actions/msvc-dev-cmd
1
0
Fork 0
mirror of https://github.com/ilammy/msvc-dev-cmd.git synced 2026-09-06 21:57:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Resolve audit warnings (#45)

Browse Source 
* Update glob-parent to resolve CVE-2020-28469

* Run audit tasks on Ubuntu runners (they are cheaper)

* Audit only production dependencies

That is, something that can actually affect users of this action.
I don't really want to be bothered with yet another "prototype pollution"
or "denial of service" in transitive dependencies of eslint.

* Audit dev-dependencies for critical vulnerabilities

That said, still audit development dependencies for critical
vulnerabilities if they come along. Hopefully, this should be rare.
This commit is contained in:
Alexei Lozovsky
2021-06-09 18:25:52 +09:00
committed by GitHub
parent af5661e514
commit 74a501b087
3 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/main.yml
+3 -2
View File
@@ -58,12 +58,13 @@ jobs:
dumpbin /headers hello.exe dumpbin /headers hello.exe
audit: audit:
name: npm audit name: npm audit
runs-on: windows-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out source code - name: Check out source code
uses: actions/checkout@v2 uses: actions/checkout@v2
- run: npm install - run: npm install
- run: npm audit --audit-level=moderate - run: npm audit --audit-level=moderate --production
- run: npm audit --audit-level=critical
alias-arch: alias-arch:
name: arch aliases name: arch aliases
runs-on: windows-latest runs-on: windows-latest
.github/workflows/release.yml
+3 -2
View File
@@ -23,8 +23,9 @@ jobs:
hello.exe hello.exe
audit: audit:
name: npm audit name: npm audit
runs-on: windows-latest runs-on: ubuntu-latest
steps: steps:
- name: Check out source code - name: Check out source code
uses: actions/checkout@v2 uses: actions/checkout@v2
- run: npm audit --audit-level=moderate - run: npm audit --audit-level=moderate --production
- run: npm audit --audit-level=critical
package-lock.json
Generated
+6 -6
View File
@@ -531,9 +531,9 @@
} }
}, },
"node_modules/glob-parent": { "node_modules/glob-parent": {
"version": "5.1.0", "version": "5.1.2",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz", "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
"integrity": "sha512-qjtRgnIVmOfnKUE3NJAQEdk+lKrxfw8t5ke7SXtfMTHcjsBfOfWXCQfdb30zfDoZQ2IRSIiidmjtbHZPZ++Ihw==", "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
"dev": true, "dev": true,
"dependencies": { "dependencies": {
"is-glob": "^4.0.1" "is-glob": "^4.0.1"
@@ -1690,9 +1690,9 @@
} }
}, },
"glob-parent": { "glob-parent": {
"version": "5.1.0", "version": "5.1.2",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz", "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
"integrity": "sha512-qjtRgnIVmOfnKUE3NJAQEdk+lKrxfw8t5ke7SXtfMTHcjsBfOfWXCQfdb30zfDoZQ2IRSIiidmjtbHZPZ++Ihw==", "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
"dev": true, "dev": true,
"requires": { "requires": {
"is-glob": "^4.0.1" "is-glob": "^4.0.1"