LoginSign Up
← Back to all sparks
H

Helm

INFRA · APIS
Velocity5.0

Package manager for Kubernetes applications

helm.sh ↗

Helm runs two release trains in lockstep while v3 walks toward end-of-life.

kubernetespackage-managementrelease-engineeringsecurity-patchesend-of-life
◆Current state
Helm ships v4 and v3 in paired patch releases, usually minutes apart, with v3 explicitly flagged as approaching end-of-life since v3.21.0. The August patches split along that line: v4.2.4 carries functional fixes — error reporting for helm template --debug --show-only, logs collected from all containers in test pods, a panic on repeated IsReachable calls, missing conflict retry under server-side apply, and registry push token scoping — while v3.21.4 is almost entirely backported dependency bumps closing Go vulnerability advisories. Several releases in this window carry no notable changes at all beyond platform checksums.
◆Where it's heading
The two branches are diverging in kind rather than in version number. New behavior lands on v4; v3 receives security backports and Kubernetes client library alignment, which is what a maintenance branch looks like before it is retired. Within v4, the recurring theme is concurrency and lifecycle correctness — data races between upgrade and rollback, a WaitForDelete watch cancelled too early, a race fix reverted in v4.2.2 and revisited later — suggesting the v4 rewrite surfaced timing behavior the v3 code path never exercised.
◆Prediction
Expect the v3 line to narrow to security backports only until its end-of-life date lands, with functional work continuing exclusively on the v4.2.x patch series.

◆Recent moves

  1. 4d ago

    v4 patch: template debugging, test pod logs, apply conflict retry

    A substantive v4 patch. helm template --debug reports errors better with --show-only, test pods now surface logs from all containers rather than one, and a missing conflict retry under server-side apply is restored. Also fixes a panic on repeated IsReachable calls, registry push token scoping, and gzip extra-field formatting in packaged charts.

    View source ↗
  2. 4d ago

    v3 patch: four Go vulnerability advisories closed via backports

    The v3 twin of the same-day v4 release, and almost purely security: migration to ProtonMail/go-crypto for GO-2026-5932, otel and grpc bumps for GO-2026-5158 and GO-2026-6061, and x/crypto with x/text for GO-2026-5970. The one functional backport prevents a Files.Lines panic on empty files.

    View source ↗
  3. 1mo ago

    Helm v3.21.3

    A v3 patch release whose published notes carry only download links and platform checksums, with no notable changes section. Nothing here indicates what changed.

    View source ↗
  4. 1mo ago

    Helm v4.2.3

    The v4 half of the same-day pair with v3.21.3, likewise published with only binaries and checksums and no enumerated changes.

    View source ↗
  5. 1mo ago

    v3 client libraries aligned to Kubernetes v1.36

    A single-purpose patch bumping the Kubernetes client libraries to match the v1.36 release. Routine, but it is the kind of alignment that determines whether Helm works against a freshly upgraded cluster.

    View source ↗
  6. 2mo ago

    v4 patch reverting a WaitForDelete race fix

    Reverts the previous fix for a WaitForDelete race where the status observer cancelled the watch too early. The revert is the whole release, and the underlying flakiness resurfaces in later v4 patches.

    View source ↗