[renovate]

This PR contains the following updates:

Package	Type	Update	Change
helm	tools	patch	4.3.0 → 4.3.1
zizmor	tools	minor	1.30.1 → 1.31.1

---

Release Notes

helm/helm (helm)

v4.3.1: Helm v4.3.1

Compare Source

Helm v4.3.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• fix(action): wait for CRD establishment under HookOnlyStrategy #​32672 by @​pujitha24
• fix(linters): update golangci-lint to v2.14.0 #​32744 by @​ruslan-shaydullin

Installation and Upgrading

Download Helm v4.3.1. The common platform binaries are here:

• MacOS amd64 (checksum / 34bec4eba761ba5c16d1965ee6b8f5b0abe5993974a802274e2a4f0418893d89)
• MacOS arm64 (checksum / 6b4e61c8cd27d99e5a801e63ff25dd5c70b36875c2cd659d3e9ce6b76fc23198)
• Linux amd64 (checksum / 0403a88ae20913d11b10a2467b50087721fea7581736da6b9d3992f5357fe54b)
• Linux arm (checksum / 292588ea9f89705511c93a39687fe5e26767bd85b5085a1be9a2a1563c1e28fa)
• Linux arm64 (checksum / 8cf8f66ecbc252ac8f7f06cca68aba88508ddfde3a6a34feb1678ad1694b4f88)
• Linux i386 (checksum / bfe8cbbec02362d869e183f27ca03342820ceae908f7a7db2e17caeef74e6d30)
• Linux loong64 (checksum / 5fc8ae4eb1d513775374160a1ff5255290b86e8a71beeae09ae7d3a60f50962f)
• Linux ppc64le (checksum / 11bbb554976ce22aeb21b308bb5683f98941db81725d2b280d8b943b6ada8036)
• Linux s390x (checksum / dfb031400c1215c0bd673d5e25bcd300a5af903fbfed10b5cb8b3ffc03bcecb6)
• Linux riscv64 (checksum / 20ebb3346bf1d5e5c330a7f1405cfea8eab6a5e1752f24055f03a5221be1688e)
• Windows amd64 (checksum / fcfd7b796dcf0f225abc40b5636a3b01f55f3de2fb1dfb18475df94e62c14112)
• Windows arm64 (checksum / 373edaae86db70342ef39b014e2e7764ea8f9cff08714843daa5e55b5ee492f2)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.3.2 and 3.22.2 are the next patch releases scheduled for November 11, 2026
• 4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

• chore(deps): bump otlploghttp and stdoutlog to v0.21.0 c0d08d0 (Terry Howe)
• chore(deps): bump the k8s-io group across 1 directory with 7 updates 0c0146e (dependabot[bot])
• fix: bump golang.org/x/net to v0.61.0 (#​32758) dd91731 (Terry Howe)
• fix(linters): update golangci-lint to v2.14.0 (#​32744) 3a376b2 (Ruslan Shaydullin)
• fix(action): wait for CRD establishment under HookOnlyStrategy (#​32672) 5fed6a5 (Pujitha Paladugu)
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.25.1 to 0.25.2 (#​32726) b227bf4 (dependabot[bot])
• chore(deps): bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 (#​32715) af79b8e (dependabot[bot])
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc ab6b245 (dependabot[bot])
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (#​32665) 0f20617 (dependabot[bot])
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (#​32664) e26e158 (dependabot[bot])
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace (#​32663) 23ab1c5 (dependabot[bot])
• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 (#​32662) 8303180 (dependabot[bot])

zizmorcore/zizmor (zizmor)

v1.31.1

Compare Source

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#​2450)

v1.31.0

Compare Source

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#​2437)

• The self-hosted-runner audit is now significantly more precise (#​2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

• zizmor is now aware of the image_version workflow trigger (#​2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

• The cache-poisoning audit is now aware of pnpm/setup (#​2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge; no actionable issues were found.

Summary

Updates the pinned development tools and their lock entries:

• Chart checks now use Helm 4.3.1.
• Workflow lint now uses zizmor 1.31.1.

No actionable issues were found. Tool installation and CI checks were not run.

_{Reviews (1) · Last reviewed commit: "chore(mise): update mise tools" · Reviewed by Greptile}