Pin Third-Party Actions to Immutable Commit SHAs and Eliminate Workflow Expression Injection - #5
Merged
Annotations
7 errors and 3 warnings
|
Run npm test:
packages/build/Cargo.lock#L1
serde@1.0.213 was published 2 day(s) ago (2026-08-25), less than the required 30 day cooldown. Wait 28 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test:
bun.lock#L1
tslib@2.8.1 was published 2 day(s) ago (2026-08-25), less than the required 30 day cooldown. Wait 28 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test:
engine/Cargo.lock#L1
serde@1.0.213 was published 2 day(s) ago (2026-08-25), less than the required 30 day cooldown. Wait 28 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test:
package-lock.json#L1
nested-dep@2.0.0 was published 2430 day(s) ago (2020-01-01), less than the required 3650 day cooldown. Wait 1220 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test:
package-lock.json#L1
tiny-invariant@1.3.4 was published 2430 day(s) ago (2020-01-01), less than the required 3650 day cooldown. Wait 1220 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test:
Cargo.lock#L1
once_cell@1.20.2 was published 2 day(s) ago (2026-08-25), less than the required 30 day cooldown. Wait 28 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test:
package-lock.json#L1
tiny-invariant@1.3.4 was published 2 day(s) ago (2026-08-25), less than the required 30 day cooldown. Wait 28 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test:
package-lock.json#L1
tiny-invariant@1.3.4 was published 2 day(s) ago (2026-08-25), less than the required 30 day cooldown. Wait 28 more day(s), pick an older version, or request an emergency bypass.
|
|
Run npm test
Dependency cooldown bypassed for 1 version(s) via the "dependency-cooldown-bypass" label. Reason: CVE-2026-1234 lets an attacker run code in prod
|
|
Run npm test:
package-lock.json#L1
tiny-invariant@1.3.4 was published 2 day(s) ago (2026-08-25), less than the required 30 day cooldown. Wait 28 more day(s), pick an older version, or request an emergency bypass.
|
background
wait
wait-all
cancel
parallel
Loading