[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
headlamp (source)	minor	0.45.0 → 0.46.0

---

Release Notes

kubernetes-sigs/headlamp (headlamp)

v0.46.0: 0.46.0

Compare Source

Headlamp 0.46.0 introduces alpha support for Kubernetes Dynamic Resource Allocation, making device classes, GPU claims, and claim templates visible in the dashboard. New hierarchical workload views, Job suspend and resume actions, a configurable details drawer, and a guided Endpoints form simplify everyday cluster work, while service port-forwards reconnect automatically after pod restarts. The release also improves OIDC login and logout, strengthens plugin credential isolation and release signing, and expands integration points for desktop products. Accessibility, localization, frontend build tooling, and reliability improvements round out the release across web and desktop.

🌟 Dynamic Resource Allocation (alpha): see how workloads get GPUs and other devices

Headlamp now shows Kubernetes Dynamic Resource Allocation (DRA), the Kubernetes API that workloads use to request GPUs and other devices. A new Devices section appears on clusters that serve resource.k8s.io/v1 (Kubernetes 1.34+). DRA support is in alpha.

Devices section and Device Classes

Browse the device classes your cluster offers, with their CEL selectors, driver settings, and extended resource names, in a Devices section that only appears where DRA is served.

Device Class details

See the CEL selectors a class uses to pick devices, shown exactly as written, along with its extended resource name and driver settings.

Resource Claims

See whether each claim is waiting for a device, allocated, or in use, along with the devices it was granted and the node they are on.

Resource Claim Templates

Templates describe the devices a Pod asks for, and Kubernetes makes a new claim from them for every Pod. See each template's namespace, how many requests it makes, and which device classes it uses.

Implemented across #​7724, #​7820, and #​7971. Thanks to @​Anjali-Chauhan1. Feedback is welcome on #​4831.

✨ Enhancements (part 1)

Adds an OIDC auto-login server flag and Helm setting so users are redirected straight to the identity provider without clicking a login button, fixing post-login redirect bugs along the way.	Thanks to: @​Suyog241005 @​mudit06mah. Thanks to @​menardorama for reporting. #​7071
Adds Suspend and Resume actions for Jobs in the details header and table row menu, so users can toggle spec.suspend without editing YAML or using kubectl.	Thanks to @​PixelRobots. #​7698
Adds a setting to open the details drawer on the right, left, or bottom instead of a hardcoded right side, letting users place the panel where they prefer, with the choice saved locally.	Thanks to @​WasThatRudy. Thanks to @​jasoncologix for reporting. #​7126
Added French translations for 75 missing strings, mostly in the new create forms and address validation messages, so French-speaking users see these forms in their language while Kubernetes API values stay untranslated.	Thanks to @​berlewis. #​7902
The desktop build manifest now accepts a product-owned company name and a separate Linux maintainer contact, mapped to Electron Builder metadata, so branded products can set their own publisher details.	Thanks to @​illume. #​7746
Products can now declare an explicit approvedCommands list separate from plugin-authorized commands, giving product-owned defaults without seeding user settings or auto-approving every shipped plugin command.	Thanks to @​illume. #​7685
Added a guided create form for Endpoints that edits subsets, addresses and ports and validates them like the API server, so users avoid hand-writing YAML and catch errors such as loopback IPs before submitting.	Thanks to @​vyncent-t. #​7666

Adds Suspend and Resume actions for Jobs in the details header and table row menu, so users can toggle spec.suspend without editing YAML or using kubectl.

✨ Enhancements (part 2)

