jsonschema/v6	v6.0.2 -> v6.0.3
github.com/sirupsen/logrus	v1.9.3 -> v1.9.4
go.yaml.in/yaml/v2	v2.4.3 -> v2.4.4
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5
golang.org/x/crypto	v0.47.0 -> v0.55.0
golang.org/x/mod	v0.32.0 -> v0.38.0
golang.org/x/net	v0.49.0 -> v0.57.0
golang.org/x/oauth2	v0.34.0 -> v0.36.0
golang.org/x/sync	v0.19.0 -> v0.22.0
golang.org/x/sys	v0.40.0 -> v0.47.0
golang.org/x/term	v0.39.0 -> v0.45.0
golang.org/x/text	v0.33.0 -> v0.41.0
golang.org/x/time	v0.14.0 -> v0.15.0
golang.org/x/tools	v0.41.0 -> v0.48.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260128011058-8636f8732409 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpc	v1.78.0 -> v1.83.1
google.golang.org/protobuf	v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
k8s.io/apiserver	v0.35.3 -> v0.37.0
k8s.io/component-base	v0.35.3 -> v0.37.0
k8s.io/klog/v2	v2.130.1 -> v2.140.0
k8s.io/kube-openapi	v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260721132016-d427ff9ee9ad
k8s.io/kubectl	v0.35.1 -> v0.37.0
k8s.io/utils	v0.0.0-20251002143259-bc988d571ff4 -> v0.0.0-20260626114624-be93311217bd
oras.land/oras-go/v2	v2.6.0 -> v2.6.2
sigs.k8s.io/structured-merge-diff/v6	v6.3.2-0.20260122202528-d9cc6641c482 -> v6.4.2