Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package helm for openSUSE:Factory checked in at 2026-07-28 18:07:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/helm (Old) and /work/SRC/openSUSE:Factory/.helm.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "helm" Tue Jul 28 18:07:13 2026 rev:111 rq:1368032 version:4.2.3 Changes: -------- --- /work/SRC/openSUSE:Factory/helm/helm.changes 2026-07-21 23:12:38.778905045 +0200 +++ /work/SRC/openSUSE:Factory/.helm.new.2004/helm.changes 2026-07-28 18:08:57.219741159 +0200 @@ -1,0 +2,5 @@ +Mon Jul 27 12:59:00 UTC 2026 - Dirk Müller <[email protected]> + +- add CVE-2026-63308.patch (CVE-2026-63308, bsc#1272402) + +------------------------------------------------------------------- New: ---- CVE-2026-63308.patch ----------(New B)---------- New: - add CVE-2026-63308.patch (CVE-2026-63308, bsc#1272402) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ helm.spec ++++++ --- /var/tmp/diff_new_pack.4iw2Ru/_old 2026-07-28 18:08:59.751829873 +0200 +++ /var/tmp/diff_new_pack.4iw2Ru/_new 2026-07-28 18:08:59.755830014 +0200 @@ -25,6 +25,7 @@ URL: https://github.com/helm/helm Source0: %{name}-%{version}.tar.gz Source1: vendor.tar.gz +Patch1: CVE-2026-63308.patch BuildRequires: bash-completion BuildRequires: fish BuildRequires: zsh ++++++ CVE-2026-63308.patch ++++++ >From 143631f7356d7f2250540c044ae20277f495cc2f Mon Sep 17 00:00:00 2001 From: Mahesh Sadupalli <[email protected]> Date: Fri, 3 Jul 2026 20:28:01 +0200 Subject: [PATCH] fix(engine): prevent Files.Lines panic on empty file Files.Lines guards against a nil entry but an empty file inside a chart is stored as a non-nil zero-length byte slice, so the trailing newline check indexes s[-1] and panics. The engine recovers the panic into a render error, making every template/install/upgrade/lint that references the file fail. Extend the guard to len(f[path]) == 0 and return an empty slice, matching the behaviour for missing files. Fixes #32279 Signed-off-by: Mahesh Sadupalli <[email protected]> --- pkg/engine/files.go | 2 +- pkg/engine/files_test.go | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) Index: helm-4.2.3/pkg/engine/files.go =================================================================== --- helm-4.2.3.orig/pkg/engine/files.go +++ helm-4.2.3/pkg/engine/files.go @@ -154,7 +154,7 @@ func (f files) AsSecrets() string { // {{ range .Files.Lines "foo/bar.html" }} // {{ . }}{{ end }} func (f files) Lines(path string) []string { - if f == nil || f[path] == nil { + if f == nil || len(f[path]) == 0 { return []string{} } s := string(f[path]) Index: helm-4.2.3/pkg/engine/files_test.go =================================================================== --- helm-4.2.3.orig/pkg/engine/files_test.go +++ helm-4.2.3/pkg/engine/files_test.go @@ -30,6 +30,8 @@ var cases = []struct { {"story/author.txt", "Joseph Conrad"}, {"multiline/test.txt", "bar\nfoo\n"}, {"multiline/test_with_blank_lines.txt", "bar\nfoo\n\n\n"}, + {"empty/empty.txt", ""}, + {"empty/newline_only.txt", "\n"}, } func getTestFiles() files { @@ -109,3 +111,31 @@ func TestBlankLines(t *testing.T) { as.Equal("bar", out[0]) as.Equal("", out[3]) } + +func TestLinesEmptyFile(t *testing.T) { + as := assert.New(t) + + f := getTestFiles() + + out := f.Lines("empty/empty.txt") + as.Empty(out) +} + +func TestLinesNewlineOnlyFile(t *testing.T) { + as := assert.New(t) + + f := getTestFiles() + + out := f.Lines("empty/newline_only.txt") + as.Len(out, 1) + as.Empty(out[0]) +} + +func TestLinesMissingFile(t *testing.T) { + as := assert.New(t) + + f := getTestFiles() + + out := f.Lines("nonexistent.txt") + as.Empty(out) +}