Added CompositePodGroup views for hierarchical gang scheduling, so users can see the nested pod group tree and tell which part of a nested workload failed to schedule.	Thanks to @​Anjali-Chauhan1. #​7542
Browser document titles now include the configured product name, so branded Headlamp builds remain identifiable in tabs and browser history.	Thanks to: @​illume @​sniok. #​7298
Branded Headlamp builds can now set an optional distribution product version that the top-bar menu shows, while the version dialog keeps the Headlamp version and Git commit for clear identification.	Thanks to: @​illume @​joaquimrocha. #​7287
Adds a validated registry for desktop OAuth callback providers that routes startup, second-instance and macOS protocol callbacks to them, while unmatched product URLs keep using the existing deep-link path.	Thanks to: @​illume @​gambtho. #​7281
Exporting stable IDs for the built-in project creation choices lets plugins replace the namespace or YAML option with their own creator, while additional plugin choices stay after the two built-in ones.	Thanks to: @​illume @​gambtho. #​7280
Project overview cards from plugins are now hidden when their component renders nothing, so users no longer see empty cards while populated sections keep the standard three-column layout.	Thanks to: @​illume @​sniok @​ashu8912. #​7279
The desktop app now reads checkForUpdates from the packaged build manifest, falling back to HEADLAMP_CHECK_FOR_UPDATES, so downstream builds can configure update checks at packaging time.	Thanks to: @​illume @​sniok. #​7278
Service-backed port-forwards now reconnect automatically by resolving a new pod through the Endpoints API after a pod restart, so rolling updates no longer leave them stopped and needing a manual restart.	Thanks to @​Slambot01. #​7273
The desktop app now reads its protocol scheme from product metadata and rejects malformed or other-product deep links, so branded builds handle only their own links while headlamp remains the default.	Thanks to: @​illume @​gambtho. #​7252

Added CompositePodGroup views for hierarchical gang scheduling, so users can see the nested pod group tree and tell which part of a nested workload failed to schedule.

Project overview cards from plugins are now hidden when their component renders nothing, so users no longer see empty cards while populated sections keep the standard three-column layout.

✨ Enhancements (part 3)

Headlamp's custom Table now honors enableTopToolbar={false} and enableRowSelection={false}, so hidden toolbars stay hidden and independent checkbox cells keep their native behavior.	Thanks to: @​illume @​sniok. #​7051
Plugins can register custom project namespace grouping through registerProjectGrouping, while default grouping and repeated project IDs stay distinct so namespaces are not wrongly merged.	Thanks to: @​illume @​yolossn. #​6905
LogViewer gains a Copy to Clipboard action, allowing users to copy log output directly without downloading it first.	Thanks to @​Priyanshu-rgbb. #​6813

🐞 Bug fixes (part 1)

Adds RP-initiated OIDC logout for server-owned contexts so signing out ends the provider's SSO session instead of silently signing the same user straight back in.	Thanks to: @​big-appled @​skoeva. Thanks to @​manujayanth for reporting. #​5972
Quiets the kubeconfig watcher when kubeconfig files are missing, so a default in-cluster Headlamp no longer fills its pod log with misleading ERROR lines when nothing is wrong.	Thanks to @​govindup63. Thanks to @​NoamBrodie and @​BigFlagBurito for reporting. #​5731
Checks the latest Helm release revision instead of only deployed ones, so failed or pending releases can be viewed, rolled back, or uninstalled and missing releases correctly return 404.	Thanks to @​NachiketPatil26. Thanks to @​ghost for reporting. #​7859
Service pod lookup for port-forwarding now uses the service resource's own cluster, so the port-forward button no longer goes missing when service details are opened from a project view.	Thanks to @​tejhan. #​7958
EndpointSlices are now matched to Services via the kubernetes.io/service-name label before falling back to ownerReferences, so API-server-created slices like the default kubernetes one link to their Service.	Thanks to @​aashu2006. #​7931
Editing a container port in the create resource form now preserves other ports and the edited port's fields like name and protocol, preventing silent data loss and crashes on partially typed YAML rows.	Thanks to @​HarshPopat23. #​7914
Fixed a crash in the Service details view when an EndpointSlice has null endpoints, so services with no ready backends, such as a Deployment scaled to 0, still display correctly.	Thanks to @​Pradyuman-aviator. #​7909
Service External IP now shows the external name for ExternalName services and <pending> for LoadBalancers without ingress, matching kubectl instead of showing a misleading "-".	Thanks to @​Aarti-panchal01. #​7907
Diagnostics now surface negative-polarity conditions like ReplicaFailure=True, so workloads blocked by a ResourceQuota or admission controller from creating pods show the explanatory failure message.	Thanks to @​HarshPopat23. #​7904
StorageClass now recognizes the beta is-default-class annotation as well as the GA one, so default classes show as default in list and details views, matching kubectl get sc.	Thanks to @​NachiketPatil26. Thanks to @​ghost for reporting. #​7900

EndpointSlices now link to their Services

🐞 Bug fixes (part 2)

