Last checked and updated on 04 May 2026
What Is New in Helm 3.12?
| Category | Key Changes |
|---|---|
| New Features | Standard OCI annotations, --set-literal flag, --cascade uninstall option, support for insecure OCI registries and custom certificates. |
| Improvements | Better readiness checks for StatefulSets, refined linting behavior, enhanced handling of Go 1.20 DNS quirks. |
| Bug Fixes | Fixed goroutine leaks in install and perform paths, corrected Windows test failures, resolved 32‑bit typo, fixed table request/response misuse. |
| Security | Added insecure option for OCI login, enabled custom certificates for OCI, improved TLS handling for Go 1.20+. |
| Deprecations | Removed varcheck and deadcode linters (deprecated since v1.49.0). |
How does Helm 3.12 improve OCI registry support?
OCI artifacts now carry standard annotations such as org.opencontainers.image.version, making them readable by other tools. This matters because downstream automation can rely on a consistent metadata schema.
Helm also introduces an --insecure flag for helm registry login and a custom‑certificate option, allowing you to work with private registries that use self‑signed certs without extra plumbing.
Reference: Helm OCI Registry Docs
What new CLI flags are available in Helm 3.12?
--set-literal– sets a value exactly as typed, bypassing Helm’s default escaping.--cascade– lets you choose a deletion policy (foreground/background) when uninstalling a release.--insecure(registry login) – disables TLS verification for OCI registries.- Custom certificate flag for OCI – points Helm at a PEM bundle for registry communication.
Example usage:
helm install myapp ./chart \\
--set-literal imageTag=1.2.3 \\
--cascade foregroundWhich bugs were addressed in Helm 3.12?
- Goroutine leaks in
helm installand internal perform logic were eliminated. - Windows‑specific test failures were fixed, improving cross‑platform reliability.
- Readiness checks now correctly handle StatefulSets with partitioned rolling updates.
- Table request/response misuse against the Kubernetes API was corrected.
- Various linting and quiet‑mode edge cases were tightened.
What dependency upgrades are included in Helm 3.12?
- Kubernetes client libraries bumped to
v0.27.1. - Go version upgraded to
1.20(affects TLS handling). - Docker client, containerd, and several Go modules received security‑focused updates.
- Deprecated linters (varcheck, deadcode) were removed from the default lint set.
FAQ
Can I use --set-literal to pass JSON strings?
Yes, the flag stores the exact string you provide, so JSON or other complex values are not escaped.
What does the --cascade flag control?
It selects the uninstall propagation policy – foreground waits for dependent resources to be deleted, while background returns immediately.
Do the new OCI annotations affect existing charts?
No, they are added only when pushing to an OCI registry; existing charts continue to work unchanged.
How do I enable insecure OCI registry access?
Run helm registry login <registry> --insecure or set the custom certificate flag to point at your PEM file.
Is there any impact on Helm’s upgrade path from 3.11?
The upgrade is straightforward; the binary is a drop‑in replacement and the new flags are optional, so existing CI pipelines remain functional.