Closed renovate[bot] closed 3 months ago
All modified and coverable lines are covered by tests :white_check_mark:
Project coverage is 47.92%. Comparing base (
490788d
) to head (f599bc6
). Report is 15 commits behind head on main.:exclamation: Current head f599bc6 differs from pull request most recent head 6361c63. Consider uploading reports for the commit 6361c63 to get more accurate results
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
Because you closed this PR without merging, Renovate will ignore this update (1.9.1
). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps
array of your Renovate config.
If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
This PR contains the following updates:
1.2.6
->1.9.1
GitHub Vulnerability Alerts
CVE-2022-35954
Impact
The
core.exportVariable
function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to theGITHUB_ENV
file may cause the path or other environment variables to be modified without the intention of the workflow or action author.Patches
Users should upgrade to
@actions/core v1.9.1
.Workarounds
If you are unable to upgrade the
@actions/core
package, you can modify your action to ensure that any user input does not contain the delimiter_GitHubActionsFileCommandDelimeter_
before callingcore.exportVariable
.References
More information about setting-an-environment-variable in workflows
If you have any questions or comments about this advisory:
actions/toolkit
Release Notes
actions/toolkit (@actions/core)
### [`v1.9.1`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#191) - Randomize delimiter when calling `core.exportVariable` ### [`v1.9.0`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#190) - Added `toPosixPath`, `toWin32Path` and `toPlatformPath` utilities [#1102](https://togithub.com/actions/toolkit/pull/1102) ### [`v1.8.2`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#182) - Update to v2.0.1 of `@actions/http-client` [#1087](https://togithub.com/actions/toolkit/pull/1087) ### [`v1.8.1`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#181) - Update to v2.0.0 of `@actions/http-client` ### [`v1.8.0`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#180) - Deprecate `markdownSummary` extension export in favor of `summary` - [https://github.com/actions/toolkit/pull/1072](https://togithub.com/actions/toolkit/pull/1072) - [https://github.com/actions/toolkit/pull/1073](https://togithub.com/actions/toolkit/pull/1073) ### [`v1.7.0`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#170) - [Added `markdownSummary` extension](https://togithub.com/actions/toolkit/pull/1014) ### [`v1.6.0`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#160) - [Added OIDC Client function `getIDToken`](https://togithub.com/actions/toolkit/pull/919) - [Added `file` parameter to `AnnotationProperties`](https://togithub.com/actions/toolkit/pull/896) ### [`v1.5.0`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#150) - [Added support for notice annotations and more annotation fields](https://togithub.com/actions/toolkit/pull/855) ### [`v1.4.0`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#140) - [Added the `getMultilineInput` function](https://togithub.com/actions/toolkit/pull/829) ### [`v1.3.0`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#130) - [Added the trimWhitespace option to getInput](https://togithub.com/actions/toolkit/pull/802) - [Added the getBooleanInput function](https://togithub.com/actions/toolkit/pull/725) ### [`v1.2.7`](https://togithub.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#127) - [Prepend newline for set-output](https://togithub.com/actions/toolkit/pull/772)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.