Repository navigation
fix: resolve npm audit vulnerabilities in action/ and replace dead gitpkg dependency - #691
Merged
Zee2413 merged 1 commit intoMar 30, 2026
Conversation
kddejong
approved these changes
Mar 27, 2026
Contributor
Author
|
CI failure is unrelated to this change — the |
Zee2413
force-pushed
the
fix/action-npm-audit-tier1
branch
from
March 27, 2026 19:41
06fd017 to
4ff3e14
Compare
kddejong
approved these changes
Mar 27, 2026
Zee2413
force-pushed
the
fix/action-npm-audit-tier1
branch
from
March 30, 2026 16:09
4ff3e14 to
ab8cf0b
Compare
Zee2413
changed the title
…tpkg dependency Replace cfn-guard dependency from gitpkg.vercel.app (which is permanently returning 402 DEPLOYMENT_DISABLED) with a local file reference to ../guard/ts-lib. This works because CI checks out the full repo. Add overrides in package.json to pin minimum safe versions for transitive dependencies, ensuring fixes persist across lockfile regeneration: - flatted: 3.4.2 (prototype pollution, DoS) - ajv: 6.14.0 (ReDoS) - micromatch: 4.0.8 (ReDoS) - js-yaml: >=3.14.2 (prototype pollution) - brace-expansion: >=1.1.13 (ReDoS) - picomatch: >=2.3.2 (method injection, ReDoS) - minimatch: >=3.1.5 (ReDoS, partial — prettier-eslint copy remains) - @babel/helpers: >=7.26.10 (regex complexity) - @eslint/plugin-kit: >=0.3.4 (ReDoS) Remaining alerts: - undici (production, via @actions/github) — requires breaking major bump - minimatch 9.0.3 via prettier-eslint — requires breaking upgrade Verified: npm run lint ✅, npm test ✅ (20/20 tests passed)
Zee2413
force-pushed
the
fix/action-npm-audit-tier1
branch
from
March 30, 2026 16:15
ab8cf0b to
e5dad00
Compare
Zee2413
commented
Mar 30, 2026
| "@actions/core": "^1.11.1", | ||
| "@actions/exec": "^1.1.1", | ||
| "@actions/github": "^6.0.0", | ||
| "cfn-guard": "https://gitpkg.now.sh/aws-cloudformation/cloudformation-guard/guard/ts-lib?33d9931" |
Contributor
Author
There was a problem hiding this comment.
Change to free tier throwing 402 Payment Required from gitpkg.vercel.app since Jan 19th.
satyakigh
approved these changes
Mar 30, 2026
chrisqm-dev
approved these changes
Mar 30, 2026
This was referenced Mar 31, 2026
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
cloudformation-guard 3.2.1 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre><!-- Release notes generated using configuration in .github/release.yml at 3.2.1 --> ## What's Changed * Use remote check for tag and force-with-lease for branch to allow rel… by @Zee2413 in aws-cloudformation/cloudformation-guard#675 * Fetch before pushing release branch by @Zee2413 in aws-cloudformation/cloudformation-guard#676 * Remove homebrew step and skip scratch compilation during cargo publish by @Zee2413 in aws-cloudformation/cloudformation-guard#678 * Prevent cargo publish errors from being swallowed as already published by @Zee2413 in aws-cloudformation/cloudformation-guard#680 * fix: exclude bot authors from release notes and prevent duplication o… by @Zee2413 in aws-cloudformation/cloudformation-guard#682 * fix: bump form-data to 4.0.5 to resolve CVE-2025-7783 (Dependabot #46) by @Zee2413 in aws-cloudformation/cloudformation-guard#685 * fix: resolve npm audit vulnerabilities in action/ and replace dead gitpkg dependency by @Zee2413 in aws-cloudformation/cloudformation-guard#691 * fix: resolve 9 npm audit vulnerabilities in guard/ dev dependencies by @Zee2413 in aws-cloudformation/cloudformation-guard#690 * fix: add explicit permissions to all GitHub Actions workflows by @Zee2413 in aws-cloudformation/cloudformation-guard#693 * fix: upgrade @actions/github to 8.0.1 and @actions/core to 2.0.3 to resolve undici CVEs by @Zee2413 in aws-cloudformation/cloudformation-guard#695 * fix: bump bytes crate to 1.11.1 to resolve CVE-2026-25541 by @Zee2413 in aws-cloudformation/cloudformation-guard#694 * chore: automate ATTRIBUTION generation with cargo-about by @Zee2413 in aws-cloudformation/cloudformation-guard#697 * chore(deps): Fix high severity npm audit findings in /action and /guard by @Zee2413 in aws-cloudformation/cloudformation-guard#711 * Fix evaluator and reporter defects where a rule reported compliance, or nothing at all, for input it should have rejected by @awsmadi in aws-cloudformation/cloudformation-guard#717 * fix(deps): Patch high-severity advisories by @Zee2413 in aws-cloudformation/cloudformation-guard#724 * fix(deps): Update undici to 6.28.0 by @Zee2413 in aws-cloudformation/cloudformation-guard#726 ## New Contributors * @github-actions[bot] made their first contribution in aws-cloudformation/cloudformation-guard#681 * @awsmadi made their first contribution in aws-cloudformation/cloudformation-guard#717 **Full Changelog**: https://github.com/aws-cloudformation/cloudformation-guard/compare/3.2.0...3.2.1</pre> <p>View the full release notes at <a href="https://github.com/aws-cloudformation/cloudformation-guard/releases/tag/3.2.1">https://github.com/aws-cloudformation/cloudformation-guard/releases/tag/3.2.1</a>.</p> </details> <hr> See merge request: Harmonybrew/homebrew-core!17668
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two fixes in one:
Replace dead
gitpkg.vercel.appdependency — the third-party service used to servecfn-guardas an npm package is permanently down (402 DEPLOYMENT_DISABLED). Replaced with a local file reference to../guard/ts-lib, which works because CI checks out the full repo.Resolve 9 npm audit vulnerabilities — adds
overridesinpackage.jsonto pin minimum safe versions for transitive dependencies, ensuring fixes persist across lockfile regeneration.Changes
Dependency source fix:
New overrides:
flatted3.4.2ajv6.14.0$dataoptionmicromatch4.0.8js-yaml>=3.14.2brace-expansion>=1.1.13picomatch>=2.3.2minimatch>=3.1.5@babel/helpers>=7.26.10@eslint/plugin-kit>=0.3.4Remaining Vulnerabilities
undici(production, 6 CVEs) — requires@actions/github6.x → 9.x breaking changeminimatch9.0.3 viaprettier-eslint(dev-only) — requires breakingprettier-eslintupgradeVerification
npm run lint✅npm test✅ (20/20 tests passed)