From b74ac45a76f0fbb263a2e3dc2b19dedd1992bd1b Mon Sep 17 00:00:00 2001 From: "octo-sts[bot]" <157150467+octo-sts@users.noreply.github.com> Date: Sun, 17 Aug 2025 08:33:59 +0000 Subject: [PATCH 1/2] cluster-api-helm-controller/0.3.2-r4: fix GHSA-f9f8-9pmf-xv68 --- cluster-api-helm-controller.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cluster-api-helm-controller.yaml b/cluster-api-helm-controller.yaml index 17ea2a529118..7de74024c3a7 100644 --- a/cluster-api-helm-controller.yaml +++ b/cluster-api-helm-controller.yaml @@ -1,7 +1,7 @@ package: name: cluster-api-helm-controller version: "0.3.2" - epoch: 3 # CVE-2025-47907 + epoch: 4 # GHSA-f9f8-9pmf-xv68 description: CAAPH uses Helm charts to manage the installation and lifecycle of Cluster API add-ons. copyright: - license: Apache-2.0 @@ -22,6 +22,7 @@ pipeline: github.com/containerd/containerd@v1.7.27 golang.org/x/net@v0.38.0 golang.org/x/oauth2@v0.27.0 + helm.sh/helm/v3@v3.18.5 - uses: go/bump with: From 6b392cf8098977b8107c1a145797efcb3366ada7 Mon Sep 17 00:00:00 2001 From: Debasish Biswas Date: Mon, 18 Aug 2025 17:46:06 +0530 Subject: [PATCH 2/2] Fix(build): CVE rem upgrading helm to 3.18.5 also update the k8s apiserver to something latest that is missing utils/version module Signed-off-by: Debasish Biswas --- cluster-api-helm-controller.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cluster-api-helm-controller.yaml b/cluster-api-helm-controller.yaml index c180f94104a8..009a84ce512a 100644 --- a/cluster-api-helm-controller.yaml +++ b/cluster-api-helm-controller.yaml @@ -24,6 +24,8 @@ pipeline: golang.org/x/oauth2@v0.27.0 helm.sh/helm/v3@v3.18.5 github.com/docker/docker@v28.0.0 + replaces: |- + k8s.io/apiserver=k8s.io/apiserver@v0.31.12 - uses: go/bump with: