2 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
3 people	e51e5fe84f	fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) (#1599) ... * Initial plan * fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist - brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16) - brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2) - brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg) - Regenerated package-lock.json - Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency Closes #1596 * fix: eliminate remaining brace-expansion vulnerabilities and update license cache ## Basic validation CI fix Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages: - `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the root @actions/[email protected] ([email protected] → [email protected]) instead of its bundled @actions/[email protected] ([email protected] → [email protected]) - `"glob": {"minimatch": "^10.2.5"}` - forces [email protected] to use [email protected] → [email protected] instead of [email protected] → [email protected] - `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that natively uses [email protected] (instead of @3.x), removing [email protected] from the jest coverage instrumentation path `npm audit --audit-level=high` now reports 0 vulnerabilities. ## Licensed CI fix Update .licenses/npm/ cache to match the new dependency tree: - Add: brace-expansion-5.0.8.dep.yml - Add: minimatch-10.2.6.dep.yml - Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit) - Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit) - Remove stale: minimatch-3.1.5.dep.yml - Remove stale: @actions/glob-0.6.1.dep.yml - Remove stale: concat-map.dep.yml - Remove stale: balanced-match-1.0.2.dep.yml Rebuild dist artifacts to include updated brace-expansion. * fix: replace brace-expansion workarounds with single override --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]>	2026-07-29 13:03:59 -05:00
4 people	ab72c7e7eb	Upgrade @actions dependencies (#1525) ... * chore: upgrade @actions dependencies and update licenses - @actions/core: ^1.11.1 → ^2.0.3 - @actions/cache: ^5.0.1 → ^5.0.5 - @actions/glob: ^0.5.0 → ^0.5.1 - @actions/http-client: ^2.2.1 → ^3.0.2 - @actions/tool-cache: ^2.0.2 → ^3.0.1 - @actions/io: ^1.0.2 → ^2.0.0 - Run npm audit fix - Update license files for new versions - Rebuild dist files Agent-Logs-Url: https://github.com/actions/setup-node/sessions/872a3dbf-9b85-446b-963b-9127718d9560 Co-authored-by: gowridurgad <[email protected]> * fix: update license files to fix Licensed CI failures Update 5 license records that were out of date after the dependency upgrade: - brace-expansion: 1.1.12 → 1.1.13 - fast-xml-builder: 1.0.0 → 1.1.4 - fast-xml-parser: 5.4.1 → 5.5.11 - strnum: 2.1.2 → 2.2.3 - path-expression-matcher: add new record (version 1.4.0, new transitive dep) Rebuild dist/ files to reflect updated lock file Agent-Logs-Url: https://github.com/actions/setup-node/sessions/fb0e70ce-ad19-48df-88a4-97f3bdc896cb Co-authored-by: gowridurgad <[email protected]> * feat: upgrade @actions/exec to ^2.0.0 and fix license records - Upgrade @actions/exec from ^1.1.1 to ^2.0.0 in package.json - Update package-lock.json via npm install - Run `licensed cache` to regenerate license records: - Remove exec-1.1.1.dep.yml and exec-2.0.0.dep.yml (replaced by exec.dep.yml) - Remove io-1.1.3.dep.yml and io-2.0.0.dep.yml (replaced by io.dep.yml) - Create exec.dep.yml (v2.0.0) - single version now in tree - Create io.dep.yml (v2.0.0) - @actions/[email protected]'s nested [email protected] removed - Rebuild dist/ files Agent-Logs-Url: https://github.com/actions/setup-node/sessions/24a1a530-6840-4445-8262-8342ec739e6d Co-authored-by: gowridurgad <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: gowridurgad <[email protected]>	2026-04-16 12:06:31 -05:00