huggingface / huggingface/semver-release-action
Please fix vulnerabilities in action dependencies
- Dominant language
- JavaScript
- Stars
- 20
- Forks
- 7
- Avg merge
- 4m
- Merged PRs (30d)
- 1
Description
```
npm audit% ~/Documents/Work/GitHub/semver-release-action $ npm audit
# npm audit report
@octokit/endpoint 10.0.0 - 10.1.2
Severity: moderate
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-x4c5-c7rf-jjgv
fix available via `npm audit fix`
node_modules/@octokit/endpoint
@octokit/plugin-paginate-rest 9.3.0-beta.1 - 11.4.0
Severity: moderate
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-h5c3-5r3r-rr8q
fix available via `npm audit fix`
node_modules/@octokit/plugin-paginate-rest
@octokit/request 9.0.0-beta.1 - 9.2.0
Severity: moderate
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-rmvr-2pp2-xj38
fix available via `npm audit fix`
node_modules/@octokit/request
@octokit/request-error 6.0.0 - 6.1.6
Severity: moderate
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking - https://github.com/advisories/GHSA-xx4v-prfh-6cgc
fix available via `npm audit fix`
node_modules/@octokit/request-error
braces <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg
fix available via `npm audit fix`
node_modules/braces
cross-spawn 7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - https://github.com/advisories/GHSA-3xgq-45jj-v275
fix available via `npm audit fix`
node_modules/cross-spawn
node_modules/npm/node_modules/cross-spawn
micromatch <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - https://github.com/advisories/GHSA-952p-6rrq-rcjv
fix available via `npm audit fix`
node_modules/micromatch
semver 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1
Severity: high
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/builtins/node_modules/semver
node_modules/eslint-plugin-n/node_modules/semver
node_modules/semantic-release/node_modules/semver
node_modules/semver
node_modules/semver-diff/node_modules/semver
word-wrap <1.2.4
Severity: moderate
word-wrap vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-j8xg-fqg3-53r7
fix available via `npm audit fix`
node_modules/word-wrap
9 vulnerabilities (6 moderate, 3 high)
To address all issues, run:
npm audit fix
npm notice
npm notice New major version of npm available! 10.8.2 -> 11.3.0
npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.3.0
npm notice To update run: npm install -g npm@11.3.0
npm notice
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Run npm audit and npm audit fix in the repository, then inspect the dependency changes produced for the listed packages. Done means the reported vulnerabilities are resolved without breaking the JavaScript action; no files or tests are named in the issue, so use the repository’s available checks to verify the update.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- devops, security, tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100