Replace privilegedescalation-dev with headlamp-dev namespace

Co-Authored-By: Paperclip <noreply@paperclip.ing>
chore: replace Dependabot references with Renovate (#55 )
2026-05-05 01:47:25 +00:00 · 2026-05-04 21:19:15 +00:00 · 2026-05-04 03:24:04 +00:00 · 2026-05-03 17:44:05 +00:00 · 2026-04-15 04:01:28 +00:00 · 2026-04-15 03:51:04 +00:00
9 changed files with 1183 additions and 765 deletions
@@ -16,3 +16,5 @@ jobs:
  dual-approval:
    uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
    secrets: inherit
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
@@ -151,7 +151,7 @@ Plaintext values never leave your browser.
 | Network sniffing | No plaintext on network | ✅ Protected |
 | Compromised proxy | Only sees encrypted data | ✅ Protected |
 | Browser XSS | Headlamp CSP policies | ⚠️ Standard web security |
-| Supply chain | Package locks, dependabot | ⚠️ Ongoing monitoring |
+| Supply chain | Package locks, Renovate | ⚠️ Ongoing monitoring |

 See: [ADR 003: Client-Side Encryption](docs/architecture/adr/003-client-side-crypto.md)

@@ -70,7 +70,7 @@ Key dependencies with security implications:
 - **node-forge**: Used for client-side encryption of secret values with the cluster's sealing certificate. Keep this dependency up to date.
 - **@kinvolk/headlamp-plugin**: Peer dependency providing the Kubernetes API proxy. Update by upgrading your Headlamp installation.

-The project uses `npm audit` and Dependabot to monitor for known vulnerabilities.
+The project uses `npm audit` and Renovate to monitor for known vulnerabilities.

 ## Contact

@@ -1,6 +1,6 @@
 # Artifact Hub package metadata file
 # https://github.com/artifacthub/hub/blob/master/docs/metadata/artifacthub-pkg.yml
-version: "1.0.1"
+version: "1.0.2"
 name: headlamp-sealed-secrets
 displayName: Sealed Secrets
 createdAt: "2026-02-12T00:00:00Z"
@@ -19,8 +19,8 @@ keywords:
  - encryption
  - security
 annotations:
-  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/download/v1.0.1/sealed-secrets-1.0.1.tar.gz"
-  headlamp/plugin/archive-checksum: sha256:a7935aac260dd08d1363321e8d2320d9f9feee74e47bf51d95a6df4bd33f7f16
+  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/download/v1.0.2/sealed-secrets-1.0.2.tar.gz"
+  headlamp/plugin/archive-checksum: sha256:0eaf34d380d133120d3a50c890e0c96b23717427887b1f23377a841cb3783b11
  headlamp/plugin/version-compat: ">=0.13.0"
  headlamp/plugin/distro-compat: "desktop,in-cluster,web,docker-desktop"
 links:
@@ -73,4 +73,4 @@ maintainers:
 recommendations:
  - url: https://artifacthub.io/packages/helm/sealed-secrets/sealed-secrets
 provider:
-  name: privilegedescalation
+  name: privilegedescalation
@@ -349,7 +349,7 @@ Added type safety:

 **Supply Chain**:
 - Risk: Compromised node-forge dependency
- Mitigation: Package lock, dependabot, regular audits
+- Mitigation: Package lock, Renovate, regular audits
 - Same risk as any JavaScript dependency

 **Browser Extensions**:
@@ -1,6 +1,6 @@
 {
  "name": "sealed-secrets",
-  "version": "1.0.1",
+  "version": "1.0.2",
  "description": "Headlamp plugin for Bitnami Sealed Secrets - manage encrypted Kubernetes secrets",
  "files": [
    "dist",
@@ -51,7 +51,9 @@
  ],
  "overrides": {
    "tar": "^7.5.11",
-    "undici": "^7.24.3"
+    "undici": "^7.24.3",
+    "vite": ">=6.4.2",
+    "lodash": ">=4.18.0"
  },
  "dependencies": {
    "node-forge": "^1.4.0"
@@ -5,7 +5,7 @@
 # a ConfigMap volume mount. No custom Docker images — the plugin is built
 # in CI and injected as a ConfigMap.
 #
-# E2E resources are deployed to the `privilegedescalation-dev` namespace. Nothing
+# E2E resources are deployed to the `headlamp-dev` namespace. Nothing
 # persists beyond the test run — teardown cleans up all created resources.
 #
 # Prerequisites:
@@ -14,7 +14,7 @@
 #   - RBAC applied: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
 #
 # Environment:
-#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: privilegedescalation-dev)
+#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: headlamp-dev)
 #   E2E_RELEASE       — release/resource name prefix (default: headlamp-e2e)
 #   HEADLAMP_VERSION  — Headlamp image tag (default: latest)
 set -euo pipefail
@@ -22,7 +22,7 @@ set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DIST_DIR="$REPO_ROOT/dist"

-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
 HEADLAMP_VERSION="${HEADLAMP_VERSION:-latest}"

@@ -4,13 +4,13 @@
 # Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh.
 #
 # Environment:
-#   E2E_NAMESPACE  — namespace to clean up (default: privilegedescalation-dev)
+#   E2E_NAMESPACE  — namespace to clean up (default: headlamp-dev)
 #   E2E_RELEASE    — release/resource name prefix (default: headlamp-e2e)
 set -euo pipefail

 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"

-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"

 echo "=== E2E Headlamp Teardown ==="
Author	SHA1	Message	Date
Chris Farhood	fb5573cd9e	Replace privilegedescalation-dev with headlamp-dev namespace Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-05 01:47:25 +00:00
privilegedescalation-engineer[bot]	67602fb279	chore: replace Dependabot references with Renovate (#55 ) - SECURITY.md: update to mention Renovate instead of Dependabot - README.md: update supply chain table - ADR 003: update mitigation to mention Renovate Closes PRI-389. Parent PRI-387. Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-04 21:19:15 +00:00
privilegedescalation-engineer[bot]	ecdee4a95a	Regenerate lockfile for lodash+vite overrides (#53 ) Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-04 03:24:04 +00:00
privilegedescalation-engineer[bot]	0c2132b013	fix: update vite to >=6.4.2 to patch arbitrary file read vulnerability (#51 ) Vite versions >=6.0.0 <=6.4.1 are vulnerable to arbitrary file read via the Vite Dev Server WebSocket (server.fs.deny bypass with queries). CVE: GHSA-p9ff-h696-f583 Co-authored-by: Gandalf the Greybeard <gandalf@privilegedescalation.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-03 17:44:05 +00:00
privilegedescalation-engineer[bot]	780f58f9d9	release: v1.0.2 (#50 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-04-15 04:01:28 +00:00
privilegedescalation-ceo[bot]	d1ea2fa36e	fix: correct artifacthub-pkg.yml checksum on main for v1.0.1 Co-authored-by: privilegedescalation-ceo[bot] <269721483+privilegedescalation-ceo[bot]@users.noreply.github.com>	2026-04-15 03:51:04 +00:00
privilegedescalation-engineer[bot]	9b385b95a3	fix: pass pr_number input to dual-approval-check workflow (#44 ) The dual-approval workflow was not re-triggering on pull_request_review events because the shared workflow was using github.event.pull_request.number which is not available in workflow_call context. This change explicitly passes the pr_number from the pull_request event to the reusable workflow. Co-authored-by: Hugh Hackman <hugh@privilegedescalation.dev> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-04-15 03:29:59 +00:00