Closes four open Dependabot advisories, all patched in 7.18.0:
- Unauthenticated DoS via inefficient route matching
- Open redirect via backslash in <Link>/useNavigate (CVE-2025-68470 bypass)
- Arbitrary constructor injection in deserializeErrors()
- RSCErrorHandler missing protocol validation (XSS)
Supersedes #726, which proposed the 8.3.0 major. v8 is not required for
any of these fixes and would additionally impose Node >=22.22.0,
React >=19.2.7, ESM-only distribution and an ES2022 target.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* build(deps): bump vite, ws, js-yaml, esbuild, @babel/core in /frontend
Closes six Dependabot advisories that had no automated PR because all but
vite are transitive and not expressible as direct bumps:
vite 7.3.1 -> 7.3.6 3 high
ws 8.19.0 -> 8.21.3 1 high
js-yaml 4.1.1 -> 4.3.0 1 high
esbuild 0.27.3 -> 0.28.1 1 low
@babel/core 7.29.0 -> 7.29.7 1 low
storybook moves 10.2.10 -> 10.5.7 as a prerequisite: 10.2.10 caps esbuild
at ^0.27.0, so 0.28.1 was unreachable until storybook widened the range.
That is within the declared ^10.2.10, so only the vite range changed in
package.json.
Verified with npm ci, vite build and tsc --noEmit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(frontend): give action() story callbacks a void return
storybook 10.5.7 types action() as returning any, so the concise arrow
bodies tripped @typescript-eslint/no-unsafe-return. Wrapping the calls in
block bodies discards the return value and restores the void contract the
onSelect/onClick props expect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Closes two high-severity Dependabot advisories with no automated PR:
- tar extraction: hardlink entry with relative Linkname escapes extract
dir via process CWD resolution
- blob upload vulnerable to credential forwarding via unvalidated
Location header
Pulled in via helm.sh/helm/v3 and marked indirect; Go module resolution
allows raising it above what the parent requires. golang.org/x/sync moves
0.20.0 -> 0.22.0 as a requirement of oras-go 2.6.2.
Verified with go build, go vet and go test ./pkg/...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: upgrade Go toolchain to 1.25 and bump helm to v3.20.2
Upgrades Go from 1.24 to 1.25 in go.mod and CI workflow to fix
golangci-lint compatibility. Includes helm.sh/helm/v3 bump to v3.20.2.
Supersedes #678.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): upgrade golangci-lint-action to v7 for Go 1.25 support
Action v4 installs golangci-lint v1.x which was built with Go 1.24
and refuses to lint Go 1.25 code. Action v7 uses golangci-lint v2.x
built with Go 1.25+.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: resolve golangci-lint v2 warnings
Handle Body.Close error returns and remove redundant embedded field
selector to satisfy stricter golangci-lint v2 defaults.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The manifests endpoint returns text/plain YAML, but fetchWithSafeDefaults
treats string responses as errors and returns the fallback value ([]).
Revert useGetReleaseManifest to use fetchWithDefaults which correctly
passes through text/plain responses.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add support for installing and upgrading charts from URLs
Adds "Install from URL" button to the repositories page, allowing users
to install charts directly from OCI registries and other URLs without
adding them as repositories first. Also adds URL mode to the upgrade
modal (via pencil/X toggle) for charts not found in any configured repo.
Closes#660
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Alter
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Correct path to static dir
* Add UI build to makefile
* Fix docker build
* describe now works
* Installed page - revision view - implement url consistent state logic (#403)
* refactor
* refactor
* Fix/responsive and small stylings (#404)
* add user defined (#405)
* Fix/modal loading button (#406)
* add repo to url (#407)
* Fix/resources table badges (#408)
* filters is now good
* fix
* test results fix
* fix
* fixes - error modal, uninstall modals, typees
* fixes
* bug fix
* Helm dashboard v2 (#402)
* missing config (#409)
* fixes
* fixes
* Fix/minor responsiveness (#410)
* installed release page
* default helm icon
* guard
* refactor
* refactor
* refactor
* key
* refactor
* fixes
* fixes to install
* install, add, upgrade, reconfigure now works
* latest ver fix
* Revision page ui fixes (#411)
* link color
* Add-repository-link (#412)
* empty badge fix
* diff fix in install repo
* removed console.log
* unique key in helathstatus
* Cosmetics
* Goreleaser upgraded
* Another way to fix it
* refactor
* refactor
* chart install fix (#413)
* more maintailable
* loading, empty space and default namespace
* typed
* loading diff state is shared
* modal height fix
* upgrade and add repo connected
* add repo suggestion data connected to modal
* removed console.log
* Chart install fix (#414)
* refactor: fix text align uninstall
* install modal values big fix
