Vulnerabilties in bundle scanning
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 54/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript, node.js
- Domain
- security
Research direction
The report identifies @actions/github and @actions/core in packages/bundler-plugin-core/package.json of the linked bundler plugins repository. Read that package manifest and check the listed advisories to identify safe package versions. Done means both packages are updated and a new version is released; the issue does not name tests or release steps.
Written by the indexing model from the issue text.
Description
@actions/github and @actions/core are being used in @codecov/bundler-plugin-code (link), which is introducing multiple vulnerabilities into our application:
https://github.com/advisories/GHSA-4qv8-2p9j-2685
https://github.com/advisories/GHSA-xjj6-f33q-929c
https://github.com/advisories/GHSA-2m5v-pch6-74hx
https://github.com/advisories/GHSA-qrxm-fqhp-jwvm
https://github.com/advisories/GHSA-9fm3-97px-rjf6
Please can you bump both packages and then release a new version so that we can satisfy our security requirements? Our only other option will be to stop using Codecov.
- Dominant language
- No language data
- Stars
- 52
- Forks
- 26
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from codecov/feedback
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Docs Waiting for: Product Owner
Difficulty 1/5 Under an hour Newbie friendliness 65/100
-
Feature RequestOpen
Difficulty 5/5 Over a week Newbie friendliness 5/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 5/5 Over a week Newbie friendliness 8/100
All issues in codecov/feedback
Similar issues
-
github_actions security
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
dekobon/big-code-analysis#1815 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Open-Earth-Foundation/CityCatalyst#3399 ·
Maintainers usually reply within 2 days
-
BUG: catalog database credentials printed to logs at startupPossibly taken @cjboyle claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
code-yeongyu/oh-my-openagent#12396 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day