chore(deps): bump helm.sh/helm/v3 from 3.19.2 to 3.21.3

[dependabot]

Bumps helm.sh/helm/v3 from 3.19.2 to 3.21.3.

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.21.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.21.3. The common platform binaries are here:

• MacOS amd64 (checksum / 76d0db4730b05d3d625eee11e80f0721b32b4d8422f4e5d093de6337bf3ac9f8)
• MacOS arm64 (checksum / 19879a848cad832b7a1ac24b767a481d20fb3b95ab53a220849649422ada144e)
• Linux amd64 (checksum / 15e041a93a590dce8100f39385cd98c84a765c9e36aeeb9e2dc6ff9e4769e2e0)
• Linux arm (checksum / 60f3106ba5e24371af51574fccf489d382d2f59c56ce566d02f2a6f00bf4fb3b)
• Linux arm64 (checksum / 67f58155079ff9ffab98ba5c88daff0ed9b542f3a4732f5dd426dde7dd0f5244)
• Linux i386 (checksum / 95e7ef76d4631f30e3f6c17d4355420878ca85771dbe7deb7b797521007aebe4)
• Linux ppc64le (checksum / c8657c0f77b7d3e2f9508c4a9a545b5862d01690f2a528fbbe659a3a4d534382)
• Linux s390x (checksum / d6c2dd29b32da1cb9dfef5af0cb93a1f391beca4e714779186330681b39f4b59)
• Linux riscv64 (checksum / ff063cc304a60af858242aa71b5635852d65aa7d3301a46eca17a31c54e8d994)
• Windows amd64 (checksum / ff490897e07e976c65a9bd7690cfc139b35ba5e8f25d00eaf1e53a30f1ad3f62)
• Windows arm64 (checksum / 1d409b98f99a38704ccb3f0917cbad2417ed53f75751902b6bd84447803b69a9)

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
• 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

• Apply suggestions from code review 1ad6e68924fdf6fb0c7dcef8e9e1dfc0f36eaed6 (Benoit Tigeot)
• fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e7d51b08e30a0233bd546c345ab3ea3bba (Benoit Tigeot)
• chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178ba06a8a1eeacaab1df9162b658b1e07fe9 (dependabot[bot])

Helm v3.21.2 is a patch release to correct bump the Kubernetes client libraries (client-go, etc) to match the expected Kubernetes v1.36 release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

... (truncated)

Commits

• 1ad6e68 Apply suggestions from code review
• 037733e fix: drop containerd v1 dep to resolve govulncheck CVEs
• d3e178b chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33
• 1259634 chore(deps): bump the k8s-io group with 2 updates
• b52e276 fixes
• 3342dbf chore(deps): bump the k8s-io group across 1 directory with 2 updates
• c56dd00 fix(action): avoid nil REST client getter panic when installing CRDs
• 702529f fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1
• 178e120 chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
• dcf35f8 chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	helm.sh/​helm/​v3@​v3.19.2 ⏵ v3.21.3	+1	+2
	k8s.io/​apiextensions-apiserver@​v0.35.3 ⏵ v0.36.2	+1
	k8s.io/​apimachinery@​v0.35.3 ⏵ v0.36.2
	k8s.io/​client-go@​v0.35.3 ⏵ v0.36.2	+1
	k8s.io/​api@​v0.35.3 ⏵ v0.36.2	+1
	golang.org/​x/​exp@​v0.0.0-20250408133849-7e4ce0ab07d0 ⏵ v0.0.0-20251219203646-944ab1f22d93
	github.com/​Masterminds/​semver/​v3@​v3.4.0 ⏵ v3.5.0	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang k8s.io/client-go is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → golang/k8s.io/client-go@v0.36.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/k8s.io/client-go@v0.36.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report