Skip to content

chore(renovate): hold the Headlamp plugin's TypeScript below 7 #2069

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Smana merged 1 commit into from
Sep 21, 2026
Merged

chore(renovate): hold the Headlamp plugin's TypeScript below 7 #2069

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,16 @@
],
"allowedVersions": "<8"
},
{
"description": "Hold the Headlamp plugin's TypeScript below 7. typescript-eslint, pulled in through @headlamp-k8s/eslint-config, refuses TS 7 (\"typescript-eslint does not support TS 7.0\"), so the image build fails at `npm run lint` and never reaches the compiler. Renovate opened #2032 for it anyway. Lift this bound once typescript-eslint supports TS >= 7: https://github.com/typescript-eslint/typescript-eslint/issues/10940",
"matchFileNames": [
"container-images/headlamp-plugin-app/**"
],
"matchPackageNames": [
"typescript"
],
"allowedVersions": "<7"
},
{
"description": "Never automerge a GitHub Action digest bump. Every `uses:` in this repo is pinned to a commit SHA, which is what makes a retagged action -- the tj-actions/changed-files compromise, CVE-2025-30066, where every tag including version tags was moved to a commit that dumped runner memory into the build log -- a visible diff rather than a silent substitution. That property only holds while a human looks at the new SHA. Automerging digest updates would restore the old behaviour exactly, with a PR trail as the only difference. Stated as its own rule rather than relying on `digest` being absent from the patch/minor automerge list above, so widening that list cannot undo this by accident. `minimumReleaseAge` is the second half: a malicious retag is typically caught within hours, so not proposing one for three days means the usual attack is revoked before it is ever offered here.",
"matchManagers": [
Expand Down
Loading