Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package helm3 for openSUSE:Factory checked in at 2026-07-28 18:12:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/helm3 (Old) and /work/SRC/openSUSE:Factory/.helm3.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "helm3" Tue Jul 28 18:12:52 2026 rev:19 rq:1368033 version:3.21.3 Changes: -------- --- /work/SRC/openSUSE:Factory/helm3/helm3.changes 2026-07-21 23:13:09.891968941 +0200 +++ /work/SRC/openSUSE:Factory/.helm3.new.2004/helm3.changes 2026-07-28 18:15:16.140991535 +0200 @@ -1,0 +2,5 @@ +Mon Jul 27 12:59:00 UTC 2026 - Dirk Müller <[email protected]> + +- add CVE-2026-63308.patch (CVE-2026-63308, bsc#1272402) + +------------------------------------------------------------------- New: ---- CVE-2026-63308.patch ----------(New B)---------- New: - add CVE-2026-63308.patch (CVE-2026-63308, bsc#1272402) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ helm3.spec ++++++ --- /var/tmp/diff_new_pack.7D5vCz/_old 2026-07-28 18:15:17.729047050 +0200 +++ /var/tmp/diff_new_pack.7D5vCz/_new 2026-07-28 18:15:17.733047189 +0200 @@ -27,6 +27,7 @@ URL: https://github.com/helm/helm Source0: %{name}-%{version}.tar.gz Source1: vendor.tar.gz +Patch1: CVE-2026-63308.patch Provides: helm = %{version} BuildRequires: fish BuildRequires: golang-packaging ++++++ CVE-2026-63308.patch ++++++ >From 143631f7356d7f2250540c044ae20277f495cc2f Mon Sep 17 00:00:00 2001 From: Mahesh Sadupalli <[email protected]> Date: Fri, 3 Jul 2026 20:28:01 +0200 Subject: [PATCH] fix(engine): prevent Files.Lines panic on empty file Files.Lines guards against a nil entry but an empty file inside a chart is stored as a non-nil zero-length byte slice, so the trailing newline check indexes s[-1] and panics. The engine recovers the panic into a render error, making every template/install/upgrade/lint that references the file fail. Extend the guard to len(f[path]) == 0 and return an empty slice, matching the behaviour for missing files. Fixes #32279 Signed-off-by: Mahesh Sadupalli <[email protected]> --- pkg/engine/files.go | 2 +- pkg/engine/files_test.go | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) Index: helm-4.2.3/pkg/engine/files.go =================================================================== --- helm-4.2.3.orig/pkg/engine/files.go +++ helm-4.2.3/pkg/engine/files.go @@ -154,7 +154,7 @@ func (f files) AsSecrets() string { // {{ range .Files.Lines "foo/bar.html" }} // {{ . }}{{ end }} func (f files) Lines(path string) []string { - if f == nil || f[path] == nil { + if f == nil || len(f[path]) == 0 { return []string{} } s := string(f[path]) Index: helm-4.2.3/pkg/engine/files_test.go =================================================================== --- helm-4.2.3.orig/pkg/engine/files_test.go +++ helm-4.2.3/pkg/engine/files_test.go @@ -30,6 +30,8 @@ var cases = []struct { {"story/author.txt", "Joseph Conrad"}, {"multiline/test.txt", "bar\nfoo\n"}, {"multiline/test_with_blank_lines.txt", "bar\nfoo\n\n\n"}, + {"empty/empty.txt", ""}, + {"empty/newline_only.txt", "\n"}, } func getTestFiles() files { @@ -109,3 +111,31 @@ func TestBlankLines(t *testing.T) { as.Equal("bar", out[0]) as.Equal("", out[3]) } + +func TestLinesEmptyFile(t *testing.T) { + as := assert.New(t) + + f := getTestFiles() + + out := f.Lines("empty/empty.txt") + as.Empty(out) +} + +func TestLinesNewlineOnlyFile(t *testing.T) { + as := assert.New(t) + + f := getTestFiles() + + out := f.Lines("empty/newline_only.txt") + as.Len(out, 1) + as.Empty(out[0]) +} + +func TestLinesMissingFile(t *testing.T) { + as := assert.New(t) + + f := getTestFiles() + + out := f.Lines("nonexistent.txt") + as.Empty(out) +}
