fix(deps): update @actions/core, @actions/github and undici to patch advisories - #148
Merged
Mark Woolley (marknet15) merged 3 commits intoJul 30, 2026
Merged
Conversation
…advisories
Bumps @actions/core to ^2.0.3 and @actions/github to ^8.0.1, which moves the
transitive undici dependency off the 5.x line and drops @fastify/busboy from
the tree entirely.
Upstream @actions/http-client still pins undici to ^6.23.0, so an npm
`overrides` entry pins the resolved copy to 7.28.0, which is the first release
carrying fixes for every open advisory against undici in this tree.
@actions/github 8 ships Octokit 7, whose packages declare an `exports` map, so
the PaginatingEndpoints type is now imported from the package root rather than
its internal dist-types path.
Also narrows GitHub Actions workflow privileges:
* release.yaml drops the workflow-level token grants to `permissions: {}` and
declares `contents: write` / `pull-requests: write` on the job that needs
them.
* The checkout steps in lint-and-test.yml and bundle-is-fresh.yml no longer
persist git credentials. The release workflow's checkout still does, because
its tag step pushes to `origin` using them.
dist/ has been rebuilt from the updated dependency tree.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The previous commit's lockfile was regenerated on a machine configured with a mirror registry, so the 21 newly added entries carried mirror URLs that CI cannot authenticate against. Point them back at registry.npmjs.org, matching every other entry in the file. Integrity hashes are unchanged and match the values published by the registry. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The CJS bundle could not resolve @actions/core 3.x or @actions/github 9.x, both of which are ESM-only. Converting the project to ESM unblocks both majors. - package.json gains "type": "module". tsconfig moves to module: ESNext with moduleResolution: bundler, which keeps relative imports extensionless: module resolution is the bundler's job and the tsc output is never executed directly. - Bundling moves from @vercel/ncc to esbuild. ncc has no ESM output mode, as its --target flag sets the language target rather than the module format. - The bundle banner injects createRequire. Bundled CommonJS dependencies lazily require() Node built-ins, which esbuild rewrites to a shim that throws in ESM scope unless a require binding exists in module scope. - ncc type-checked as a side effect of bundling and esbuild does not, so an explicit typecheck script (tsc --noEmit) replaces it and runs in CI. - dist/licenses.txt and dist/sourcemap-register.js were ncc-specific artifacts and are removed. A process.setSourceMapsEnabled(true) banner replaces the latter. - commitlint.config.js becomes .cjs, as its module.exports would throw once the nearest package.json declares type: module. The undici override is retained, as no @actions/* release reaches undici 7 alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Mark Woolley (marknet15)
force-pushed
the
fix/dependency-security-advisories
branch
from
July 29, 2026 15:47
40667d5 to
8b70bde
Compare
Alexis Coles (AlexisColes)
approved these changes
Jul 30, 2026
Merged
gh-github-automation Bot
pushed a commit
to actions-marketplace-validations/Lendable_sloth
that referenced
this pull request
Jul 30, 2026
I have created a release PR for this version --- ## [1.2.1](Lendable/sloth@1.2.0...1.2.1) (2026-07-30) ### Bug Fixes * **deps:** Update @actions/core, @actions/github and undici to patch advisories ([#148](Lendable/sloth#148)) ([4f4f118](Lendable/sloth@4f4f118)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: lendabot[bot] <126705550+lendabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
Clears published security advisories, converts the project to ESM so the current majors are reachable, and tightens workflow token scopes.
Dependencies.
@actions/core→^3.0.1,@actions/github→^9.1.1, plus anoverridesentry pinningundicito 7.28.0. This clears 12 undici advisories and drops@fastify/busboy, a dependency of undici 5.x only. The override is required rather than incidental: no@actions/*release reaches undici 7 on its own.ESM conversion. Both majors are ESM-only (
"type": "module", an exports map with nodefault), which the CJS bundle could not resolve:package.jsonnow declares"type": "module".tsconfig.jsonmoves tomodule: ESNextwithmoduleResolution: bundler, which keeps relative imports extensionless: resolution is the bundler's job, and thetscoutput is never executed directly.Bundler:
@vercel/ncc→esbuild. ncc has no ESM output mode;--targetsets the language target, not the module format. Two consequences worth review:require()Node built-ins, which esbuild rewrites to a shim that throws in ESM scope. The bundle banner injectscreateRequireso arequirebinding exists; without it the action dies withDynamic require of "net" is not supported.typecheckscript (tsc --noEmit) replaces it and runs in CI.dist/licenses.txtanddist/sourcemap-register.jswere ncc-specific artifacts and are removed; asetSourceMapsEnabledbanner replaces the latter.commitlint.config.jsbecomes.cjs, sincemodule.exportswould throw undertype: module.Workflows — least-privilege
permissions:onrelease.yaml,persist-credentials: falseon the two checkouts that don't push.release.yamlkeeps its credentials for the tagging step that follows.Tests don't cover
fetch-check-runs.ts, so the bundle was smoke-run against the live API.