Jason Ginchereau 6e8379ea7a Implement PAX header validation and path safety checks in tar extraction ...

- Added a new test suite for parser-differential bypass detection in tar archives.
- Introduced length-correct PAX extended-header re-parsing to catch discrepancies between node-tar and system tar.
- Enhanced the listAndValidate function to return approved names alongside violations for better extraction control.
- Implemented checks for unsafe characters and glob metacharacters in entry paths.
- Updated the tar extraction logic to utilize an allow-list for approved entries when path validation is in error mode.
- Added utility functions for writing temporary allow-list files for system tar extraction.

2026-06-19 09:17:41 -10:00

..

artifact

Audit fix packages

2026-06-11 17:22:31 -07:00

attest

Merge pull request #2368 from actions/dependabot/npm_and_yarn/packages/attest/brace-expansion-2.0.3

2026-06-08 15:21:00 -07:00

cache

Implement PAX header validation and path safety checks in tar extraction

2026-06-19 09:17:41 -10:00

core

release new versions for a few packages

2026-04-21 17:15:02 +00:00

exec

Bump @actions/io to 3.0.2

2026-01-28 15:59:40 -05:00

github

release new versions for a few packages

2026-04-21 17:15:02 +00:00

glob

Audit fix packages

2026-06-11 17:22:31 -07:00

http-client

release new versions for a few packages

2026-04-21 17:15:02 +00:00

io

@actions/io: update lock file version

2026-01-28 14:36:03 -05:00

tool-cache

Audit tool-cache

2026-05-01 16:36:55 +00:00