ci: set min age for `npm` installed packages by christian-heusel · Pull Request #1003 · kubeflow/notebooks

christian-heusel · 2026-04-01T09:23:38Z

chore: Infer node version in CI from packages.json
ci: Enforce a minimum npm release age for increased supply chain security
ci: Use npm ci instead of npm install in CI

christian-heusel · 2026-04-01T09:24:15Z

/ok-to-test

andyatmiami

overall this looks just - just a minor nit and looking for simply some clarification on one of the changes.

andyatmiami · 2026-04-02T15:11:27Z

  },
  "engines": {
-    "node": ">=20.0.0"
+    "npm" : "^11.10.0",


minor nit:

Suggested change

"npm" : "^11.10.0",

"npm": "^11.10.0",

If I recall correctly, npm 11 ships with Node 24 (not yet LTS). Node 20 ships with npm 10.x. Are we sure we want to pinning to ^20 for Node but requiring a npm version that doesn't ship with Node 20?

Yes, we actually need to (I outlined the reasoning in the commit message for 790e0e1) if we want to use the min-release-age attrbute. Before this version it is not respected.

ederign · 2026-04-02T16:25:36Z

@christian-heusel thanks for working on this! Just some questions in the PR.

thesuperzapper · 2026-04-02T16:49:37Z

I think this change is critical for the security of maintainers themselves, as there have been many recent cases where these supply chain attacks target the developer computers, rather than the end user consuming the javascript service.

ederign · 2026-04-02T17:06:39Z

@thesuperzapper I agree with you, the only point that I'm making is the corner case/tradeoff if there is a day zero CVE and a patch recently released, we would need to patch both package and min-release-age=7 (something that Dependabot doesn't do).

Signed-off-by: Christian Heusel <christian@heusel.eu>

…rity This feature is available the earliest in `npm` with version "v11.10.0" The upstream `actions/setup-node` GHA does not allow to specify a fixed `npm` version, but we need it to be a specific version in an upcoming change, on its own the action itself installs version "10.8.2" right now. To keep the setup maintainable the version is extracted from `packages.json`. Related to actions/setup-node#529 Related to npm/cli#8570 Signed-off-by: Christian Heusel <christian@heusel.eu>

This way the `packages-lock.json` stays untouched and other sane defaults are set for the CI. Link: https://docs.npmjs.com/cli/v8/commands/npm-ci Signed-off-by: Christian Heusel <christian@heusel.eu>

ederign · 2026-04-02T18:20:52Z

Follow up for my comment will be part of : #818

ederign · 2026-04-02T18:20:58Z

/approve
/lgtm

ederign · 2026-04-02T18:21:18Z

Thanks @christian-heusel

ederign · 2026-04-02T18:24:55Z

/approve

ederign · 2026-04-02T19:00:15Z

@andyatmiami @thesuperzapper we need someone with approval on CI.

andyatmiami · 2026-04-02T19:11:33Z

/lgtm
/approve

thanks @christian-heusel - we have been discussing this on/off on various slack channels today and feel like this improves our security posture. we can/will adjust/adapt moving forward as needs arise

i.e. if 7 day window blocks us from "need now" updates

But i think we have good ideas about how that can work - so it won't leave us in a real bind to get these changes in now.

google-oss-prow · 2026-04-02T19:11:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andyatmiami, ederign

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~.github/workflows/OWNERS~~ [andyatmiami]
~~workspaces/frontend/OWNERS~~ [ederign]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

The backend added a `namespaceFilter` query param to GET /workspacekinds (kubeflow#1009). Without it, the endpoint requires cluster-wide `list workspacekinds` permission (admin-only). With the filter, auth falls back to checking `create workspaces` in the given namespace, allowing regular users access. The frontend was always calling `listWorkspaceKinds()` without the filter, so non-admin users would get 403 when auth is enabled. Changes: - Update swagger.version to include the namespaceFilter swagger changes - Regenerate the API client from the updated swagger spec - Add optional `namespaceFilter` param to the `useWorkspaceKinds` hook - Thread namespace through WorkspaceFormKindSelection and WorkspaceTable - Add unit test coverage for the new parameter - Sync package-lock.json engines field with package.json - `package.json` updated as part of kubeflow#1003 but `npm` was not ran to reflect this in the lock file Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

The backend added a `namespaceFilter` query param to GET /workspacekinds (#1009). Without it, the endpoint requires cluster-wide `list workspacekinds` permission (admin-only). With the filter, auth falls back to checking `create workspaces` in the given namespace, allowing regular users access. The frontend was always calling `listWorkspaceKinds()` without the filter, so non-admin users would get 403 when auth is enabled. Changes: - Update swagger.version to include the namespaceFilter swagger changes - Regenerate the API client from the updated swagger spec - Add optional `namespaceFilter` param to the `useWorkspaceKinds` hook - Thread namespace through WorkspaceFormKindSelection and WorkspaceTable - Add unit test coverage for the new parameter - Sync package-lock.json engines field with package.json - `package.json` updated as part of #1003 but `npm` was not ran to reflect this in the lock file Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