* refactor
* no changes in diff msg
* refactor
* sorted versions
* typography changes
* refactor
* refactor
* refactor
* migrate to sb 7 (#416)
* Chart install fix (#415)
* Add troubleshoot in komodor (#417)
* status style
* fix
* fixes
* delete now reload the page correclty
* navigate after add repo fix
* Chart install fix (#419)
* refactor
* refactor
* Fix revision age (#420)
* refactor
* fixed redirects and nav links selected ui (#421)
* test modal ui fixes
* arrows fix
* loading ui (#422)
* test dialog now shows errors
* fixed rollback diff, redirect after rollback, and debouncing before refetching chart values after changing user defined values (#423)
* everything is working besides install chart
* install chart should work now
* no need for this anymore
* styling and naming
* improvements
* navigation fix
* flow fixes
* top bar pixel perfect
* onClose is optional
* ts optional
* pixel perfect - clusters, box shadow, error modal
* installed page pixel perfect
* fixes
* need to fix this naming
* rollback logic is now good
* buttons now similiar to the old app
* pass release instead of release date (#426)
* repository page style fixes
* rounded input
* colors like in the old app
* more rounding
* colors
* colors
* Cosmetics
* drop-shadow cause the dropdown to swallowed
* smaller text
* fixes (#428)
* fixes
* describe fix
* Fix/lint (#431)
* style fixes
* fix
* describe panel style fixes
* diff when repo is available
* diff style fixes
* fixes to install dialog
* specific version should be latests revision
* refactor
* fixes
* fixes
* cause troubles
* Fixes (#434)
* fix
* dont fetch if repo not available
* tag should not be visible
* custom-shdaow fixes
* space and shadow like in the old app
* refactor (#435)
* describe display logic aligned with the old app
* style fix
* action button style fix
* selected revision default logic fix
* font fix
* style fixes
* shutdown button fix
* latest revision is now consistent in dev and prod
* namespace should be empty on install
* fix for current version on install
* sorting fix
* checkmark should be displayed in options - install
* state jump fix
* local charts (#436)
* Several more fixes (#438)
* api docs (#439)
* html remove diff2html dep (#437)
* Refactor
* refactor
* Adding storybook for StatusLabel component (#441)
* refactor (#442)
* we need the css
* add prettier (#440)
* add prettier
* refactor
* refactor
* Fix reconfigure issue (#443)
* first diff fetch fix
* missing dep in hooks (#444)
* namespace should be from query
* triggering diff rerender by listening to loading
* missing uservalues
* no need for auto retry
* we should work against latest revision
* refactor
* Fix build merge
* refactor
* refactor
* fix
* refactor
* refactor
* age tooltip
* prettier fix
* fix bug (#447)
* Add eslint now (#449)
* repo install chart now works as expected
* release modal and eslint working good now
* we should fetch when return to the initial value
* Tailwind theme reorganized (#446)
* install release code is like reading a story !
* namespace is not needed for chart values
* install repo chart is now like reading a story :)
* Fix/filternamesapce (#451)
* not needed dep
* prettier fix
* namespace fix
* add debounce (#452)
* namespace filter fix
* now namespace filter behaves like in the old app
* more linter rules and configurations
* intial value should be empty
* no need to keep filters on cluster change
* we don't want to keep tab state between pages
* button should be disabled when loading
* prettier fix
* initial value we're not presented
* navigation fix
* namespace should always be empty
* supporting pre selected namespaces
* lint adjustments
* Refactor stories fodler (#450)
* refactor
* refactor
* if no user values, use the release values
* Adding layer to base style (#456)
* Extract duplicate type to types file (#453)
* Refactor callApi into direct usage of apiService (#454)
* Remove scanners from backend
* Give some room for multiple HealthStatus (#458)
* refactor: add dynamic api docs (#460)
* remove scanners from openapi
* was loading forever
* fix
* Extract defined values from the Modals (#461)
* refactor (#462)
* fix chart with no repo diff flow
* naming fix
* crypto UUID not available through https
* revert
* Update analytics.js with UUID fallback
* Cosmetics
* repo fetch fix
* not need to depened on versions
* forgot to push
* revert
* was causing infinite loop
* COsmetics
---------
Co-authored-by: Nir Parisian <nir.parisian@gmail.com>
Co-authored-by: dav-sap <davidsaper@gmail.com>
Co-authored-by: chad11111 <chad1111@tutanota.com>
Co-authored-by: IdanSchiller <58664272+IdanSchiller@users.noreply.github.com>
Co-authored-by: dav-sap <16819417+dav-sap@users.noreply.github.com>
Co-authored-by: rotembm12 <46103618+rotembm12@users.noreply.github.com>
Co-authored-by: naorzr <naorzruk@gmail.com>
Co-authored-by: Gary Gensler <127234894+chad11111@users.noreply.github.com>
Co-authored-by: Tamir Abutbul <1tamir198@gmail.com>
Co-authored-by: Nir Parisian <nir2002@users.noreply.github.com>
