fix: resolve audit/license failures (#784)

mirror of https://github.com/actions/setup-go.git synced 2026-08-20 06:00:40 +02:00

* fix: resolve brace-expansion high-severity vulnerability, refresh license cache, rebuild dist

- Regenerated package-lock.json to pick up brace-expansion@5.0.9 (fixes
  GHSA-rgw5-rvv9-x895, a DoS via unbounded intermediate arrays), which
  is already permitted by minimatch's existing ^5.0.8 semver range.
- Refreshed .licenses/npm cache to match the updated dependency tree.
- Added minimatch to the licensed.yml reviewed list: its detected
  license text doesn't cleanly match Blue Oak 1.0.0, which is already
  in the allowed list.
- Rebuilt dist/setup and dist/cache-save from source.

npm audit --audit-level=high now reports 0 vulnerabilities;
licensed status reports 0 errors; npm run pre-checkin passes locally.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: narrow audit dependency updates

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This commit is contained in:

Haritha

2026-08-19 10:06:05 -05:00

committed by

GitHub

co-authored by

Copilot

parent 5064d95ba1

commit fba3fb4ead

6 changed files with 825 additions and 205 deletions

									
										.licenses/npm/undici.dep.yml
									
Generated

		+1
		-1
	
												View File
												
				@@ -1,6 +1,6 @@

				---

				name: undici

				version: 6.27.0

				version: 6.28.0

				type: npm

				summary: An HTTP/1.1 client, written from scratch for Node.js

				homepage: https://undici.nodejs.org