msvc-dev-cmd v1.1.0

Fail audit on moderate and above vulnerabilities
Set the threshold to "moderate" and above. Currently msvc-dev-cmd has an issue in transitive dev-dependency "minimist" [1] via somewhat long chain of dependencies: - eslint > file-entry-cache > flat-cache > write > mkdirp > minimist - eslint > mkdirp > minimist In order for this to be resolved all these packages need to do something about their pinned versions. I don't want to sit there with a red build because of some possible low-severity prototype pollution in dev dependency. Anything higher -- okay, I'll look at at, and apply a fix if necessary. (Maybe we should not audit dev dependencies at all...) This particular vulnerability can be exploited by an attacker who can submit a pull request and do "something bad"™ to Actions runners executing jobs for this repository. However, since it's a dev dependency, nothing will happen to our users. So we can safely ignore this advisory. [1]: https://npmjs.com/advisories/1179
2026-09-06 21:57:19 +08:00 · 2020-03-19 08:51:27 +02:00 · 2020-03-19 08:41:04 +02:00 · 2020-03-19 08:34:02 +02:00 · 2020-03-19 08:24:49 +02:00 · 2020-03-12 12:54:03 +02:00
5 changed files with 14 additions and 6 deletions
@@ -34,4 +34,4 @@ jobs:
      - name: Check out source code
        uses: actions/checkout@v1
      - run: npm install
-      - run: npm audit
+      - run: npm audit --audit-level=moderate
@@ -23,3 +23,10 @@ jobs:
        run: |
          cl.exe hello.c
          hello.exe
+  audit:
+    name: npm audit
+    runs-on: windows-latest
+    steps:
+      - name: Check out source code
+        uses: actions/checkout@v1
+      - run: npm audit --audit-level=moderate
@@ -14,6 +14,7 @@ const InterestingVariables = [
    'LIBPATH',
    'Path',
    'Platform',
+    'VisualStudioVersion',
    /^VCTools/,
    /^VSCMD_/,
    /^WindowsSDK/i,
@@ -1,6 +1,6 @@
 {
  "name": "msvc-dev-cmd",
-  "version": "1.0.0",
+  "version": "1.1.0",
  "lockfileVersion": 1,
  "requires": true,
  "dependencies": {
@@ -30,9 +30,9 @@
      }
    },
    "acorn": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.1.0.tgz",
-      "integrity": "sha512-kL5CuoXA/dgxlBbVrflsflzQ3PAas7RYZB52NOm/6839iVYJgKMJ3cQJD+t2i5+qFa8h3MDpEOJiS64E8JLnSQ==",
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.1.1.tgz",
+      "integrity": "sha512-add7dgA5ppRPxCFJoAGfMDi7PIBXq1RtGo7BhbLaxwrXPOmw8gq48Y9ozT01hUKy9byMjlR20EJhu5zlkErEkg==",
      "dev": true
    },
    "acorn-jsx": {
@@ -1,6 +1,6 @@
 {
  "name": "msvc-dev-cmd",
-  "version": "1.0.1",
+  "version": "1.1.0",
  "description": "GitHub Action to setup Developer Command Prompt for Microsoft Visual C++",
  "main": "index.js",
  "scripts": {
Author	SHA1	Message	Date
ilammy	b5113e7e9d	msvc-dev-cmd v1.1.0	2020-03-19 08:51:27 +02:00
ilammy	ddf4cb029f	Fail audit on moderate and above vulnerabilities Set the threshold to "moderate" and above. Currently msvc-dev-cmd has an issue in transitive dev-dependency "minimist" [1] via somewhat long chain of dependencies: - eslint > file-entry-cache > flat-cache > write > mkdirp > minimist - eslint > mkdirp > minimist In order for this to be resolved all these packages need to do something about their pinned versions. I don't want to sit there with a red build because of some possible low-severity prototype pollution in dev dependency. Anything higher -- okay, I'll look at at, and apply a fix if necessary. (Maybe we should not audit dev dependencies at all...) This particular vulnerability can be exploited by an attacker who can submit a pull request and do "something bad"™ to Actions runners executing jobs for this repository. However, since it's a dev dependency, nothing will happen to our users. So we can safely ignore this advisory. [1]: https://npmjs.com/advisories/1179	2020-03-19 08:41:04 +02:00
ilammy	26cb400781	Run "npm audit" for release branch too I'd like to be notified about weird vulnerabilities in JavaScript libraries for the release branch as well. It's double important since the release branch ships particular pinned version of all dependencies.	2020-03-19 08:34:02 +02:00
Sean Kelly	075328686b	Add VisualStudioVersion variable to exports (#3 ) This variable seems to be necessary for some build tools like colcon: https://colcon.readthedocs.io/en/released/	2020-03-19 08:24:49 +02:00
ilammy	e6cca73138	Refresh dependencies "npm audit" started whining about moderate denial of service vulnerability in a dependency of dependency of dependency (eslint > espree > acorn). This is not really serious because we use "eslint" only for development. However, red builds are not good so bump the pinned version in package.lock. (Released versions are not affected because they do not include eslint.)	2020-03-12 12:54:03 +02:00