# npm audit report
brace-expansion 1.0.0 - 1.1.11 || 2.0.0 - 2.0.1
brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
brace-expansion Regular Expression Denial of Service vulnerability - https://github.com/advisories/GHSA-v6h2-p8h4-qcjw
fix available via `npm audit fix`
node_modules/@actions/glob/node_modules/brace-expansion
node_modules/@eslint/eslintrc/node_modules/brace-expansion
node_modules/@humanwhocodes/config-array/node_modules/brace-expansion
node_modules/archiver-utils/node_modules/brace-expansion
node_modules/cacache/node_modules/brace-expansion
node_modules/editorconfig/node_modules/brace-expansion
node_modules/eslint-plugin-react/node_modules/brace-expansion
node_modules/eslint/node_modules/brace-expansion
node_modules/filelist/node_modules/brace-expansion
node_modules/glob/node_modules/brace-expansion
node_modules/js-beautify/node_modules/brace-expansion
node_modules/mem-fs-editor/node_modules/brace-expansion
node_modules/mocha/node_modules/brace-expansion
node_modules/multimatch/node_modules/brace-expansion
node_modules/prettier-eslint/node_modules/@eslint/eslintrc/node_modules/brace-expansion
node_modules/prettier-eslint/node_modules/brace-expansion
node_modules/prettier-eslint/node_modules/eslint/node_modules/brace-expansion
node_modules/readdir-glob/node_modules/brace-expansion
diff 6.0.0 - 8.0.2
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/diff
mocha 11.4.0 - 12.0.0-beta-3
Depends on vulnerable versions of diff
node_modules/mocha
glob 10.2.0 - 10.4.5
Severity: high
glob CLI: Command injection via -c/--cmd executes matches with shell:true - https://github.com/advisories/GHSA-5j98-mcp5-4vw2
fix available via `npm audit fix`
node_modules/@jest/reporters/node_modules/glob
node_modules/archiver-utils/node_modules/glob
node_modules/cacache/node_modules/glob
node_modules/jest-config/node_modules/glob
node_modules/jest-runtime/node_modules/glob
node_modules/js-beautify/node_modules/glob
node_modules/mocha/node_modules/glob
js-yaml <3.14.2
Severity: moderate
js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
fix available via `npm audit fix`
node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml
undici <6.23.0
Severity: moderate
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion - https://github.com/advisories/GHSA-g9mf-h72j-4rw9
fix available via `npm audit fix --force`
Will install @actions/[email protected], which is a breaking change
node_modules/undici
@actions/github 6.0.1 - 8.0.0
Depends on vulnerable versions of undici
node_modules/@actions/attest/node_modules/@actions/github
@actions/attest >=2.2.0
Depends on vulnerable versions of @actions/github
node_modules/@actions/attest
8 vulnerabilities (3 low, 4 moderate, 1 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
