From 01ea63f1604ae3f3723cc9cce25c4fdc9b1e3825 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 26 Sep 2026 15:12:53 +0000
Subject: [PATCH] Update vendir https://github.com/helm/helm to v4.3.0

---
 modules/k3s/flux/vendor/scripts/get-helm-4 | 9 ++++++---
 vendir.lock.yml                            | 6 +++---
 vendir.yml                                 | 2 +-
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/modules/k3s/flux/vendor/scripts/get-helm-4 b/modules/k3s/flux/vendor/scripts/get-helm-4
index 1c90bbad..3d232cca 100644
--- a/modules/k3s/flux/vendor/scripts/get-helm-4
+++ b/modules/k3s/flux/vendor/scripts/get-helm-4
@@ -114,12 +114,15 @@ verifySupported() {
 checkDesiredVersion() {
   if [ "x$DESIRED_VERSION" == "x" ]; then
     # Get tag from release URL
-    local latest_release_url="https://get.helm.sh/helm4-latest-version"
+    # Cache behavior is provider-specific, so this mitigation is best effort.
+    # The current CDN does not revalidate on the request no-cache directive,
+    # so use a unique query while retaining no-cache for compliant intermediaries.
+    local latest_release_url="https://get.helm.sh/helm4-latest-version?ts=$(date +%s)"
     local latest_release_response=""
     if [ "${HAS_CURL}" == "true" ]; then
-      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
+      latest_release_response=$( curl -L --silent --show-error --fail --header "Cache-Control: no-cache" "$latest_release_url" 2>&1 || true )
     elif [ "${HAS_WGET}" == "true" ]; then
-      latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true )
+      latest_release_response=$( wget "$latest_release_url" --header="Cache-Control: no-cache" -q -O - 2>&1 || true )
     fi
     TAG=$( echo "$latest_release_response" | grep '^v[0-9]' )
     if [ "x$TAG" == "x" ]; then
diff --git a/vendir.lock.yml b/vendir.lock.yml
index 0534186a..437b90e4 100644
--- a/vendir.lock.yml
+++ b/vendir.lock.yml
@@ -10,10 +10,10 @@ directories:
   path: modules/k3s/server_node/vendor
 - contents:
   - git:
-      commitTitle: 'Minimal fix to build failure from #31211....'
-      sha: 3900f434fd3ef2b84065dc04508df48f288dba00
+      commitTitle: 'chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1...'
+      sha: bec5b06ed841fe5269972d864d5177944fd5970f
       tags:
-      - v4.2.4
+      - v4.3.0
     path: .
   path: modules/k3s/flux/vendor
 kind: LockConfig
diff --git a/vendir.yml b/vendir.yml
index 85efc7f6..a1739739 100644
--- a/vendir.yml
+++ b/vendir.yml
@@ -16,7 +16,7 @@ directories:
       - path: .
         git:
           url: https://github.com/helm/helm
-          ref: v4.2.4
+          ref: v4.3.0
           depth: 1
         includePaths:
           - scripts/get-helm-4