mirror of
https://github.com/truecharts/charts.git
synced 2026-07-12 23:23:17 -03:00
b3137f747c
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [helm.sh/helm/v3](https://redirect.github.com/helm/helm) | `v3.18.3` -> `v3.18.4` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2025-53547](https://redirect.github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm) A Helm contributor discovered that a specially crafted `Chart.yaml` file along with a specially linked `Chart.lock` file can lead to local code execution when dependencies are updated. ### Impact Fields in a `Chart.yaml` file, that are carried over to a `Chart.lock` file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a `bash.rc` file or shell script). If the `Chart.lock` file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This affects when dependencies are updated. When using the `helm` command this happens when `helm dependency update` is run. `helm dependency build` can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader `Manager` performs an update. ### Patches This issue has been resolved in Helm v3.18.4 ### Workarounds Ensure the `Chart.lock` file in a chart is not a symlink prior to updating dependencies. ### For more information Helm's security policy is spelled out in detail in our [SECURITY](https://redirect.github.com/helm/community/blob/master/SECURITY.md) document. ### Credits Disclosed by Jakub Ciolek at AlphaSense. --- ### Release Notes <details> <summary>helm/helm (helm.sh/helm/v3)</summary> ### [`v3.18.4`](https://redirect.github.com/helm/helm/releases/tag/v3.18.4): Helm v3.18.4 [Compare Source](https://redirect.github.com/helm/helm/compare/v3.18.3...v3.18.4) Helm v3.18.4 is a security release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! - Join the discussion in [Kubernetes Slack](https://kubernetes.slack.com): - for questions and just to hang out - for discussing PRs, code, and bugs - Hang out at the Public Developer Call: Thursday, 9:30 Pacific via [Zoom](https://zoom.us/j/696660622) - Test, debug, and contribute charts: [ArtifactHub/packages](https://artifacthub.io/packages/search?kind=0) #### Installation and Upgrading Download Helm v3.18.4. The common platform binaries are here: - [MacOS amd64](https://get.helm.sh/helm-v3.18.4-darwin-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-darwin-amd64.tar.gz.sha256sum) / 860a7238285b44b5dc7b3c4dad6194316885d7015d77c34e23177e0e9554af8f) - [MacOS arm64](https://get.helm.sh/helm-v3.18.4-darwin-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-darwin-arm64.tar.gz.sha256sum) / 041849741550b20710d7ad0956e805ebd960b483fe978864f8e7fdd03ca84ec8) - [Linux amd64](https://get.helm.sh/helm-v3.18.4-linux-amd64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-linux-amd64.tar.gz.sha256sum) / f8180838c23d7c7d797b208861fecb591d9ce1690d8704ed1e4cb8e2add966c1) - [Linux arm](https://get.helm.sh/helm-v3.18.4-linux-arm.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-linux-arm.tar.gz.sha256sum) / 34ea88aef15fd822e839da262176a36e865bb9cfdb89b1f723811c0cc527f981) - [Linux arm64](https://get.helm.sh/helm-v3.18.4-linux-arm64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-linux-arm64.tar.gz.sha256sum) / c0a45e67eef0c7416a8a8c9e9d5d2d30d70e4f4d3f7bea5de28241fffa8f3b89) - [Linux i386](https://get.helm.sh/helm-v3.18.4-linux-386.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-linux-386.tar.gz.sha256sum) / 75c2d9858725a5907faf8f19d9fb21c0263e4cb864d27d6df8809f96f147d3c0) - [Linux ppc64le](https://get.helm.sh/helm-v3.18.4-linux-ppc64le.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-linux-ppc64le.tar.gz.sha256sum) / dbd74c59e7710f26e058596723abbf73662b553e01f40dfb08508ffffaeb7b81) - [Linux s390x](https://get.helm.sh/helm-v3.18.4-linux-s390x.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-linux-s390x.tar.gz.sha256sum) / c8bafb34bcebd53494f0223239977e1ff7b487e714598a5843a0cb1788e20075) - [Linux riscv64](https://get.helm.sh/helm-v3.18.4-linux-riscv64.tar.gz) ([checksum](https://get.helm.sh/helm-v3.18.4-linux-riscv64.tar.gz.sha256sum) / f67f39104c7e695cbba04dc3b4507a80a034ce9e5ccbe55c84e91b1553b787bd) - [Windows amd64](https://get.helm.sh/helm-v3.18.4-windows-amd64.zip) ([checksum](https://get.helm.sh/helm-v3.18.4-windows-amd64.zip.sha256sum) / 0af12a2233d71ef4207db1eabbf103b554631206ed5b2b34fc56b73a52596888) - [Windows arm64](https://get.helm.sh/helm-v3.18.4-windows-arm64.zip) ([checksum](https://get.helm.sh/helm-v3.18.4-windows-arm64.zip.sha256sum) / de6bc8fcffeb041f524a92c6026ea22ef6f939118a30e6bb8b996b77a38486b1) The [Quickstart Guide](https://helm.sh/docs/intro/quickstart/) will get you going from there. For **upgrade instructions** or detailed installation notes, check the [install guide](https://helm.sh/docs/intro/install/). You can also use a [script to install](https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3) on any system with `bash`. #### What's Next - 3.18.5 is the next patch release and will be on August 13, 2025 - 3.19.0 is the next minor release and will be on September 11, 2025 #### Changelog - Disabling linter due to unknown issue [`f20a4ad`](f20a4ad1d5) (Matt Farina) - build(deps): bump the k8s-io group with 7 updates [`563b094`](563b0947b9) (dependabot\[bot]) - Updating link handling [`00de613`](00de613324) (Matt Farina) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4yMC4wIiwidXBkYXRlZEluVmVyIjoiNDEuMjAuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJhdXRvbWVyZ2UiLCJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->
title
| title |
|---|
| TrueCharts |
Community Helm Chart Catalog
TrueCharts is a catalog of highly optimised Helm Charts. Made for the community, By the community!
All our charts are supposed to work together and be easy to setup using any helm-compatible deployment tool, above all, give the average user more than enough options to tune things to their liking.
Getting started using TrueCharts
Support
Please check our FAQ, manual and Issue tracker There is a significant chance your issue has been reported before!
Still something not working as expected? Contact us! and we'll figure it out together!
Development
Our development process is fully distributed and agile, so every chart-maintainer is free to set their own roadmap and development speed and does not have to comply to a centralised roadmap. This ensures freedom and flexibility for everyone involved and makes sure you, the end user, always has the latest and greatest of every Chart installed.
Getting into creating Charts
For more information check the website: https://truecharts.org
Contact and Support
To contact the TrueCharts project:
-
Create an issue on Github issues
-
Open a Support Ticket
-
Send us an email
Contributors ✨
Thanks goes to these wonderful people (emoji key):
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?v=4?s=100)
![allcontributors[bot]](https://avatars.githubusercontent.com/in/23186?v=4?s=100)
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4?s=100)
This project follows the all-contributors specification. Contributions of any kind welcome!
Licence
Truecharts, is primarily based on a AGPL-v3 license, this ensures almost everyone can use and modify our charts. Licences can vary on a per-Chart basis. This can easily be seen by the presence of a "LICENSE" file in said folder.
An exception to this, has been made for every document inside folders labeled as docs or doc and their subfolders: those folders are not licensed under AGPL-v3 and are considered "all rights reserved". Said content can be modified and changes submitted per PR, in accordance to the github End User License Agreement.
SPDX-License-Identifier: AGPL-3.0
