Skip to content

fix: fixed vulnerabilities #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
amanstep wants to merge 2 commits into
base: main
Choose a base branch
from
+78,473 −60,043
Open

fix: fixed vulnerabilities #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
06eecd6
fix: fixed vulnerabilities
amanstep Feb 16, 2026
97b0a79
fix: ignored undici vulnerability via osv-scanner.toml and dependency…
amanstep Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,5 @@ jobs:
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- name: 'Dependency Review'
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
with:
allow-ghsas: GHSA-g9mf-h72j-4rw9
127,004 changes: 72,780 additions & 54,224 deletions dist/index.js
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion dist/index.js.map
View file
Open in desktop

Large diffs are not rendered by default.

358 changes: 89 additions & 269 deletions dist/licenses.txt
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 0 additions & 1 deletion jest.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@ module.exports = {
moduleFileExtensions: ['js', 'ts'],
testEnvironment: 'node',
testMatch: ['**/*.test.ts'],
testRunner: 'jest-circus/runner',
transform: {
'^.+\\.ts$': 'ts-jest'
},
Expand Down
3 changes: 3 additions & 0 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
[[IgnoredVulns]]
id = "GHSA-g9mf-h72j-4rw9"
reason = "undici is a transitive dependency of @actions/github v6; and interacts with trusted servers. Resource exhaustion attack is very less likely in this context."
Copy link

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Grammatical error: "very less likely" should be "much less likely" or "very unlikely".

Suggested change
reason = "undici is a transitive dependency of @actions/github v6; and interacts with trusted servers. Resource exhaustion attack is very less likely in this context."
reason = "undici is a transitive dependency of @actions/github v6; and interacts with trusted servers. Resource exhaustion attack is very unlikely in this context."

Copilot uses AI. Check for mistakes.
11,090 changes: 5,568 additions & 5,522 deletions package-lock.json
View file
Open in desktop

Large diffs are not rendered by default.

11 changes: 5 additions & 6 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,24 +25,23 @@
"license": "MIT",
"dependencies": {
"@actions/core": "^1.10.0",
"@actions/github": "^4.0.0",
"@actions/github": "^6.0.1",
"@semantic-release/commit-analyzer": "^8.0.1",
"@semantic-release/release-notes-generator": "^9.0.1",
"axios": "^1.13.5",
"conventional-changelog-conventionalcommits": "^4.6.1",
"semver": "^7.3.5"
},
"devDependencies": {
"@types/jest": "^27.0.2",
"@types/jest": "^29.5.14",
"@types/js-yaml": "^4.0.4",
"@types/node": "^20.11.16",
"@types/semver": "^7.3.9",
"@vercel/ncc": "^0.38.4",
"jest": "^27.3.1",
"jest-circus": "^27.3.1",
"jest": "^29.7.0",
"js-yaml": "^4.1.0",
"prettier": "2.4.1",
"ts-jest": "^27.0.7",
"typescript": "^4.4.4"
"ts-jest": "^29.4.6",
"typescript": "~4.9"
Copy link

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TypeScript version constraint changed from caret (^4.4.4) to tilde (~4.9). The tilde constraint is more restrictive and only allows patch-level updates (4.9.x), while the previous caret constraint allowed minor version updates (4.x.x). This means you won't automatically receive TypeScript 4.10+ patches. Consider using ^4.9 instead if you want to receive future patch and minor updates within the v4 major version, or document why the tilde constraint is preferred.

Suggested change
"typescript": "~4.9"
"typescript": "^4.9"

Copilot uses AI. Check for mistakes.
}
}
10 changes: 5 additions & 5 deletions src/github.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ export async function listTags(
): Promise<Tag[]> {
const octokit = getOctokitSingleton();

const tags = await octokit.repos.listTags({
const tags = await octokit.rest.repos.listTags({
...context.repo,
per_page: 100,
page,
Expand All @@ -56,7 +56,7 @@ export async function compareCommits(baseRef: string, headRef: string) {
const octokit = getOctokitSingleton();
core.debug(`Comparing commits (${baseRef}...${headRef})`);

const commits = await octokit.repos.compareCommits({
const commits = await octokit.rest.repos.compareCommits({
...context.repo,
base: baseRef,
head: headRef,
Expand All @@ -72,11 +72,11 @@ export async function createTag(
) {
const octokit = getOctokitSingleton();
let annotatedTag:
| Await<ReturnType<typeof octokit.git.createTag>>
| Await<ReturnType<typeof octokit.rest.git.createTag>>
| undefined = undefined;
if (createAnnotatedTag) {
core.debug(`Creating annotated tag.`);
annotatedTag = await octokit.git.createTag({
annotatedTag = await octokit.rest.git.createTag({
...context.repo,
tag: newTag,
message: newTag,
Expand All @@ -86,7 +86,7 @@ export async function createTag(
}

core.debug(`Pushing new tag to the repo.`);
await octokit.git.createRef({
await octokit.rest.git.createRef({
...context.repo,
ref: `refs/tags/${newTag}`,
sha: annotatedTag ? annotatedTag.data.sha : GITHUB_SHA,
Expand Down
32 changes: 18 additions & 14 deletions tests/github.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,22 +5,26 @@ jest.mock(
jest.fn().mockImplementation(() => ({
context: { repo: { owner: 'mock-owner', repo: 'mock-repo' } },
getOctokit: jest.fn().mockReturnValue({
repos: {
listTags: jest.fn().mockImplementation(({ page }: { page: number }) => {
if (page === 6) {
return { data: [] };
}
rest: {
repos: {
listTags: jest
.fn()
.mockImplementation(({ page }: { page: number }) => {
if (page === 6) {
return { data: [] };
}

const res = [...new Array(100).keys()].map((_) => ({
name: `v0.0.${_ + (page - 1) * 100}`,
commit: { sha: 'string', url: 'string' },
zipball_url: 'string',
tarball_url: 'string',
node_id: 'string',
}));
const res = [...new Array(100).keys()].map((_) => ({
name: `v0.0.${_ + (page - 1) * 100}`,
commit: { sha: 'string', url: 'string' },
zipball_url: 'string',
tarball_url: 'string',
node_id: 'string',
}));

return { data: res };
}),
return { data: res };
}),
},
},
}),
}))
Expand Down
3 changes: 2 additions & 1 deletion tsconfig.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@
"outDir": "./lib", /* Redirect output structure to the directory. */
"rootDir": "./src",
"strict": true,
"esModuleInterop": true
"esModuleInterop": true,
"skipLibCheck": true
},
"exclude": ["node_modules", "**/*.test.ts"]
}
Loading