The PVC create form now keeps the StorageClass input visible while its text is being edited, so replacing a name no longer hides the field and creates the PVC with the default StorageClass instead.	Thanks to @​9p-tech. #​7897
Replica count helpers now tolerate workloads with no status, such as JobSets waiting on a Kueue MultiKueue manager cluster, preventing the Workloads overview from crashing.	Thanks to @​glassharbor. #​7893
Custom resource date printer columns are now formatted only when the field has a value, so unset dates show an empty cell instead of "Invalid Date".	Thanks to @​Aarti-panchal01. #​7892
The log viewer search now subscribes to result changes before running findNext, so the match count updates correctly while typing instead of showing "Too many matches" or a stale count.	Thanks to @​9p-tech. #​7889
Docker extension releases now build, publish and sign the image without pushing a version bump to main, which Prow rejects, so the extension can update beyond 0.35.0 again.	Thanks to @​govindup63. Thanks to @​skoeva for reporting. #​7877
The desktop app's deep-link handler now adds a missing slash after the # in the URL, so returns from flows like OAuth route to the correct page.	Thanks to @​sapnilbiswas. #​7872
The Home Warnings column now merges results from every allowed namespace per cluster instead of keeping only the last, so warning counts are correct with multiple namespaces.	Thanks to @​9p-tech. #​7866
Renaming a cluster back to its original name now works and clears the saved custom name, instead of failing with a 'custom name already in use' error.	Thanks to @​h55n. Thanks to @​9p-tech for reporting. #​7843
Backend start scripts now run through cross-env, so npm start works on Windows where cmd.exe can't parse POSIX-style variable prefixes and the backend previously never started.	Thanks to @​carterpewpew. Thanks to @​Adi-204 for reporting. #​7839
Request tracing and metrics middleware are now attached to the router that actually serves requests, restoring HTTP spans with -tracing-enabled while keeping streaming responses working.	Thanks to @​dlanov. Thanks to @​silvioincalza for reporting. #​7762

🐞 Bug fixes (part 3)

Node Details now shows all capacity and allocatable resources instead of a hardcoded key list, so extended resources such as GPUs and hugepages are visible to users.	Thanks to @​Anushka-2905. Thanks to @​jayaprajapatii for reporting. #​7603
The Release Notes dialog now keeps GitHub's zero-height table header images and their sizing instead of stripping them, so release note tables and images render readably.	Thanks to @​NachiketPatil26. Thanks to @​sniok for reporting. #​7573
Settings now reads the app's live theme through useTheme() instead of importing a test-only fixture, so production code no longer depends on TestHelpers and follows the real theme.	Thanks to @​Priyanshu-rgbb. #​7493
Safe requests are now retried after client-go refreshes an exec credential following a transient 401, so users no longer see the token login dialog when the next request would succeed.	Thanks to @​nungster. #​7483
The macOS tray icon now uses 16×16 and 32×32 template images in place of the 22×22 and 44×44 ones, so it matches the size of neighboring menu-bar icons instead of looking oversized.	Thanks to @​nova9. #​7476
CronJob Spawn Job now binds the request to the CronJob's own cluster, so the Job is no longer created on the wrong cluster when the URL cluster differs after the grace period.	Thanks to: @​YousufFFFF @​yolossn. #​7304
Desktop runCommand IPC listeners are now released when commands exit or are rejected, preventing leaked subscriptions and making plugin manager command cleanup consistent.	Thanks to: @​illume @​tejhan. #​7277
Lowercase k is now parsed as kilo in byte quantities, so Kubernetes values like 500k read as 500000 bytes instead of being silently under-reported by 1000x.	Thanks to: @​omlahore @​skoeva. #​7073
Query retries now stop immediately for permanent HTTP errors below 500 while still retrying temporary ones like 408 and 429, avoiding pointless repeat requests that cannot succeed.	Thanks to: @​illume @​sniok. #​6907

Release notes render tables and images correctly

🐞 Bug fixes (part 4)

Electron Zoom In, Zoom Out, and Reset menu actions are restored after plugin menu serialization strips callbacks, so users can zoom the app again from the menu.	Thanks to: @​illume @​skoeva. #​6891
Byte-quantity parsing now handles micro (u) and nano (n) suffixes, so fractional values no longer fall through as raw bytes and skew memory usage percentages by about 1000x.	Thanks to @​Pratikdeb07. #​6817
MCP clients no longer restart when only secondary selected clusters are reordered, avoiding unnecessary disruption while keeping the current cluster first and backend context order deterministic.	Thanks to @​rootp1. #​6536

