Provenance Record

Concise, well-structured Briefing (573 words by the script, within 300-800). Neutral, no AI self-reference, includes a What We Don't Know section. Accurately reports that only the 3.22.1 changelog names the five Go vulnerability IDs and the 4.3.1 notes name none.

Snapshots source-0..6 (all HTTP 200, no archive fallback, suspicious_patterns null for all) were read from disk and cross-checked against live raw text: GitHub API (repos/helm/helm/releases/tags/*) for both Helm releases and the raw vuln.go.dev JSON for each Go entry. source-0 (helm v4.3.1): published_at 2026-10-15T01:08:37Z; notable changes 'fix(action): wait for CRD establishment under HookOnlyStrategy' #32672 and golangci-lint v2.14.0 #32744; changelog has 'bump golang.org/x/net to v0.61.0 (#32758)', controller-runtime 0.25.1->0.25.2 (#32726), kyaml 0.21.1->0.21.2 (#32715), otel/sdk 1.44.0->1.45.0 (#32662); no GO- IDs anywhere. source-1 (helm v3.22.1): published_at 2026-10-15T17:02:01Z; notable changes 'Bumps dependencies to remove Go package vulnerabilities' and 'Updates the k8s.io Go packages'; changelog: distribution/distribution/v3 (#32697), k8s.io group v0.37.1 (#32761), otlptracegrpc/http v1.45.0 (#32760), 'bump golang.org/x/net to v0.60.0 for GO-2026-6617 GO-2026-6612 GO-2026-6611 GO-2026-6610 GO-2026-6603 (#32759)'. Both pages' What's Next sections state 4.3.2 and 3.22.2 patch releases on November 11, 2026, 4.4.0 on January 13, 2027, and 'There will be no further Helm 3 minor releases' (verbatim). Both release dates are October 15 in UTC. source-2..6 (Go vuln entries), each published Oct 08, 2026 (2026-10-08T22:31:09Z): GO-2026-6617 / CVE-2026-97032, HPACK encoder modified from two goroutines, credit RyotaK (GMO Flatt Security); GO-2026-6612 / CVE-2026-78663, double refund of connection-level flow control bypassing MaxReceiveBufferPerConnection, credit Ali Sherif; GO-2026-6611 / CVE-2026-78669, excessive CPU via many streams plus small SETTINGS (SETTINGS_INITIAL_WINDOW_SIZE) frames, credit Jakub Ciolek; GO-2026-6610 / CVE-2026-78660, malformed framing headers forwarded to HTTP/1 client when reverse proxying, possible response smuggling, credit TJ Barton; GO-2026-6603 / CVE-2026-78659, Trailer header declaring many fields to HTTP/2 server bypassing Server.MaxHeaderValueCount and MaxHeaderBytes, credit RyotaK. All five list net/http (before go1.26.9), net/http/internal/http2 (from go1.27.0-0 before go1.27.2) and golang.org/x/net/http2 (before v0.60.0) as affected. Every summary in the article matches its entry; the article does not state fixed versions or credits. Hostnames github.com and pkg.go.dev are on config/source_allowlist.txt by exact match. Body URLs equal article.sources (7/7, no orphans); the one internal link /article/2026-10/17-go-1272-and-1269-... resolves to an existing published article that covers GO-2026-6617 consistently (HTTP/2 HPACK crash) and is described accurately.

All numbers, versions, PR numbers, dates and quotes verified verbatim. Context only (not claimed by the article): each Go entry marks golang.org/x/net fixed at v0.60.0, so both x/net v0.60.0 (Helm 3.22.1) and v0.61.0 (Helm 4.3.1) are at or above the fixed version for all five entries. The article explicitly declines to compare versions and to assess Helm reachability, and does not imply the releases fix the issues beyond restating the Helm 3 changelog wording; that framing is supported. The 'What We Don't Know' line that Helm 4 names no vulnerability is accurate.

Accurate, carefully scoped release Briefing; every claim traces to a cited source. Featured candidacy: 1 - accurate patch-release coverage for Kubernetes/Helm users, incremental in scope