Cursor Agent
e872393561
fix(deps): scope glob resolution to avoid breaking jest coverage
...
The global glob@^10.5.0 resolution forced glob v10 for all consumers,
including test-exclude (used by babel-plugin-istanbul), which expects the
glob v7 function API. CI runs tests with --coverage, causing:
TypeError: The "original" argument must be of type function
Scope the resolution to archiver-utils only so Jest coverage works.
Co-authored-by: Greg Nazario <greg@gnazar.io>
2026-06-17 14:39:28 +00:00
Cursor Agent
1ae1226a47
build(deps): update dependencies to address security audit issues
...
- Bump @docker/actions-toolkit from 0.39.0 to 0.69.0
- Bump js-yaml from 4.1.0 to 4.2.0
- Add yarn resolutions to pin patched transitive dependencies
- Rebuild dist bundle with updated dependencies
Co-authored-by: Greg Nazario <greg@gnazar.io>
2026-06-17 14:30:23 +00:00
Andrea Cappa (zi0Black)
d85b0a76d2
Merge pull request #1 from aptos-labs/fix/ci-security-hardening
...
ci: harden GitHub Actions workflows (zizmor audit)
2026-05-14 01:03:37 +02:00
zi0Black
265af8a183
ci: harden GitHub Actions workflows (zizmor audit)
...
- Pin all unpinned action refs to immutable commit SHAs (tag
immutability verified via GitHub rulesets API for each repo;
all returned false/empty so SHA pinning applied)
- Add top-level `permissions: contents: read` to ci.yml, test.yml,
and validate.yml (publish.yml already had per-job permissions)
- Add `persist-credentials: false` to all actions/checkout steps
to prevent credential leakage through GitHub Actions artifacts
Findings addressed: unpinned-uses (40 errors), excessive-permissions
(27 warnings), artipacked (26 warnings) — 93 findings total
Actions pinned:
actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5
actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978
docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130
docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8
docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d
docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad
crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8
codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
crazy-max/.github install-k3s -> already SHA-pinned (skipped)
2026-05-14 00:34:57 +02:00
CrazyMax
0f069ddc17
Merge pull request #372 from crazy-max/publish-immutable-action
...
ci: publish as immutable action workflow
2024-10-26 00:40:56 +02:00
CrazyMax
d036b3238c
ci: publish as immutable action workflow
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-25 13:22:55 +02:00
CrazyMax
460e45646d
Merge pull request #370 from docker/dependabot/npm_and_yarn/actions/core-1.11.1
...
build(deps): bump @actions/core from 1.10.1 to 1.11.1
2024-10-07 14:19:44 +02:00
CrazyMax
93aa1c807f
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-07 14:17:38 +02:00
CrazyMax
d391aad55c
remove uuid package and switch to crypto
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-07 14:16:41 +02:00
dependabot[bot]
e5b688ea46
build(deps): bump @actions/core from 1.10.1 to 1.11.1
...
Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core ) from 1.10.1 to 1.11.1.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md )
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core )
---
updated-dependencies:
- dependency-name: "@actions/core"
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-10-07 04:49:55 +00:00
CrazyMax
c47758b77c
Merge pull request #369 from crazy-max/revert-crypto
...
switch back to uuid package
2024-10-04 09:42:48 +02:00
CrazyMax
8fea382513
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-04 09:35:26 +02:00
CrazyMax
2874e980e8
switch back to uuid package
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-04 09:34:00 +02:00
CrazyMax
8026d2bc36
Merge pull request #362 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.39.0
...
build(deps): bump @docker/actions-toolkit from 0.35.0 to 0.39.0
2024-10-03 09:29:53 +02:00
CrazyMax
e51aab53e9
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-03 09:23:32 +02:00
dependabot[bot]
fd7390e14d
build(deps): bump @docker/actions-toolkit from 0.35.0 to 0.39.0
...
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit ) from 0.35.0 to 0.39.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases )
- [Commits](https://github.com/docker/actions-toolkit/compare/v0.35.0...v0.39.0 )
---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-10-03 07:19:28 +00:00
CrazyMax
910a304005
Merge pull request #366 from crazy-max/remove-uuid
...
remove uuid package and switch to crypto
2024-10-03 09:18:07 +02:00
CrazyMax
3623ee443e
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-03 09:16:05 +02:00
CrazyMax
e0e5ecf670
remove uuid package and switch to crypto
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-03 09:15:20 +02:00
CrazyMax
5334dd0cdd
Merge pull request #363 from crazy-max/set-buildkitd-flags-optin
...
always set buildkitd-flags if opt-in
2024-10-03 09:14:50 +02:00
CrazyMax
214bb6dac1
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-03 08:54:56 +02:00
CrazyMax
818c69a4ea
always set buildkitd-flags if opt-in
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-10-03 08:54:55 +02:00
CrazyMax
b467d6aa7a
Merge pull request #354 from docker/dependabot/npm_and_yarn/path-to-regexp-6.3.0
...
build(deps): bump path-to-regexp from 6.2.2 to 6.3.0
2024-09-12 22:41:49 +02:00
dependabot[bot]
7594cf3831
build(deps): bump path-to-regexp from 6.2.2 to 6.3.0
...