🔒 Security

Added grouped weekly Dependabot updates for Go modules, GitHub Actions and Docker base images, so dependencies and pinned actions stay current without manual work or one PR per backend module.	Thanks to @​skoeva. #​7864
Release signing now works for checksums, container images and release tags, dropping the broken GPG signature, so users can verify releases and tags are signed consistently.	Thanks to @​skoeva. #​7858
Added a provider-neutral cluster registration framework to the desktop app, allowing authorized product plugins to retrieve cluster credentials and safely register clusters in the user's kubeconfig.	Thanks to @​illume. #​7744
Service proxy requests with a relative URI now keep the configured URIPrefix base path and block encoded traversal, so requests like /status resolve under /api/v1/proxy instead of the host root.	Thanks to @​zanarellidev. #​7594
Desktop plugins can now use Electron safeStorage through a frozen pluginSecureStorage API with per-plugin namespaces and token-based access, so each plugin's encrypted values stay isolated from others.	Thanks to: @​illume @​gambtho. #​7253
MCP desktop debug logging is now off by default and redacts values when HEADLAMP_MCP_DEBUG=true, so arguments and cluster metadata no longer leak into logs.	Thanks to @​rootp1. #​6529
Desktop MCP child processes now get only the SDK's default platform environment plus explicitly configured server env values, so the full Headlamp process environment is no longer inherited.	Thanks to @​rootp1. #​6521

♿ Accessibility

Adds alt+shift+p and alt+shift+d hotkeys for Pods and Deployments that keep the selected namespace filter, so users no longer have to re-select it after keyboard navigation.	Thanks to @​aditya-c7. Thanks to @​Rucha0901 for reporting. #​7851
Removes a stale RestartMultipleButton entry from the accessibility baseline, so CI strictly enforces the already-fixed aria-required-parent rule and catches regressions.	Thanks to @​Bhargava-Ram-Thunga. Thanks to @​illume for reporting. #​7395
Cluster Overview pod and node status pie charts now link to filtered list views, so users can jump straight to unready pods, cordoned nodes, or unready nodes when troubleshooting.	Thanks to @​Suyog241005. Thanks to @​kriswuollett for reporting. #​6748
Removed the resolved scrollable-region-focusable entry from the Storybook accessibility baseline for ClusterChooserPopup, keeping the baseline accurate now that the list is keyboard-focusable and axe-core no longer flags it.	Thanks to @​ubermensch177. Thanks to @​illume for reporting. #​7898
DropZoneBox now uses a theme-aware border instead of hardcoded pure black, so the drop area outline stays visible in dark mode.	Thanks to @​Priyanshu-rgbb. #​7551
The editor dialog now asks for confirmation before discarding unsaved changes via Close, X, Escape or backdrop, preventing accidental loss of edits while pristine editors still close immediately.	Thanks to @​Adi-204. #​7443
VersionDialog now falls back to 'Headlamp' when the product name is unset and stale axe baseline entries are removed, so the dialog always has an accessible name and title.	Thanks to @​Bhargava-Ram-Thunga. Thanks to @​illume for reporting. #​7425
Project Details can now grow past the viewport, the resources grid keeps a 300 px minimum height and the category list is capped and scrollable, keeping content usable at high zoom.	Thanks to: @​illume @​gambtho. #​7293
ShowHideLabel's expand/collapse button now sits outside the label element and carries the aria-expanded and aria-controls attributes, fixing an accessibility issue for assistive technology users.	Thanks to @​Alok-work23. Thanks to @​illume for reporting. #​7267
Stale label-title-only entries were removed from the accessibility baseline for the Settings stories, so the baseline reflects the fixed Debug Image field and no longer lists resolved violations.	Thanks to @​Bhargava-Ram-Thunga. Thanks to @​illume for reporting. #​7224
Resource-map labels now reflow instead of using fixed sizing, preventing content from being clipped at 200% text zoom.	Thanks to: @​illume @​gambtho. #​6910
Kubeconfig load dialog errors now use the themed MUI Alert component instead of a hardcoded red box, so they follow the active theme and include an error icon rather than relying on color alone.	Thanks to @​Satyam087. #​7751

