Security feed

This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (bsc#1281104). - CVE-2026-85732: oras.la…

Summary oras-go's pagination helper parseLink() in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header…