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp ) from 6.2.2 to 6.3.0.
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases )
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md )
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v6.2.2...v6.3.0 )
---
updated-dependencies:
- dependency-name: path-to-regexp
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-09-12 19:22:52 +00:00
CrazyMax
988b5a0280
Merge pull request #347 from crazy-max/skip-malformed-context
...
check for malformed docker context
2024-07-29 18:29:31 +02:00
CrazyMax
2c215620b8
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-29 18:25:27 +02:00
CrazyMax
3382292cd5
check for malformed docker context
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-29 18:24:18 +02:00
CrazyMax
3d68780484
Merge pull request #341 from crazy-max/docker-context-tls
...
create docker context if default one has TLS data loaded
2024-07-29 15:34:28 +02:00
CrazyMax
d069e98648
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-29 15:16:07 +02:00
CrazyMax
8b850f86dc
create docker context if default one has TLS data loaded
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-29 15:12:05 +02:00
CrazyMax
aa33708b10
Merge pull request #345 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.35.0
...
build(deps): bump @docker/actions-toolkit from 0.34.0 to 0.35.0
2024-07-22 11:48:29 +02:00
CrazyMax
2d99e3412d
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-22 11:45:40 +02:00
dependabot[bot]
4dab43650b
build(deps): bump @docker/actions-toolkit from 0.34.0 to 0.35.0
...
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit ) from 0.34.0 to 0.35.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases )
- [Commits](https://github.com/docker/actions-toolkit/compare/v0.34.0...v0.35.0 )
---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-07-22 04:47:18 +00:00
CrazyMax
49a04d6890
Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.34.0
...
build(deps): bump @docker/actions-toolkit from 0.32.0 to 0.34.0
2024-07-19 13:09:43 +02:00
CrazyMax
a6ade2e34f
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-19 13:07:08 +02:00
CrazyMax
2f2694b8d1
switch to Docker exec
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-19 13:05:34 +02:00
dependabot[bot]
0a4bab6632
build(deps): bump @docker/actions-toolkit from 0.32.0 to 0.34.0
...
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit ) from 0.32.0 to 0.34.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases )
- [Commits](https://github.com/docker/actions-toolkit/compare/v0.32.0...v0.34.0 )
---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-07-18 04:06:15 +00:00
CrazyMax
2ad185228a
Merge pull request #340 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.32.0
...
build(deps): bump @docker/actions-toolkit from 0.31.0 to 0.32.0
2024-07-05 11:38:19 +02:00
CrazyMax
560ac469d6
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-05 11:35:45 +02:00
dependabot[bot]
b3a341759e
build(deps): bump @docker/actions-toolkit from 0.31.0 to 0.32.0
...
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit ) from 0.31.0 to 0.32.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases )
- [Commits](https://github.com/docker/actions-toolkit/compare/v0.31.0...v0.32.0 )
---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-07-05 09:33:37 +00:00
CrazyMax
4fd812986e
Merge pull request #312 from docker/dependabot/npm_and_yarn/undici-5.28.4
...
build(deps): bump undici from 5.28.3 to 5.28.4
2024-07-04 00:59:46 +02:00
CrazyMax
3386dc4251
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-04 00:57:40 +02:00
dependabot[bot]
d191aef416
build(deps): bump undici from 5.28.3 to 5.28.4
...
Bumps [undici](https://github.com/nodejs/undici ) from 5.28.3 to 5.28.4.
- [Release notes](https://github.com/nodejs/undici/releases )
- [Commits](https://github.com/nodejs/undici/compare/v5.28.3...v5.28.4 )
---
updated-dependencies:
- dependency-name: undici
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-07-03 22:39:48 +00:00
CrazyMax
f686054aab
Merge pull request #338 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.31.0
...
build(deps): bump @docker/actions-toolkit from 0.23.0 to 0.31.0
2024-07-04 00:36:59 +02:00
CrazyMax
78547859d7
chore: update generated content
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-04 00:28:28 +02:00
CrazyMax
830928c706
fix builder type path
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-04 00:28:27 +02:00
dependabot[bot]
26d2aec173
build(deps): bump @docker/actions-toolkit from 0.23.0 to 0.31.0
...
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit ) from 0.23.0 to 0.31.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases )
- [Commits](https://github.com/docker/actions-toolkit/compare/v0.23.0...v0.31.0 )
---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2024-07-03 18:22:10 +00:00
CrazyMax
ab17e3ec80
Merge pull request #339 from crazy-max/missing-types-jsyaml
...
missing types for js-yaml
2024-07-03 20:21:11 +02:00
CrazyMax
d79cb80903
missing types for js-yaml
...
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2024-07-03 20:17:56 +02:00
CrazyMax
13cf78894f
Merge pull request #326 from docker/dependabot/npm_and_yarn/uuid-10.0.0
...
build(deps): bump uuid from 9.0.1 to 10.0.0
2024-07-03 13:50:25 +02:00
