[Security] Workflow remove-labels.yml is using vulnerable action mondeja/remove-labels-gh-action

AlexRogalskiy / proverbs

🎲 Styled Proverbs API

https://styled-proverbs.vercel.app

GNU General Public License v3.0

5 stars 1 forks source link

[Security] Workflow remove-labels.yml is using vulnerable action mondeja/remove-labels-gh-action #967

Open akulpillai opened 2 years ago

akulpillai commented 2 years ago

The workflow remove-labels.yml is referencing action mondeja/remove-labels-gh-action using references v1.0.0. However this reference is missing the commit 5abe631a9c2bef28782a90e9f44938a75ee9f1d1 which may contain fix to the some vulnerability. The vulnerability fix that is missing by actions version could be related to: (1) CVE fix (2) upgrade of vulnerable dependency (3) fix to secret leak and others. Please consider to update the reference to the action.

github-actions[bot] commented 2 years ago

👋 Thanks for reporting!