Skip to content

fix: Security updates #101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anurag-stepsecurity merged 2 commits into from
Jul 22, 2026
Merged

fix: Security updates #101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f500b03
fix: apply audit fixes
github-actions[bot] Jun 22, 2026
3a26176
chore(deps): Bump axios to 1.18.1
anurag-stepsecurity Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions dist/save-cache/index.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22953,7 +22953,7 @@ var require_package = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "6.1.0",
version: "6.2.0",
description: "Actions cache lib",
keywords: [
"github",
Expand Down Expand Up @@ -74600,6 +74600,15 @@ function getCacheServiceVersion() {
return "v1";
return process.env["ACTIONS_CACHE_SERVICE_V2"] ? "v2" : "v1";
}
var KNOWN_CACHE_MODES = ["none", "read", "write", "write-only"];
function getCacheMode() {
return (process.env["ACTIONS_CACHE_MODE"] || "").trim().toLowerCase();
}
function isCacheWritable(mode) {
if (!KNOWN_CACHE_MODES.includes(mode))
return true;
return mode === "write" || mode === "write-only";
}
function getCacheServiceURL() {
const version3 = getCacheServiceVersion();
switch (version3) {
Expand Down Expand Up @@ -75889,6 +75898,12 @@ function saveCache2(paths_1, key_1, options_1) {
debug(`Cache service version: ${cacheServiceVersion}`);
checkPaths(paths);
checkKey(key);
const cacheMode = getCacheMode();
if (!isCacheWritable(cacheMode)) {
info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`);
debug(`Skipped save for paths [${paths.join(", ")}] with key '${key}'.`);
return -1;
}
switch (cacheServiceVersion) {
case "v2":
return yield saveCacheV2(paths, key, options, enableCrossOsArchive);
Expand Down Expand Up @@ -75946,8 +75961,6 @@ function saveCacheV1(paths_1, key_1, options_1) {
const typedError = error2;
if (typedError.name === ValidationError.name) {
throw error2;
} else if (typedError.name === CacheWriteDeniedError.name) {
warning(`Failed to save: ${typedError.message}`);
} else if (typedError.name === ReserveCacheError.name) {
info(`Failed to save: ${typedError.message}`);
} else {
Expand Down Expand Up @@ -76035,8 +76048,6 @@ function saveCacheV2(paths_1, key_1, options_1) {
const typedError = error2;
if (typedError.name === ValidationError.name) {
throw error2;
} else if (typedError.name === CacheWriteDeniedError.name) {
warning(`Failed to save: ${typedError.message}`);
} else if (typedError.name === ReserveCacheError.name) {
info(`Failed to save: ${typedError.message}`);
} else if (typedError.name === FinalizeCacheError.name) {
Expand Down
61 changes: 55 additions & 6 deletions dist/setup/index.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22952,7 +22952,7 @@ var require_package = __commonJS({
"node_modules/@actions/cache/package.json"(exports2, module2) {
module2.exports = {
name: "@actions/cache",
version: "6.1.0",
version: "6.2.0",
description: "Actions cache lib",
keywords: [
"github",
Expand Down Expand Up @@ -70361,6 +70361,7 @@ var SystemTarPathOnWindows = `${process.env["SYSTEMDRIVE"]}\\Windows\\System32\\
var TarFilename = "cache.tar";
var ManifestFilename = "manifest.txt";
var CacheFileSizeLimit = 10 * Math.pow(1024, 3);
var CacheReadDeniedMessagePrefix = "cache read denied:";

