Copilot
e51e5fe84f
fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) ( #1599 )
...
* Initial plan
* fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist
- brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16)
- brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2)
- brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg)
- Regenerated package-lock.json
- Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency
Closes #1596
* fix: eliminate remaining brace-expansion vulnerabilities and update license cache
## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
from the jest coverage instrumentation path
`npm audit --audit-level=high` now reports 0 vulnerabilities.
## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml
Rebuild dist artifacts to include updated brace-expansion.
* fix: replace brace-expansion workarounds with single override
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
2026-07-29 13:03:59 -05:00
gowridurgad
8207627860
Migrate to ESM and upgrade dependencies ( #1574 )
...
* Migrate to ESM
* updated package.json version
* Update README for v6 and clean up dev dependencies
* Remove unused ts-node
* fix audit issue
---------
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
2026-07-13 21:38:27 -05:00
Copilot
ab72c7e7eb
Upgrade @actions dependencies ( #1525 )
...
* chore: upgrade @actions dependencies and update licenses
- @actions/core: ^1.11.1 → ^2.0.3
- @actions/cache: ^5.0.1 → ^5.0.5
- @actions/glob: ^0.5.0 → ^0.5.1
- @actions/http-client: ^2.2.1 → ^3.0.2
- @actions/tool-cache: ^2.0.2 → ^3.0.1
- @actions/io: ^1.0.2 → ^2.0.0
- Run npm audit fix
- Update license files for new versions
- Rebuild dist files
Agent-Logs-Url: https://github.com/actions/setup-node/sessions/872a3dbf-9b85-446b-963b-9127718d9560
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
* fix: update license files to fix Licensed CI failures
Update 5 license records that were out of date after the dependency
upgrade:
- brace-expansion: 1.1.12 → 1.1.13
- fast-xml-builder: 1.0.0 → 1.1.4
- fast-xml-parser: 5.4.1 → 5.5.11
- strnum: 2.1.2 → 2.2.3
- path-expression-matcher: add new record (version 1.4.0, new transitive dep)
Rebuild dist/ files to reflect updated lock file
Agent-Logs-Url: https://github.com/actions/setup-node/sessions/fb0e70ce-ad19-48df-88a4-97f3bdc896cb
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
* feat: upgrade @actions/exec to ^2.0.0 and fix license records
- Upgrade @actions/exec from ^1.1.1 to ^2.0.0 in package.json
- Update package-lock.json via npm install
- Run `licensed cache` to regenerate license records:
- Remove exec-1.1.1.dep.yml and exec-2.0.0.dep.yml (replaced by exec.dep.yml)
- Remove io-1.1.3.dep.yml and io-2.0.0.dep.yml (replaced by io.dep.yml)
- Create exec.dep.yml (v2.0.0) - single version now in tree
- Create io.dep.yml (v2.0.0) - @actions/exec@1.1.1's nested io@1.1.3 removed
- Rebuild dist/ files
Agent-Logs-Url: https://github.com/actions/setup-node/sessions/24a1a530-6840-4445-8262-8342ec739e6d
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
2026-04-16 12:06:31 -05:00
gowridurgad
5e2628c959
Bumps form-data ( #1332 )
...
Co-authored-by: “gowridurgad” <“hgowridurgad@github.com>
2025-07-31 15:39:40 -05:00
Maxim Lobanov
282049a5b1
regenerate license ( #7 )
...
* regenerate license
* npm run build
* sync branches
* rebuild project
* fix test
Co-authored-by: Dmitry Shibanov <dmitry-shibanov@github.com>
2021-06-29 13:34:35 +03:00
