[MikeMcC399]

Situation

npm audit and dependabot report multiple vulnerabilities in the root of the repo:

$ npm audit
# npm audit report

basic-ftp  <=6.2.0
Severity: high
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) - https://github.com/advisories/GHSA-c475-qrg2-pj4r
fix available via `npm audit fix --force`
Will install markdown-link-check@3.11.2, which is a breaking change
node_modules/basic-ftp
  get-uri  >=5.0.0
  Depends on vulnerable versions of basic-ftp
  node_modules/get-uri
    pac-proxy-agent  >=6.0.0
    Depends on vulnerable versions of get-uri
    node_modules/pac-proxy-agent
      proxy-agent  >=6.0.0
      Depends on vulnerable versions of pac-proxy-agent
      node_modules/proxy-agent
        link-check  >=5.3.0
        Depends on vulnerable versions of proxy-agent
        node_modules/link-check
          markdown-link-check  >=3.12.0
          Depends on vulnerable versions of link-check
          Depends on vulnerable versions of proxy-agent
          node_modules/markdown-link-check

http-cache-semantics  <=4.2.0
Severity: high
http-cache-semantics max-stale handling can disclose cross-user cached responses - https://github.com/advisories/GHSA-ch52-4w7c-c8xp
fix available via `npm audit fix`
node_modules/http-cache-semantics

ip-address  <=10.7.3
Severity: moderate
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process - https://github.com/advisories/GHSA-rxp7-6hxx-x8q5
fix available via `npm audit fix`
node_modules/ip-address

undici  6.5.0 - 6.29.0 || 7.0.0 - 7.30.0
Severity: high
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser - https://github.com/advisories/GHSA-4qv8-2p9j-2685
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser - https://github.com/advisories/GHSA-4qv8-2p9j-2685
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens - https://github.com/advisories/GHSA-f72v-6w45-q472
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings - https://github.com/advisories/GHSA-xjj6-f33q-929c
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings - https://github.com/advisories/GHSA-xjj6-f33q-929c
fix available via `npm audit fix`
node_modules/cheerio/node_modules/undici
node_modules/undici

9 vulnerabilities (1 moderate, 8 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Change

Execute npm update --save in the root of the repo and rebuild the action.

[cursor]

This PR is too large for Bugbot to review. It changes 107,913 lines and 4,077,103 characters. Split the change into smaller pull requests to get a review.

[MikeMcC399]

This PR is too large for Bugbot to review. It changes 107,913 lines and 4,077,103 characters. Split the change into smaller pull requests to get a review.

Unable to oblige for Bugbot's sake. Perhaps Bugbot can be persuaded to ignore the contents of the compiled code from ncc in the dist directory?

This PR changes only versions in package-lock.json and rebuilds the action. There are no other changes in the PR.

The goal is to address vulnerabilities.

[mschile]

I believe the dist/849.index.js file can be deleted. We'll probably want to add clearing the dist directory in the build step in the future.

[MikeMcC399]

@mschile

I believe the dist/849.index.js file can be deleted. We'll probably want to add clearing the dist directory in the build step in the future.

Thanks for noticing! I've removed the stale file. Unfortunately, ncc does not clear the output directory dist and doesn't offer any option to do this. I'll follow up with a PR to make sure the directory gets cleaned.

• Edit: see chore: clean dist directory before (re-)build #1945