mirror of
http://gh.hjkl01.cn/https://github.com/actions/setup-node
synced 2026-07-30 02:13:15 +08:00
e51e5fe84f
* Initial plan * fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist - brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16) - brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2) - brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg) - Regenerated package-lock.json - Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency Closes #1596 * fix: eliminate remaining brace-expansion vulnerabilities and update license cache ## Basic validation CI fix Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages: - `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x) - `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x - `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x from the jest coverage instrumentation path `npm audit --audit-level=high` now reports 0 vulnerabilities. ## Licensed CI fix Update .licenses/npm/ cache to match the new dependency tree: - Add: brace-expansion-5.0.8.dep.yml - Add: minimatch-10.2.6.dep.yml - Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit) - Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit) - Remove stale: minimatch-3.1.5.dep.yml - Remove stale: @actions/glob-0.6.1.dep.yml - Remove stale: concat-map.dep.yml - Remove stale: balanced-match-1.0.2.dep.yml Rebuild dist artifacts to include updated brace-expansion. * fix: replace brace-expansion workarounds with single override --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
65 lines
1.9 KiB
JSON
65 lines
1.9 KiB
JSON
{
|
|
"name": "setup-node",
|
|
"version": "7.0.0",
|
|
"type": "module",
|
|
"private": true,
|
|
"description": "setup node action",
|
|
"main": "lib/setup-node.js",
|
|
"engines": {
|
|
"node": ">=24.0.0"
|
|
},
|
|
"scripts": {
|
|
"build": "ncc build -o dist/setup src/setup-node.ts && ncc build -o dist/cache-save src/cache-save.ts",
|
|
"format": "prettier --no-error-on-unmatched-pattern --write \"**/*.{ts,yml,yaml}\"",
|
|
"format-check": "prettier --no-error-on-unmatched-pattern --check \"**/*.{ts,yml,yaml}\"",
|
|
"lint": "eslint \"**/*.ts\"",
|
|
"lint:fix": "eslint \"**/*.ts\" --fix",
|
|
"test": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --runInBand --coverage",
|
|
"pre-checkin": "npm run format && npm run lint:fix && npm run build && npm test"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/actions/setup-node.git"
|
|
},
|
|
"keywords": [
|
|
"actions",
|
|
"node",
|
|
"setup"
|
|
],
|
|
"author": "GitHub",
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"@actions/cache": "^6.2.0",
|
|
"@actions/core": "^3.0.1",
|
|
"@actions/exec": "^3.0.0",
|
|
"@actions/github": "^9.1.1",
|
|
"@actions/glob": "^0.7.0",
|
|
"@actions/http-client": "^4.0.1",
|
|
"@actions/io": "^3.0.2",
|
|
"@actions/tool-cache": "^4.0.0",
|
|
"semver": "^7.8.5"
|
|
},
|
|
"overrides": {
|
|
"brace-expansion": "5.0.8"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@jest/globals": "^30.4.1",
|
|
"@types/node": "^24.1.0",
|
|
"@types/semver": "^7.7.0",
|
|
"@typescript-eslint/eslint-plugin": "^8.62.0",
|
|
"@typescript-eslint/parser": "^8.62.0",
|
|
"@vercel/ncc": "^0.44.0",
|
|
"eslint": "^10.5.0",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"eslint-plugin-jest": "^29.15.2",
|
|
"eslint-plugin-n": "^18.1.0",
|
|
"globals": "^17.7.0",
|
|
"jest": "^30.4.2",
|
|
"jest-each": "^30.4.1",
|
|
"prettier": "^3.8.4",
|
|
"ts-jest": "^29.4.11",
|
|
"typescript": "^6.0.3"
|
|
}
|
|
}
|