pulp · ggainey · Sep 14, 2026 · Sep 13, 2026 · Sep 13, 2026 · Sep 13, 2026
diff --git a/.npmrc b/.npmrc
@@ -1 +1,24 @@
-legacy-peer-deps=true
+# Pins to exact registry
+registry=https://registry.npmjs.org/
+
+# Package Minimum Age Adoption
+min-release-age=3
+min-release-age-exclude=[]
+
+# Package Installation Script
+strict-allow-scripts=true
+
+# Enforces required Node.js versions
+engine-strict=true
+
+# Pins exact dependency version
+save-exact=true
+
+# Enable integrity verification
+package-lock=true
+
+# Other options
+legacy-peer-deps=true
+audit=true
+fund=false
+strict-ssl=true
diff --git a/README.md b/README.md
@@ -1,15 +1,48 @@
-# pulp-ui
+<p align="center">
+  <img src="https://raw.githubusercontent.com/pulp/pulp-ui/main/static/images/pulp_logo.png" alt="Pulp logo" width="150">
+</p>
 
-A community driven UI for [Pulp](https://pulpproject.org/).
+# PulpUI
 
-## How to run
+[![License: Apache 2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](https://raw.githubusercontent.com/pulp/pulp-ui/main/LICENSE)
+[![Node](https://img.shields.io/badge/node-%3E%3D22.32.2-brightgreen)](https://raw.githubusercontent.com/pulp/pulp-ui/main/package.json)
 
-### backend
+PulpUI is a community driven single-page application that talks to a running [pulpcore](https://github.com/pulp/pulpcore) instance over its REST API, giving that content - across whichever plugins your Pulp deployment has installed - a shared, consistent web UI instead of requiring the CLI or raw API calls.
 
-You can follow the [pulp-oci-images quickstart](https://pulpproject.org/pulp-oci-images/docs/admin/tutorials/quickstart/),
-TLDR:
+## Contents
 
-#### setup:
+- [Features](#features)
+- [Requirements](#requirements)
+- [Quick start](#quick-start)
+- [Configuration](#configuration)
+- [Contributing & Help](#contributing--help)
+- [License](#license)
+
+## Features
+### Core
+- Task Management
+- User / Group / Role management
+- Content Signing Keys
+- Cross-plugin search
+
+### Plugins
+- Ansible (repositories, remotes, collections, namespaces, approvals, imports)
+- File (repositories, remotes)
+- RPM (content)
+- Container (execution environments, tags, manifests)
+
+## Requirements
+- Node.js >= 22.32.2
+- npm >= 10
+- Python 3 + pip
+
+## Quick start
+
+### 1. Run a Pulp backend
+
+Follow the [pulp-oci-images quickstart](https://pulpproject.org/pulp-oci-images/docs/admin/tutorials/quickstart/)
+
+#### Setup
 
 ```sh
 mkdir -p ~/pulp-backend-oci/{settings/certs,pulp_storage,pgsql,containers}
@@ -20,8 +53,7 @@ ANSIBLE_API_HOSTNAME='http://$(hostname):8080'
 ANSIBLE_CONTENT_HOSTNAME='http://$(hostname):8080/pulp/content'
 " >> settings/settings.py
 ```
-
-#### run:
+#### Run
 
 ```sh
 cd ~/pulp-backend-oci/
@@ -33,26 +65,15 @@ podman run --publish 8080:80 \
            --volume "$(pwd)/containers":/var/lib/containers \
            docker.io/pulp/pulp
 ```
-
-#### check:
-
+#### Check
 ```sh
 curl localhost:8080/pulp/api/v3/status/ | jq
 ```
-
-or open http://localhost:8080/pulp/api/v3/status/
-
-#### change password:
-
+#### Change the admin password
 ```sh
 podman exec -it pulp pulpcore-manager reset-admin-password --password admin
 ```
-```sh
-docker exec -it compose-pulp_api-1 pulpcore-manager reset-admin-password --password admin
-```
-
-#### configure `pulp-cli`:
-
+#### Configure `pulp-cli` (optional)
 ```sh
 pip install pulp-cli[pygments]
 pulp config create --username admin --base-url http://localhost:8080 --password admin
@@ -61,28 +82,38 @@ pulp --help
 pulp user list
 ```
 
-### frontend
+---
 
-You can clone the frontend from https://github.com/pulp/pulp-ui .
+### 2. Run the frontend
 
+#### Clone and install
 ```sh
+git clone https://github.com/pulp/pulp-ui
+cd pulp-ui
 npm install
-npm run start
 ```
 
-and open http://localhost:8002/ :tada: :)
+#### Start
+```sh
+npm run start
+```
 
-If your API listens elsewhere, you can use `API_PROXY=http://elsewhere:12345 npm run start` instead. Do note that the server at `elsewhere` has to be configured to allow CORS requests for `localhost` (where UI actually listens); using something like `changeOrigin` is out of scope for pulp-ui, and breaks pulp API URLs (because the domains are based on the Origin header). Do NOT use webpack proxy in production.
+Open http://localhost:8002/.
 
+If your API listens elsewhere, you can use `API_PROXY=http://elsewhere:12345 npm run start`. The server at `elsewhere` must allow CORS requests from `localhost`; using `changeOrigin` is out of scope for pulp-ui, and breaks pulp API URLs. **Do NOT use the webpack proxy in production.**
 
-## Misc
+## Configuration
+A production build (`npm run build`) can be further configured by serving a `/pulp-ui-config.json` alongside the built UI, mapped at `/`. 
 
