Compare commits

..

2 Commits

Author SHA1 Message Date
Chris Farhood 2789b6eb47 Regenerate lockfile for lodash override
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-03 18:15:36 +00:00
Gandalf the Greybeard 5cbf0af261 fix: override lodash >=4.18.0 to patch code injection vulnerability
GHSA-r5fr-rjxr-66jc is a code injection vulnerability in lodash
below 4.18.0. The vulnerable transitive dependency comes through
@kinvolk/headlamp-plugin.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-23 10:58:21 +00:00
2 changed files with 2 additions and 3 deletions
+2 -2
View File
@@ -121,7 +121,7 @@ For Headlamp running in Kubernetes:
kubectl create configmap headlamp-sealed-secrets-plugin \ kubectl create configmap headlamp-sealed-secrets-plugin \
--from-file=main.js=dist/main.js \ --from-file=main.js=dist/main.js \
--from-file=package.json=package.json \ --from-file=package.json=package.json \
-n kube-system -n headlamp
``` ```
2. **Update Headlamp deployment**: 2. **Update Headlamp deployment**:
@@ -149,7 +149,7 @@ For Headlamp running in Kubernetes:
3. **Apply and restart**: 3. **Apply and restart**:
```bash ```bash
kubectl apply -f headlamp-deployment.yaml kubectl apply -f headlamp-deployment.yaml
kubectl rollout restart deployment/headlamp -n kube-system kubectl rollout restart deployment/headlamp -n headlamp
``` ```
## Verification ## Verification
-1
View File
@@ -52,7 +52,6 @@
"overrides": { "overrides": {
"tar": "^7.5.11", "tar": "^7.5.11",
"undici": "^7.24.3", "undici": "^7.24.3",
"vite": ">=6.4.2",
"lodash": ">=4.18.0" "lodash": ">=4.18.0"
}, },
"dependencies": { "dependencies": {