fix: resolve npm audit vulnerabilities in action/ and replace dead gitpkg dependency#691
Merged
Zee2413 merged 1 commit intoMar 30, 2026
Conversation
kddejong
approved these changes
Mar 27, 2026
Contributor
Author
|
CI failure is unrelated to this change — the |
Zee2413
force-pushed
the
fix/action-npm-audit-tier1
branch
from
06fd017 to
4ff3e14
Compare
kddejong
approved these changes
Mar 27, 2026
Zee2413
force-pushed
the
fix/action-npm-audit-tier1
branch
from
4ff3e14 to
ab8cf0b
Compare
Zee2413
changed the title
…tpkg dependency Replace cfn-guard dependency from gitpkg.vercel.app (which is permanently returning 402 DEPLOYMENT_DISABLED) with a local file reference to ../guard/ts-lib. This works because CI checks out the full repo. Add overrides in package.json to pin minimum safe versions for transitive dependencies, ensuring fixes persist across lockfile regeneration: - flatted: 3.4.2 (prototype pollution, DoS) - ajv: 6.14.0 (ReDoS) - micromatch: 4.0.8 (ReDoS) - js-yaml: >=3.14.2 (prototype pollution) - brace-expansion: >=1.1.13 (ReDoS) - picomatch: >=2.3.2 (method injection, ReDoS) - minimatch: >=3.1.5 (ReDoS, partial — prettier-eslint copy remains) - @babel/helpers: >=7.26.10 (regex complexity) - @eslint/plugin-kit: >=0.3.4 (ReDoS) Remaining alerts: - undici (production, via @actions/github) — requires breaking major bump - minimatch 9.0.3 via prettier-eslint — requires breaking upgrade Verified: npm run lint ✅, npm test ✅ (20/20 tests passed)
Zee2413
force-pushed
the
fix/action-npm-audit-tier1
branch
from
ab8cf0b to
e5dad00
Compare
Zee2413
commented
Mar 30, 2026
| "@actions/core": "^1.11.1", | ||
| "@actions/exec": "^1.1.1", | ||
| "@actions/github": "^6.0.0", | ||
| "cfn-guard": "https://gitpkg.now.sh/aws-cloudformation/cloudformation-guard/guard/ts-lib?33d9931" |
Contributor
Author
There was a problem hiding this comment.
Change to free tier throwing 402 Payment Required from gitpkg.vercel.app since Jan 19th.
satyakigh
approved these changes
Mar 30, 2026
chrisqm-dev
approved these changes
Mar 30, 2026
This was referenced Mar 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two fixes in one:
Replace dead
gitpkg.vercel.appdependency — the third-party service used to servecfn-guardas an npm package is permanently down (402 DEPLOYMENT_DISABLED). Replaced with a local file reference to../guard/ts-lib, which works because CI checks out the full repo.Resolve 9 npm audit vulnerabilities — adds
overridesinpackage.jsonto pin minimum safe versions for transitive dependencies, ensuring fixes persist across lockfile regeneration.Changes
Dependency source fix:
New overrides:
flatted3.4.2ajv6.14.0$dataoptionmicromatch4.0.8js-yaml>=3.14.2brace-expansion>=1.1.13picomatch>=2.3.2minimatch>=3.1.5@babel/helpers>=7.26.10@eslint/plugin-kit>=0.3.4Remaining Vulnerabilities
undici(production, 6 CVEs) — requires@actions/github6.x → 9.x breaking changeminimatch9.0.3 viaprettier-eslint(dev-only) — requires breakingprettier-eslintupgradeVerification
npm run lint✅npm test✅ (20/20 tests passed)