Visible file upload borders in dark mode

Confirmation before discarding unsaved edits

Themed kubeconfig error alerts

⚡ Performance and Build Speed

Table filters now reuse stable row models and cache dropdown options on demand, avoiding repeated work while restoring Status and Namespace filters on large clusters with their memory safeguards intact.	Thanks to @​srebb. #​7486
Makes Rsbuild the default frontend builder while keeping Vite scripts available, addressing build crashes on low-memory CI and slow or broken dev mode on Windows.	Thanks to @​illume. Thanks to @​vyncent-t for reporting. #​7712
Packaging no longer runs an intermediate unpacked Electron Builder pass and adds a prepared-assets path, so repeated package preparation is avoided and builds with prebuilt assets skip redundant work.	Thanks to @​illume. #​7727
The Build App workflow now caches npm and Go dependencies and cancels superseded runs on new pushes, making one of the slowest PR checks faster and avoiding wasted builds.	Thanks to @​skoeva. #​6210
Removed the dead base-branch coverage step from the backend-test workflow, so PRs run the test suite once instead of twice and save roughly 40-50 seconds.	Thanks to @​skoeva. #​6190

📖 Documentation

The identity-aware proxy guide now includes a Pomerium example with Ingress Controller setup and Headlamp Helm values, helping users configure it and understand the shared service account for API access.	Thanks to @​desimone. #​7227

💻 Development (part 1)

Wraps the SettingsCluster loading text in the translation function, so the loading indicator appears in the user's chosen language like other loaders.	Thanks to @​Priyanshu-rgbb. #​7553
Bundled Plugin Catalog updated from 0.4.4 to 0.4.5 with its new archive SHA-256 checksum pinned, so builds ship the latest catalog release with a verified archive.	Thanks to @​illume. #​7979
Added the missing Portuguese translation key for the table filter message, so the frontend i18n check passes again on main.	Thanks to @​Aarti-panchal01. #​7953
Terminal storybook snapshots now normalize xterm's counter-based ids in injected style tags, making the storyshots independent of how many xterm instances were created earlier in the test run.	Thanks to @​Priyanshu-rgbb. #​7908
Added unit tests for the BackLink component covering its label, styling and back navigation, so regressions in this shared navigation element are caught early.	Thanks to @​sapnilbiswas. #​7895
Added unit tests for the SectionBox layout component covering its content and title rendering, so regressions in this widely used common component are caught early.	Thanks to @​sapnilbiswas. #​7884
Added unit tests for the EmptyContent component covering string and ReactNode children and color forwarding, helping catch regressions in how it renders.	Thanks to @​sapnilbiswas. #​7868
Packaging now reports start times and elapsed durations for backend, app assembly, post-pack and artifact build phases, making it easier for developers to see where build time goes.	Thanks to @​illume. #​7731

💻 Development (part 2)

The product manifest's display name is now applied to the Electron runtime before storage modules load, so branded development builds use their own default profile directory instead of sharing Headlamp's.	Thanks to @​illume. #​7615
Adds empty batch/v1 Job and CronJob list responses to the frontend and plugin-template Storybook mocks, so workload list stories no longer depend on unhandled Kubernetes API requests.	Thanks to: @​illume @​skoeva. #​7473
Expands Storybook apps/v1 workload mocks to cover namespaced and cluster-prefixed requests, with end-to-end regressions for all four apps workload list pages so these stories render reliably.	Thanks to: @​illume @​skoeva. #​7438
Desktop command execution now reports distinct exit codes (-1, -2, -3) for invalid data, rejected permission secrets and denied consent, letting renderer callers tell these rejections apart.	Thanks to: @​illume @​tejhan. #​7294
Added regression tests for ActivitiesRenderer's route-change policy, so ordinary split-right activities stay visible while blocking activities and details drawers are minimized as intended.	Thanks to @​illume. #​6323

💻 Development (part 3)

| <img src="https://raw.githubusercontent.com/kubernetes-sigs/headlamp/main/docs/images/icon.png" width="

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.25%. Comparing base (7afc217) to head (4e64e4b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main       #5   +/-   ##
=======================================
  Coverage   70.25%   70.25%           
=======================================
  Files          16       16           
  Lines        1180     1180           
=======================================
  Hits          829      829           
  Misses        350      350           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.