// node_modules/@actions/cache/lib/internal/cacheUtils.js
var __awaiter10 = function(thisArg, _arguments, P, generator) {
Expand Down Expand Up @@ -103947,6 +103948,15 @@ function getCacheServiceVersion() {
return "v1";
return process.env["ACTIONS_CACHE_SERVICE_V2"] ? "v2" : "v1";
}
var KNOWN_CACHE_MODES = ["none", "read", "write", "write-only"];
function getCacheMode() {
return (process.env["ACTIONS_CACHE_MODE"] || "").trim().toLowerCase();
}
function isCacheReadable(mode) {
if (!KNOWN_CACHE_MODES.includes(mode))
return true;
return mode === "read" || mode === "write";
}
function getCacheServiceURL() {
const version3 = getCacheServiceVersion();
switch (version3) {
Expand Down Expand Up @@ -104020,6 +104030,7 @@ function createHttpClient() {
}
function getCacheEntry(keys, paths, options) {
return __awaiter13(this, void 0, void 0, function* () {
var _a;
const httpClient = createHttpClient();
const version3 = getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive);
const resource = `cache?keys=${encodeURIComponent(keys.join(","))}&version=${version3}`;
Expand All @@ -104033,6 +104044,10 @@ function getCacheEntry(keys, paths, options) {
return null;
}
if (!isSuccessStatusCode(response.statusCode)) {
const errorMessage = (_a = response.error) === null || _a === void 0 ? void 0 : _a.message;
if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(CacheReadDeniedMessagePrefix)) {
throw new Error(errorMessage);
}
throw new Error(`Cache service responded with ${response.statusCode}`);
}
const cacheResult = response.result;
Expand Down Expand Up @@ -105161,6 +105176,14 @@ var ValidationError = class _ValidationError extends Error {
Object.setPrototypeOf(this, _ValidationError.prototype);
}
};
var CACHE_READ_DENIED_PREFIX = CacheReadDeniedMessagePrefix;
var CacheReadDeniedError = class _CacheReadDeniedError extends Error {
constructor(message) {
super(message);
this.name = "CacheReadDeniedError";
Object.setPrototypeOf(this, _CacheReadDeniedError.prototype);
}
};
function checkPaths(paths) {
if (!paths || paths.length === 0) {
throw new ValidationError(`Path Validation Error: At least one directory or file path is required`);
Expand All @@ -105180,6 +105203,12 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) {
const cacheServiceVersion = getCacheServiceVersion();
debug(`Cache service version: ${cacheServiceVersion}`);
checkPaths(paths);
const cacheMode = getCacheMode();
if (!isCacheReadable(cacheMode)) {
info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`);
debug(`Skipped restore for paths [${paths.join(", ")}] with primary key '${primaryKey}'.`);
return void 0;
}
switch (cacheServiceVersion) {
case "v2":
return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive);
Expand All @@ -105191,6 +105220,7 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) {
}
function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
return __awaiter16(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) {
var _a;
restoreKeys = restoreKeys || [];
const keys = [primaryKey, ...restoreKeys];
debug("Resolved Keys:");
Expand All @@ -105204,10 +105234,19 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
const compressionMethod = yield getCompressionMethod();
let archivePath = "";
try {
const cacheEntry = yield getCacheEntry(keys, paths, {
compressionMethod,
enableCrossOsArchive
});
let cacheEntry;
try {
cacheEntry = yield getCacheEntry(keys, paths, {
compressionMethod,
enableCrossOsArchive
});
} catch (error2) {
const errorMessage = (_a = error2 === null || error2 === void 0 ? void 0 : error2.message) !== null && _a !== void 0 ? _a : "";
if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) {
throw new CacheReadDeniedError(errorMessage);
}
throw error2;
}
if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) {
return void 0;
}
Expand Down Expand Up @@ -105249,6 +105288,7 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
}
function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) {
return __awaiter16(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) {
var _a;
options = Object.assign(Object.assign({}, options), { useAzureSdk: true });
restoreKeys = restoreKeys || [];
const keys = [primaryKey, ...restoreKeys];
Expand All @@ -105269,7 +105309,16 @@ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) {
restoreKeys,
version: getCacheVersion(paths, compressionMethod, enableCrossOsArchive)
};
const response = yield twirpClient.GetCacheEntryDownloadURL(request);
let response;
try {
response = yield twirpClient.GetCacheEntryDownloadURL(request);
} catch (error2) {
const errorMessage = (_a = error2 === null || error2 === void 0 ? void 0 : error2.message) !== null && _a !== void 0 ? _a : "";
if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) {
throw new CacheReadDeniedError(errorMessage);
}
throw error2;
}
if (!response.ok) {
debug(`Cache not found for version ${request.version} of keys: ${keys.join(", ")}`);
return void 0;
Expand Down
Loading
Loading