-### post-build configuration
+| Key                     | Default         | Purpose                                                                                 |
+|-------------------------|-----------------|-----------------------------------------------------------------------------------------|
+| `API_BASE_PATH`         | `/pulp/api/v3/` | Change when using domains or a different path                                           |
+| `UI_BASE_PATH`          | `/ui/`          | Change when only serving index in a subdirectory, or want different browser path prefix |
+| `UI_EXTERNAL_LOGIN_URI` | `null`          | Set to something like `/login/` when using SSO                                          |
+| `EXTRA_VERSION`         | `""`            | An extra version string to display in about modal                                       |
 
-The UI builds produced by `npm run build` can be further configured by serving a `/pulp-ui-config.json` alongside the built UI.
-(Note it has to be mapped at `/`, not just wherever `index.html` is served from.)
+## Contributing & Help
+See the [Pulp developer guide](https://pulpproject.org/dev/) to contribute, or reach the community on [Discourse](https://discourse.pulpproject.org) / Matrix ([#pulp](https://matrix.to/#/#pulp:matrix.org), [#pulp-dev](https://matrix.to/#/#pulp-dev:matrix.org))
 
-* `API_BASE_PATH` - defaults to `/pulp/api/v3/` - change when using domains or a different path
-* `UI_BASE_PATH` - defaults to `/ui/` - change when only serving index in a subdirectory, or want different browser path prefix
-* `UI_EXTERNAL_LOGIN_URI` - defaults to nothing - set to something like `/login/` when using an SSO
-* `EXTRA_VERSION` - an extra version string to display in about modal
+## License
+[Apache-2.0](https://raw.githubusercontent.com/pulp/pulp-ui/main/LICENSE)
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,88 @@
+# Pulp Security Policy
+
+## Goal
+
+This document defines the official Security Policy for The Pulp Project.
+
+## Commitment
+
+This project is stewarded by **Red Hat, Inc.**, an open-source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)].
+
+Red Hat takes security seriously.
+Red Hat is committed to maintaining the highest level of security and trust for all users.
+Red Hat appreciates the Pulp community and security researchers' efforts in helping identify and address vulnerabilities responsibly.
+
+Contact: [cra-steward@redhat.com]
+
+## Scope
+
+- Pulp Core (pulpcore)
+- All maintained plugins under [the Pulp GitHub organization]
+  - Includes plugins maintained by the core Red Hat team and community maintainers
+- All contributors, maintainers, committers, and security researchers interacting with these projects
+
+Third-party collections or plugins hosted outside the Pulp organization are out of scope but are encouraged to adopt compatible practices.
+
+## Secure Development Practices
+
+We follow established industry best practices for secure development including, but not limited to:
+
+- Secured version control of source code with push restrictions
+- Automated testing of security relevant features (e.g. authentication)
+- Mandatory peer reviews and CI checks for integrating code into release branches
+- Automated distribution of CI updates via [plugin-template]
+- Semi-automatic updates of third-party dependencies via [Dependabot]
+- Automated secret leak detection via [GitLeaks]
+
+## Reporting a vulnerability
+
+All reports MUST be submitted by email to: [pulp-security@redhat.com]
+
+Security vulnerabilities MUST NOT be reported through any public or insecure method, including but not limited to
+Public GitHub issues, Pull Requests, Pulp Discourse, Pulp Matrix, Public forums or social media.
+
+Please refer to the [Vulnerability Management Policy] for full details on how to report a vulnerability.
+
+## Incident response
+
+A security incident is any event indicating that Pulp project infrastructure, build systems, distribution channels, or governance accounts have been compromised or are under active attack.
+This is distinct from a vulnerability report (a flaw in code) and requires operational response.
+
+The response steps are:
+
+1. **Contain:** Isolate affected systems, revoke compromised credentials, and halt affected release pipelines
+1. **Assess:** Determine the scope, impact, and root cause of the incident
+1. **Remediate:** Apply fixes, rotate credentials, rebuild affected artifacts from verified sources
+1. **Communicate:** Notify affected parties. For incidents affecting released artifacts, issue a public advisory
+1. **Post-mortem:** Conduct a blameless post-incident review. Document lessons learned and update this policy if warranted
+
+## Security Policy Hierarchy
+
+The `SECURITY.md` file is the standard location where users, developers, and security researchers can find information on how to report a potential vulnerability for a particular repository.
+Having this file ensures high visibility and automatic integration with GitHub's security features.
+
+Each project SHOULD host a `SECURITY.md` file in the root directory of their GitHub repository.
+The `SECURITY.md` file MAY be a copy of this policy.
+If the file exists and is not an exact copy, it MUST point to this document as an authoritative policy.
+
+## Policy governance
+
+This policy may be updated periodically.
+Suggestions for improvement can be submitted through issues or pull requests to the [pulp/governance] repository.
+
+## Notes
+
+The key words "MUST", "MUST NOT", and "SHOULD" in this document are to be interpreted as described in [RFC 2119].
+
+<!-- links -->
+
+[the pulp github organization]: https://github.com/pulp/
+[vulnerability management policy]: docs/vulnerability-management-policy.md
+[eu cyber resilience act (regulation 2024/2847)]: https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng
+[cra-steward@redhat.com]: mailto:cra-steward@redhat.com
+[pulp-security@redhat.com]: mailto:pulp-security@redhat.com
+[pulp/governance]: https://github.com/pulp/governance
+[rfc 2119]: https://www.rfc-editor.org/rfc/rfc2119.html
+[gitleaks]: https://github.com/gitleaks/gitleaks
+[dependabot]: https://github.com/dependabot
+[plugin-template]: https://github.com/pulp/plugin_template/
diff --git a/config/shared.config.js b/config/shared.config.js
@@ -54,7 +54,7 @@ module.exports = (inputConfigs) => {
 
   return {
     devtool: 'source-map',
-
+    experiments: { typescript: false },
     ...(isBuild
       ? {}
       : {