* chore: Infer node version in CI from `packages.json` Signed-off-by: Christian Heusel <christian@heusel.eu> * ci: Enforce a minimum npm release age for increased supply chain security This feature is available the earliest in `npm` with version "v11.10.0" The upstream `actions/setup-node` GHA does not allow to specify a fixed `npm` version, but we need it to be a specific version in an upcoming change, on its own the action itself installs version "10.8.2" right now. To keep the setup maintainable the version is extracted from `packages.json`. Related to actions/setup-node#529 Related to npm/cli#8570 Signed-off-by: Christian Heusel <christian@heusel.eu> * ci: Use `npm ci` instead of `npm install` in CI This way the `packages-lock.json` stays untouched and other sane defaults are set for the CI. Link: https://docs.npmjs.com/cli/v8/commands/npm-ci Signed-off-by: Christian Heusel <christian@heusel.eu> --------- Signed-off-by: Christian Heusel <christian@heusel.eu>

The backend added a `namespaceFilter` query param to GET /workspacekinds (#1009). Without it, the endpoint requires cluster-wide `list workspacekinds` permission (admin-only). With the filter, auth falls back to checking `create workspaces` in the given namespace, allowing regular users access. The frontend was always calling `listWorkspaceKinds()` without the filter, so non-admin users would get 403 when auth is enabled. Changes: - Update swagger.version to include the namespaceFilter swagger changes - Regenerate the API client from the updated swagger spec - Add optional `namespaceFilter` param to the `useWorkspaceKinds` hook - Thread namespace through WorkspaceFormKindSelection and WorkspaceTable - Add unit test coverage for the new parameter - Sync package-lock.json engines field with package.json - `package.json` updated as part of #1003 but `npm` was not ran to reflect this in the lock file Signed-off-by: Andy Stoneberg <astonebe@redhat.com>

github-project-automation Bot added this to Kubeflow Notebooks Apr 1, 2026

github-project-automation Bot moved this to Needs Triage in Kubeflow Notebooks Apr 1, 2026

google-oss-prow Bot added the area/ci area - related to ci label Apr 1, 2026

google-oss-prow Bot requested review from andyatmiami and ederign April 1, 2026 09:23

google-oss-prow Bot added area/frontend area - related to frontend components area/v2 area - version - kubeflow notebooks v2 size/S labels Apr 1, 2026

google-oss-prow Bot added the ok-to-test label Apr 1, 2026

andyatmiami requested changes Apr 2, 2026

View reviewed changes

google-oss-prow Bot assigned andyatmiami Apr 2, 2026

andyatmiami reviewed Apr 2, 2026

View reviewed changes

Comment thread .github/workflows/ws-frontend-test.yml Resolved

ederign suggested changes Apr 2, 2026

View reviewed changes

Comment thread workspaces/frontend/.npmrc Resolved

google-oss-prow Bot assigned ederign Apr 2, 2026

christian-heusel mentioned this pull request Apr 2, 2026

[TASK] Add Dependabot for automated dependency updates #818

Closed

1 of 4 tasks

christian-heusel added 3 commits April 2, 2026 19:50

chore: Infer node version in CI from packages.json

76c38c6

Signed-off-by: Christian Heusel <christian@heusel.eu>

ci: Use npm ci instead of npm install in CI

66d4a90

This way the `packages-lock.json` stays untouched and other sane defaults are set for the CI. Link: https://docs.npmjs.com/cli/v8/commands/npm-ci Signed-off-by: Christian Heusel <christian@heusel.eu>

christian-heusel force-pushed the ci/set-min-age branch from 232736d to 66d4a90 Compare April 2, 2026 17:50

christian-heusel requested a review from ederign April 2, 2026 17:53

google-oss-prow Bot added the lgtm label Apr 2, 2026

ederign approved these changes Apr 2, 2026

View reviewed changes

google-oss-prow Bot added the approved label Apr 2, 2026

google-oss-prow Bot merged commit 8fdffe8 into kubeflow:notebooks-v2 Apr 2, 2026
8 checks passed

github-project-automation Bot moved this from Needs Triage to Done in Kubeflow Notebooks Apr 2, 2026

andyatmiami mentioned this pull request Apr 3, 2026

feat: pass namespaceFilter to GET /workspacekinds from frontend #1010

Merged

christian-heusel mentioned this pull request Apr 4, 2026

feat: setup Dependabot for kubeflow/notebooks #1014

Merged

Conversation

christian-heusel commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christian-heusel commented Apr 1, 2026

Uh oh!

andyatmiami left a comment

Choose a reason for hiding this comment

Uh oh!

andyatmiami Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ederign Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

christian-heusel Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ederign commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thesuperzapper commented Apr 2, 2026

Uh oh!

ederign commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ederign commented Apr 2, 2026

Uh oh!

ederign commented Apr 2, 2026

Uh oh!

ederign commented Apr 2, 2026

Uh oh!

ederign commented Apr 2, 2026

Uh oh!

ederign commented Apr 2, 2026

Uh oh!

andyatmiami commented Apr 2, 2026

Uh oh!

google-oss-prow Bot commented Apr 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

christian-heusel commented Apr 1, 2026 •

edited

Loading

ederign commented Apr 2, 2026 •

edited

Loading

ederign commented Apr 2, 2026 •

edited

Loading