mirror of
https://code.forgejo.org/actions/setup-go.git
synced 2026-08-27 20:44:57 -04:00
13eb0cbdd4
- Regenerated package-lock.json to pick up brace-expansion@5.0.9 (fixes GHSA-rgw5-rvv9-x895, a DoS via unbounded intermediate arrays), which is already permitted by minimatch's existing ^5.0.8 semver range. - Refreshed .licenses/npm cache to match the updated dependency tree. - Added minimatch to the licensed.yml reviewed list: its detected license text doesn't cleanly match Blue Oak 1.0.0, which is already in the allowed list. - Rebuilt dist/setup and dist/cache-save from source. npm audit --audit-level=high now reports 0 vulnerabilities; licensed status reports 0 errors; npm run pre-checkin passes locally. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
20 lines
No EOL
264 B
YAML
20 lines
No EOL
264 B
YAML
sources:
|
|
npm: true
|
|
|
|
allowed:
|
|
- apache-2.0
|
|
- bsd-2-clause
|
|
- bsd-3-clause
|
|
- isc
|
|
- mit
|
|
- cc0-1.0
|
|
- unlicense
|
|
- 0bsd
|
|
- blueoak-1.0.0
|
|
|
|
reviewed:
|
|
npm:
|
|
- "@actions/http-client"
|
|
- "balanced-match"
|
|
- "brace-expansion"
|
|
- "minimatch" |