search

github / vscode-github-actions

GitHub Actions extension for VS Code
https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-github-actions
MIT License
469 stars 70 forks source link

Incorrect version in package-lock.json triggers false positive for critical security vulnerability #356

Open 0xg0nz0 opened 1 week ago

0xg0nz0 commented 1 week ago

In ~/.vscode-server/extensions/github.vscode-github-actions-0.26.3/script/workspace/package-lock.json:

    "vscode-github-actions": {
      "version": "0.25.6",

So it looks like the declared version in the lock file (0.25.6) is older than the package version (0.26.3).

This in turn gets flagged in grype:

vscode-github-actions  0.25.6                                                                    npm        GHSA-wvmr-x489-hcpj  Critical

Which is quite the false alarm, given the severity of that particular issue:

https://github.com/advisories/GHSA-wvmr-x489-hcpj