Vite versions >=6.0.0 <=6.4.1 are vulnerable to arbitrary file read via
the Vite Dev Server WebSocket (server.fs.deny bypass with queries).
CVE: GHSA-p9ff-h696-f583
Co-authored-by: Gandalf the Greybeard <gandalf@privilegedescalation.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Bumps version to 1.0.1 and updates artifacthub-pkg.yml with the
correct archive URL for v1.0.1. The archive-checksum is intentionally
left blank so the release workflow can compute it after rebuilding the
tarball (fixes the v1.0.0 ordering bug fixed in PR #80).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Follows the pattern established in headlamp-intel-gpu-plugin (PR #25):
- e2e/sealed-secrets.spec.ts: 5 smoke tests covering sidebar navigation,
list view, sealing keys view, cross-view navigation, and plugin settings
- e2e/auth.setup.ts: shared OIDC + token auth setup
- playwright.config.ts: fail-fast if HEADLAMP_URL not set (no prod URL fallback)
- scripts/deploy-e2e-headlamp.sh: ConfigMap-based plugin injection to privilegedescalation-dev
- scripts/teardown-e2e-headlamp.sh: clean teardown of all E2E resources
pnpm/action-setup@v5 requires either a version key in the action config
or a packageManager field in package.json. Add the field to unblock the
release workflow.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
npm/pnpm rejects a package.json that specifies the same package in both
overrides and devDependencies (EOVERRIDE). Since typescript is now a
direct devDependency pinned at ~5.6.2, remove it from overrides.
pnpm strict hoisting means only direct deps are on PATH. The overrides
entry pins the version but does not install tsc as a binary. Without an
explicit devDependency entry pnpm run tsc fails with "tsc: not found".
- Add eslint@^8.57.0, @headlamp-k8s/eslint-config@^0.6.0, prettier@^2.8.8
as explicit devDependencies — without these the lint and format:check CI
steps fail with "eslint: not found" / "prettier: not found"
- Remove vite/client and vite-plugin-svgr/client from tsconfig types — these
are transitive deps that pnpm does not hoist; polaris plugin omits them too
and tsc passes cleanly without them
- Update pnpm-lock.yaml to reflect new direct deps
- Bump version to 1.0.0 in package.json and artifacthub-pkg.yml
- Add explicit devDependencies: vitest, @testing-library/react,
@testing-library/jest-dom, @testing-library/user-event, jsdom,
react, react-dom, @types/react, @types/react-dom, react-router-dom,
@mui/material, notistack — resolves phantom-dep test failures
- Add process.env.NODE_ENV define to vitest.config.mts (fixes
"act() not supported in production builds" failures)
- Switch to pnpm lockfile (pnpm-lock.yaml), drop package-lock.json
- Remove install-plugin.sh (violates ArtifactHub-only install policy)
- Fill in CHANGELOG entries for v0.2.22, v0.2.23, v0.2.24
- Update CHANGELOG [1.0.0] and version comparison links
- All 233 tests pass
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Fix handleRotate bug ignoring Result from rotateSealedSecret()
- Fix dead code branch in useControllerHealth
- Replace all `any` types with `unknown` + type guards
- Delete unused functions/exports (452 lines removed)
- Add 18 new test files covering all hooks, libs, and components
- 233 tests passing, zero tsc errors, zero lint issues
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Chris Farhood
privilegedescalation-engineer[bot]