chore: Upgrade helm to 3.19.2 by wandb-kc · Pull Request #105 · wandb/operator

wandb-kc · 2025-11-21T14:40:23Z

Addresses CVE-2024-25621

go get helm.sh/helm/v3@latest
go mod tidy

Summary by CodeRabbit

Chores
- Updated internal dependencies to latest versions for improved stability and security.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2025-11-21T14:40:41Z

Walkthrough

This pull request updates four dependencies in go.mod to newer versions: helm.sh/helm/v3 to v3.19.2, and three indirect dependencies (containerd, filepath-securejoin, and pflag). No code changes or public entity declarations are modified.

Changes

Cohort / File(s)	Summary
Dependency version upgrades `go.mod`	Updated helm.sh/helm/v3 from v3.19.0 to v3.19.2; updated indirect dependencies: containerd (v1.7.28 → v1.7.29), filepath-securejoin (v0.4.1 → v0.6.0), pflag (v1.0.9 → v1.0.10)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Single file modified with straightforward version bumps
No logic, code, or structural changes
Consider reviewing upstream release notes for the updated packages to verify compatibility and absence of breaking changes

Possibly related PRs

chore: Upgrade go to 1.25.3 #104 — Upgrades helm.sh/helm/v3 dependency to the same version (v3.19.2)
fix: Bump deps #70 — Updates overlapping dependencies (helm, containerd, filepath-securejoin, and others)

Suggested reviewers

j7m4
theishshah
danielpanzella

Poem

🐰 Dependencies dance in the morning light,
Patched and polished, oh what a sight!
Helm holds steady, containerd springs free,
The module's refreshed—as it should be! 🌱

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change in the pull request, which is upgrading the Helm dependency from v3.19.0 to v3.19.2 in go.mod.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch kc/upgrade-helm-3.19.2

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 6007156 and 9aa59e8.

⛔ Files ignored due to path filters (1)

go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

go.mod (3 hunks)

🔇 Additional comments (2)

go.mod (2)

38-38: Verify transitive dependency compatibility after upgrading Helm.

The indirect dependencies updated here (containerd, filepath-securejoin, pflag) are likely transitive pulls from upgrading to Helm 3.19.2. The most significant change is filepath-securejoin jumping from v0.4.1 to v0.6.0 (two minor versions). While Helm 3.19.2 should handle this correctly, verify that:

The codebase builds successfully with these versions.

Integration tests pass to ensure no runtime issues with the new dependency versions.

The patch-level bumps for containerd and pflag are lower-risk maintenance updates.

Also applies to: 42-42, 117-117

14-14: Helm 3.19.2 upgrade verified as safe; go.sum properly updated.

Verification confirms:

Helm 3.19.2 is a patch-level rebuild of v3.19.1 with no code changes

The go.sum file has been correctly regenerated with v0.6.0 checksums for filepath-securejoin

The operator codebase does not directly use filepath-securejoin, eliminating any breaking change compatibility risks

All transitive dependency updates are properly resolved

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2025-11-21T14:40:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	helm.sh/helm/v3@v3.19.0 ⏵ v3.19.2	⁺¹

View full report

jsbroks · 2025-12-04T21:47:28Z

This PR is included in version 1.21.3 🎉

* chore: Upgrade go to 1.25.3 (#104) * chore: Upgrade go to 1.25.3 * chore: Upgrade go to 1.25.3 * chore: Upgrade helm to 3.19.2 (#105) * chore: initial scaffolding for application type * fix: Refactor webhooks to match the kubebuilder standard structure * fix: WIP on conversion webhooks * fix: Get existing tests to pass with v1 and v2 reconcile paths enabled * fix: Revert tiltfile changes and fix conversion webhooks to ensure v1 deploys still work, default v2 to enabled. * fix: reworked all the operator installs * chore: re-generate * chore: remove erroneous import * feat: additional application reconcile logic and validating webhooks actually fireing * fix: address some minor issues and merge from main * fix: address some minor issues and merge from main --------- Co-authored-by: Kevin Chen <140976422+wandb-kc@users.noreply.github.com>

* chore: Upgrade go to 1.25.3 (#104) * chore: Upgrade go to 1.25.3 * chore: Upgrade go to 1.25.3 * chore: Upgrade helm to 3.19.2 (#105) * fix: Upgrade helm to 3.19.2 (#106) * chore(release): version 1.21.3 [skip ci] ### [1.21.3](v1.21.2...v1.21.3) (2025-12-04) ### Bug Fixes * Upgrade helm to 3.19.2 ([#106](#106)) ([aa4ca21](aa4ca21)) * chore: Need to create the workflow in main so it can be updated and run in v2 branch (#127) * chore: Need to create the workflow in main so it can be updated and run in v2 branch * chore: Add newline * chore: Add empty workflow so it can be run in a branch (#131) * fix to clickhouse enum we vendored (but is unused) * work in progress on retention * work in progress * ONPREM-111 rentention/purge works for wandb delete * ONPREM-111 more consistent label handling for retention * ONPREM-111 more consistent label handling for retention * initial retention e2e tests * WIP: fix Redis PVC labeling for retention e2e tests - Remove ensurePodLabels (operator SA lacks RBAC to patch pods, caused rapid requeue loop) - Fix Redis PVC prefix: use crName-crName- pattern matching actual opstree PVC names - Bypass cache for PVC reads in client (PVCs not watched, caused ErrCacheNotStarted) - Add USE_EXISTING_CLUSTER=true to test-e2e-retention Makefile target - Improve retention_test.go: namespace isolation, verifyComponentResourcesExist checks Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * ONPREM-111 complete impl of retention DETACH/PURGE policies --------- Co-authored-by: Kevin Chen <140976422+wandb-kc@users.noreply.github.com> Co-authored-by: semantic-release-bot <semantic-release-bot@martynus.net> Co-authored-by: Daniel Panzella <daniel.panzella@wandb.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: Upgrade helm to 3.19.2

9aa59e8

wandb-kc marked this pull request as ready for review November 21, 2025 15:01

dacbd approved these changes Nov 25, 2025

View reviewed changes

wandb-kc merged commit e70f07f into main Nov 25, 2025
11 checks passed

wandb-kc deleted the kc/upgrade-helm-3.19.2 branch November 25, 2025 22:22

wandb-kc changed the title ~~chore: Upgrade helm to 3.19.2~~ fix: Upgrade helm to 3.19.2 Dec 4, 2025

wandb-kc changed the title ~~fix: Upgrade helm to 3.19.2~~ chore: Upgrade helm to 3.19.2 Dec 4, 2025

wandb-kc mentioned this pull request Dec 4, 2025

fix: Upgrade helm to 3.19.2 #106

Merged

Navigation Menu

Uh oh!

chore: Upgrade helm to 3.19.2 - #105

chore: Upgrade helm to 3.19.2#105
wandb-kc merged 1 commit into
mainfrom
kc/upgrade-helm-3.19.2

wandb-kc commented Nov 21, 2025 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 21, 2025 •

edited

Loading

Uh oh!

socket-security Bot commented Nov 21, 2025

Uh oh!

Uh oh!

jsbroks commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

wandb-kc commented Nov 21, 2025 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Pre-merge checks and finishing touches

Uh oh!

socket-security Bot commented Nov 21, 2025

Uh oh!

Uh oh!

jsbroks commented Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wandb-kc commented Nov 21, 2025 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Nov 21, 2025 •

edited

Loading