Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 4 · patch: 7) [package.json] #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gh-worker-campaigns-3e9aa4 wants to merge 2 commits into
base: main
Choose a base branch
from
+10,713 −2,698
Open

fix(deps): vuln minor upgrades — 11 packages (minor: 4 · patch: 7) [package.json] #301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
63dd9fa
ADMS: vuln minor upgrades — 11 packages (minor: 4 · patch: 7) [packag…
gh-worker-campaigns-3e9aa4[bot] Oct 5, 2026
d812b5c
fix: remediate vulnerable dependencies in the action bundle
simaoseica-dd Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# Dependency directory
node_modules
!dist/node_modules/
!dist/node_modules/**

# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
# Logs
Expand Down Expand Up @@ -97,4 +99,4 @@ Thumbs.db

# Ignore built ts files
__tests__/runner/*
lib/**/*
lib/**/*
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,3 +45,11 @@ jobs:
|`site`|string|optional|Datadog site region. Defaults to `datadoghq.com`; use `datadoghq.eu` for the EU.|
|`dsym_paths`|list|required|List of dSYM files path to upload. Supports paths to folders and/or to zip files.|
|`dry_run`|Boolean|optional|If `true`, the command runs without the final upload step. All other checks are performed.|

## Building

Run `yarn install`, `yarn build`, and `yarn package` after updating dependencies, and commit `yarn.lock` and all generated files under `dist/`.

The packaging step builds `glob` separately from its unbundled entry point (`glob/raw`). Its default minified entry point embeds dependencies that Yarn resolutions cannot update. The separate bundle at `dist/node_modules/glob/` uses the versions from our lockfile and must ship with the action.

The `socks` resolution and the coverage-config loader's `js-yaml` resolution remove both dependency paths to the unpatched `sprintf-js` package. Keep these resolutions until the parent packages require the updated dependencies themselves.
Loading
Loading