Fix npm audit failures on releases/v5 - #1154
Merged
brunoborges merged 3 commits intoJul 29, 2026
Merged
Conversation
Override minimatch with the patched release and refresh transitive dependencies and bundled action output. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 61439b48-bcf1-4855-94e9-31c4da3e8314
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses npm audit --audit-level=high failures on releases/v5 by updating vulnerable transitive dependencies (notably minimatch, brace-expansion, and js-yaml) via an npm override, refreshing the lockfile, and updating the checked-in compiled action bundle output.
Changes:
- Add an npm
overridesentry to force a patchedminimatchversion. - Refresh
package-lock.jsonto resolve updated transitive versions (includingbrace-expansionandjs-yaml). - Update the checked-in
dist/cleanup/index.jsbundle to reflect the new dependency graph.
Show a summary per file
| File | Description |
|---|---|
| package.json | Adds an npm override to force a patched minimatch version. |
| package-lock.json | Updates resolved transitive dependency versions to eliminate audit findings. |
| dist/cleanup/index.js | Rebuilds the compiled cleanup action bundle with updated dependency contents. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/4 changed files
- Comments generated: 1
- Review effort level: Low
Use ESLint's directory and extension arguments so file enumeration does not depend on minimatch handling absolute Windows paths after the security override. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep the transitive override at the validated patched release to avoid unrelated changes during future lockfile refreshes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
npm audit --audit-level=highfails onreleases/v5because transitiveminimatch,brace-expansion, andjs-yamlversions are covered by new denial-of-service advisories.Override
minimatchwith the patched10.2.6release, refresh the lockfile, and rebuild the checked-in action bundles. The audit now reports zero vulnerabilities.Related issue:
N/A
Check list:
npm run checklocally (format, lint, build, test) and all checks pass.