huggingface / huggingface/semver-release-action

Please fix vulnerabilities in action dependencies

Open
#8 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
20
Forks
7
Avg merge
4m
Merged PRs (30d)
1

Description

```
npm audit% ~/Documents/Work/GitHub/semver-release-action $ npm audit
# npm audit report

@octokit/endpoint 10.0.0 - 10.1.2
Severity: moderate
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-x4c5-c7rf-jjgv
fix available via `npm audit fix`
node_modules/@octokit/endpoint

@octokit/plugin-paginate-rest 9.3.0-beta.1 - 11.4.0
Severity: moderate
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-h5c3-5r3r-rr8q
fix available via `npm audit fix`
node_modules/@octokit/plugin-paginate-rest

@octokit/request 9.0.0-beta.1 - 9.2.0
Severity: moderate
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-rmvr-2pp2-xj38
fix available via `npm audit fix`
node_modules/@octokit/request

@octokit/request-error 6.0.0 - 6.1.6
Severity: moderate
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-xx4v-prfh-6cgc
fix available via `npm audit fix`
node_modules/@octokit/request-error

braces <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces

cross-spawn 7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix`
node_modules/cross-spawn
node_modules/npm/node_modules/cross-spawn

micromatch <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
fix available via `npm audit fix`
node_modules/micromatch

semver 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1
Severity: high
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/builtins/node_modules/semver
node_modules/eslint-plugin-n/node_modules/semver
node_modules/semantic-release/node_modules/semver
node_modules/semver
node_modules/semver-diff/node_modules/semver

word-wrap <1.2.4
Severity: moderate
word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7
fix available via `npm audit fix`
node_modules/word-wrap

9 vulnerabilities (6 moderate, 3 high)

To address all issues, run:
npm audit fix
npm notice
npm notice New major version of npm available! 10.8.2 -> 11.3.0
npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.3.0
npm notice To update run: npm install -g npm@11.3.0
npm notice
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Run npm audit and npm audit fix in the repository, then inspect the dependency changes produced for the listed packages. Done means the reported vulnerabilities are resolved without breaking the JavaScript action; no files or tests are named in the issue, so use the repository’s available checks to verify the update.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
devops, security, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.