Helm 3.22.0 - Kubernetes 0.37 Clients And Registry Token Scopes

Helm v3.22.0 was published on 10 September 2026. It is a final release, not a release candidate. The project calls it a feature release. The notable changes section is one line: dependency updates, with the k8s-io group at 0.37.0.

The full release notes and downloads are on the GitHub release page.

The tag tip, commit 144ca65f8501953fa8b41cd1d37c7223051c85b7, is a Dependabot bump of the k8s-io group: six updates in one directory. Pull request 32573, commit 0841093658d96f4787cc9599cd2a891a3c590971, is an earlier pass of seven modules in that group. The go.mod on v3.22.0 pins the direct modules at v0.37.0: k8s.io/client-go, k8s.io/api, k8s.io/apimachinery, k8s.io/apiextensions-apiserver, k8s.io/apiserver, k8s.io/cli-runtime, and k8s.io/kubectl. k8s.io/klog/v2 is v2.140.0, up from 2.130.1 in this changelog.

Those modules are what install, upgrade, rollback, and release storage use against the API server. The notes list no removed API and no new flag. The tradeoff is skew. A 0.37 client is what you now run, so chart installs still need a pass on every cluster version you keep.

github.com/Masterminds/semver/v3 goes from 3.4.0 to 3.5.0. github.com/santhosh-tekuri/jsonschema/v6 is v6.0.3 in the tagged module. github.com/lib/pq goes from 1.11.2 to 1.12.3 (SQL release storage, Postgres). The notes do not describe a behavior change for any of the three.

The long tail is CI. Bumps of actions/checkout, actions/setup-go, actions/stale, actions/labeler, CodeQL, ossf/scorecard-action, golangci/golangci-lint-action (6.1.1 to 9.3.0), and github.com/stretchr/testify v1.12.1 do not ship in the helm binary.

Pull request 32362, commit 9dbcb9f1edb4cdf2b055870dc9a07e0c0f4b05d1, is a backport. The subject is “set [pull,push] scope when helm push to a registry (use token auth)”. In pkg/registry/client.go, Push calls WithScopeHint with auth.ActionPush and auth.ActionPull before oras.ExtendedCopy. The helper appends a repository scope when the target is an ORAS remote repository. The new test expects the token auth URL to carry scope repository:testrepo/local-subchart:pull,push on push, and repository:testrepo/local-subchart:pull on pull.

There is no new CLI flag. helm push against a bearer token realm now requests both pull and push. The patch only adds that hint inside Push. The new test covers token auth, not htpasswd basic auth.

Commit 2fb05f8a35f6c0d5760c03c12d60c46adf2b3d12 keeps credentials on the plain HTTP fallback after oras-go v2.6.1. Pull request 32331 then moves oras.land/oras-go/v2 to v2.6.2, which is what the tag requires. Retest helm push and helm pull if the registry is still plain HTTP.

The changelog names four Go advisory IDs.

Pull request 32536, commit a442b8cf64f5942ca9e920b46fceb15e0878ca80, backports google.golang.org/grpc v1.82.1 for GO-2026-6061. The tagged module lists it as indirect.

Pull request 32535, commit adab0ef15d40085b4ddad4334418dc1bf41c85c7, bumps go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158. The module file matches, also indirect.

Commit bd392c6a60d09a6c9f467dc52dbfd249a641f80d moves provenance crypto to ProtonMail/go-crypto v1.4.1 to close GO-2026-5932. The notes do not say the provenance file format changed. Run helm verify on a chart you already signed before a pipeline treats a verify failure as a bad chart.

golang.org/x/crypto is a direct requirement at v0.55.0. Pull request 32542 is the last step in the notes, from 0.54.0. Commit 1dde6c7551746a74a6f69db06eaf4fc58a90042b bumps golang.org/x/net to v0.55.0 for GO-2026-5026. The tagged go.mod resolves golang.org/x/net at v0.57.0, so the advisory floor is met and a later bump went past it.

Commit a061886b724181526f5283789e78ec4369e25ff3 drops the containerd v1 dependency to clear govulncheck findings. The v3.22.0 module file does not require github.com/containerd/containerd, and the notes describe no CLI change from the drop.

The go line is 1.26.0, recorded in commit c678c0c9c088fc2f9ddbad8c88416c77f4e048cc. The golangci-lint bump to v2.11.3 stays in CI.

Commit c02a9aed3452c0c7ee9d79ded44dd170ce5001ca stops Files.Lines from panicking on an empty file. A missing file was already empty. An empty file is a non nil zero length slice, and the helper indexed the last byte. The panic is index out of range [-1], returned as a template error from helm template, helm lint, helm install, and helm upgrade. The case is {{ range .Files.Lines "files/empty.txt" }} on a zero byte file.

Commit 0a4757359edcdfaad2e19e8ee3518188bd3cfa1b is a v3 backport, “Fix rollback for missing resources”. Commit 711a4eaf40a911b0864a01b99f59f62817443003 avoids a nil REST client getter panic when installing CRDs. Neither subject lists a flag or a migration. Those two are the rollback and CRD behavior changes in this tag. The notes stop at the subjects.

This is the last Helm 3 minor. The release text says there will be no further Helm 3 minor releases, and it links the end of life note. The next patch is 3.22.1 on 14 October 2026, the same day as 4.3.1. The next minor is 4.4.0 on 13 January 2027. Patches can still land on 3.22. A new Helm 3 feature release will not.

Binaries are signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155, on the keybase account for @scottrigby. Check the attached signatures with gpg.

One published checksum is not a checksum. The Linux loong64 line is an Azure BlobNotFound error, request id 8c31497a-101e-0042-27b6-404cb4000000, time 2026-09-09T23:55:30.1192401Z. The other digest files are sha256 sums. Linux amd64 sums to 1e4ab49e429626cf6c6958d914248b78c9730803c2751b87627e171dc800e7bb. Do not treat the loong64 field as a hash.

The install blurb links a bash script at scripts/get-helm-4 on main. That path is the Helm 4 installer, and it tracks main rather than the v3.22.0 tag. For this release, use the versioned archives on the GitHub release page, or the install guide.