mirror of
https://github.com/actions/setup-node.git
synced 2026-07-28 12:43:02 +00:00
copilot-swe-agent[bot]
4ff1ddf5d7
## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
from the jest coverage instrumentation path
`npm audit --audit-level=high` now reports 0 vulnerabilities.
## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml
Rebuild dist artifacts to include updated brace-expansion.
69 lines
2.0 KiB
JSON
69 lines
2.0 KiB
JSON
{
|
|
"name": "setup-node",
|
|
"version": "7.0.0",
|
|
"type": "module",
|
|
"private": true,
|
|
"description": "setup node action",
|
|
"main": "lib/setup-node.js",
|
|
"engines": {
|
|
"node": ">=24.0.0"
|
|
},
|
|
"scripts": {
|
|
"build": "ncc build -o dist/setup src/setup-node.ts && ncc build -o dist/cache-save src/cache-save.ts",
|
|
"format": "prettier --no-error-on-unmatched-pattern --write \"**/*.{ts,yml,yaml}\"",
|
|
"format-check": "prettier --no-error-on-unmatched-pattern --check \"**/*.{ts,yml,yaml}\"",
|
|
"lint": "eslint \"**/*.ts\"",
|
|
"lint:fix": "eslint \"**/*.ts\" --fix",
|
|
"test": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --runInBand --coverage",
|
|
"pre-checkin": "npm run format && npm run lint:fix && npm run build && npm test"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/actions/setup-node.git"
|
|
},
|
|
"keywords": [
|
|
"actions",
|
|
"node",
|
|
"setup"
|
|
],
|
|
"author": "GitHub",
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"@actions/cache": "^6.2.0",
|
|
"@actions/core": "^3.0.1",
|
|
"@actions/exec": "^3.0.0",
|
|
"@actions/github": "^9.1.1",
|
|
"@actions/glob": "^0.7.0",
|
|
"@actions/http-client": "^4.0.1",
|
|
"@actions/io": "^3.0.2",
|
|
"@actions/tool-cache": "^4.0.0",
|
|
"semver": "^7.8.5"
|
|
},
|
|
"overrides": {
|
|
"@actions/glob": "$@actions/glob",
|
|
"glob": {
|
|
"minimatch": "^10.2.5"
|
|
},
|
|
"test-exclude": "^7.0.2"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@jest/globals": "^30.4.1",
|
|
"@types/node": "^24.1.0",
|
|
"@types/semver": "^7.7.0",
|
|
"@typescript-eslint/eslint-plugin": "^8.62.0",
|
|
"@typescript-eslint/parser": "^8.62.0",
|
|
"@vercel/ncc": "^0.44.0",
|
|
"eslint": "^10.5.0",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"eslint-plugin-jest": "^29.15.2",
|
|
"eslint-plugin-n": "^18.1.0",
|
|
"globals": "^17.7.0",
|
|
"jest": "^30.4.2",
|
|
"jest-each": "^30.4.1",
|
|
"prettier": "^3.8.4",
|
|
"ts-jest": "^29.4.11",
|
|
"typescript": "^6.0.3"
|
|
}
|
|
}
|