Helm v3.21.4 - Security And Rendering Fixes

Helm v3.21.4 was published on August 14, 2026. This stable patch release updates four Go dependency paths for security advisories. It also prevents Files.Lines from panicking when a chart supplies an empty file.

The full release notes and downloads are on the GitHub release page.

Security maintenance accounts for most of this release. The provenance implementation moves to ProtonMail/go-crypto to resolve GO-2026-5932. That is the change most likely to interest teams that verify chart provenance or audit the cryptographic packages embedded in deployment tooling.

The telemetry dependency go.opentelemetry.io/otel moves to version 1.44.0 for GO-2026-5158. The RPC dependency google.golang.org/grpc moves to version 1.82.1 for GO-2026-6061. Both entries are explicitly marked as dev-v3 backports, so the release brings those corrections into the Helm 3 line rather than reserving them for later development.

The fourth dependency update moves golang.org/x/crypto from 0.53.0 to 0.54.0. It also includes golang.org/x/text 0.40.0 to address GO-2026-5970. The notes do not claim new commands, flags, or configuration keys around any of these updates. For platform teams, this is dependency hygiene in an existing command line tool, not a workflow change.

Inventory systems should record the exact component versions and advisory identifiers. A generic note that Helm was patched loses the detail needed when the same Go modules appear in controllers, plugins, or internal utilities.

The sole direct behavior fix prevents Files.Lines from panicking on an empty file. Charts can use this template function to read a bundled file one line at a time. Before this patch, an empty input could terminate template evaluation instead of yielding no lines.

This is narrow, but it removes a brittle edge from generated charts. Pipeline packaging steps often create placeholder files before data is populated. A zero byte result should not turn a chart render into an application panic. The release notes list no related value schema change and no new template syntax.

Chart maintainers should retain empty fixtures in render tests rather than replacing them with artificial content. That verifies the corrected path and catches any separate chart assumption that at least one line exists.

The project lists v3.21.4 as a patch release, not a prerelease. No breaking changes or migration steps are documented. Existing Helm 3 automation should therefore need a binary replacement and its usual chart regression run, with extra attention to provenance checks because the crypto implementation changed.

Official archives cover macOS, Linux, and Windows across the architectures named in the notes. Each archive has a published SHA256 checksum. The release is also signed with fingerprint 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155, with attached signatures intended for verification through gpg.

For automated installation, pin the archive for the required platform and verify its checksum before promotion. Teams that require signature verification should test that path as well. The security changes make artifact identity part of the upgrade, not an optional detail after the binary has entered a build image.