GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: resolve Basic Validation audit failures (brace-expansion, fast-xml-parser) by v-HarithaVattikuti · Pull Request #1347 · actions/setup-python

Conversation

@v-HarithaVattikuti

@v-HarithaVattikuti v-HarithaVattikuti commented Jul 28, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Summary

Fixes the npm audit --audit-level=high failure in basic-validation.yml

Changes

  • Upgraded fast-xml-parser to 5.10.1, fixing GHSA-8r6m-32jq-jx6q
  • Added a package.json overrides entry to pin transitive brace-expansion to ^5.0.8, fixing GHSA-mh99-v99m-4gvg in nested deps of @actions/cache, glob, and test-exclude — without the breaking ts-jest@27 downgrade that npm audit fix --force would otherwise pull in
  • Refreshed .licenses/npm/* cache to match the updated dependency tree
  • Rebuilt dist/setup/index.js and dist/cache-save/index.js

Validation

  • npm audit --audit-level=high → 0 vulnerabilities
  • licensed status → 48 dependencies checked, 0 errors
  • npm run format-check → pass
  • npm run lint → pass
  • npm run build → pass
  • npm test → 69/69 tests pass (7 pre-existing, unrelated test-suite failures due to a jest/ESM teardown issue reproduced identically on unmodified main with Node 24 — out of scope for this fix)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@v-HarithaVattikuti
fix: resolve npm audit high severity vulnerabilities
0c8be20 
- Upgrade fast-xml-parser to 5.10.1 (fixes GHSA-8r6m-32jq-jx6q)
- Add package.json override to force brace-expansion >=5.0.8 across
  all transitive dependencies (fixes GHSA-mh99-v99m-4gvg) without
  downgrading jest/ts-jest
- Refresh .licenses/npm cache to match updated dependency tree
- Rebuild dist/setup and dist/cache-save

npm audit now reports 0 vulnerabilities. Pre-existing test suite
failures (7 suites, ESM/jest teardown issue) verified unrelated to
this change - identical on unmodified main with node 24.

Co-authored-by: Copilot <[email protected]>
Copilot AI review requested due to automatic review settings July 28, 2026 20:10
@v-HarithaVattikuti
v-HarithaVattikuti requested a review from a team as a code owner July 28, 2026 20:10
Copilot started reviewing on behalf of v-HarithaVattikuti July 28, 2026 20:10
View session
Copilot AI reviewed Jul 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses npm audit --audit-level=high failures in the basic-validation.yml workflow by updating direct and transitive Node dependencies, and then refreshing generated artifacts (lockfile, bundled dist/ outputs, and .licenses cache) to match the new dependency graph.

Changes:

  • Add an npm overrides rule to force patched brace-expansion versions for transitive dependencies.
  • Upgrade fast-xml-parser (and its dependency tree) to versions that remediate the referenced security advisory.
  • Regenerate package-lock.json, dist/* bundles, and .licenses/npm/* entries to align with updated dependencies.

Reviewed changes

Copilot reviewed 10 out of 15 changed files in this pull request and generated no comments.

Show a summary per file
File Description
package.json Adds overrides to ensure patched brace-expansion is used in the dependency tree.
package-lock.json Updates resolved dependency versions (notably brace-expansion and fast-xml-parser) and removes older nested vulnerable copies.
dist/setup/index.js Rebuilt bundled output to incorporate updated dependencies and their security fixes.
dist/cache-save/index.js Rebuilt bundled output to incorporate updated dependencies and their security fixes.
.licenses/npm/xml-naming-0.3.0.dep.yml Adds license metadata for newly introduced [email protected].
.licenses/npm/xml-naming-0.1.0.dep.yml Normalizes metadata formatting to match the refreshed license cache.
.licenses/npm/path-expression-matcher.dep.yml Updates recorded version to match the new dependency tree.
.licenses/npm/is-unsafe.dep.yml Updates recorded version to match the new dependency tree.
.licenses/npm/fast-xml-parser.dep.yml Updates recorded version to match the new dependency tree.
.licenses/npm/concat-map.dep.yml Removes license metadata for a dependency no longer present in the tree.
.licenses/npm/brace-expansion.dep.yml Updates recorded version to match the new dependency tree.
.licenses/npm/brace-expansion-1.1.15.dep.yml Removes license metadata for a dependency no longer present in the tree.
.licenses/npm/balanced-match.dep.yml Adds license metadata for the updated balanced-match version in the tree.
.licenses/npm/balanced-match-1.0.2.dep.yml Removes license metadata for a dependency no longer present in the tree.
.licenses/npm/@nodable/entities.dep.yml Updates recorded version to match the new dependency tree.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
v-priya-kinthali
v-priya-kinthali approved these changes Jul 30, 2026
View reviewed changes
v-priyagupta108
v-priyagupta108 approved these changes Jul 30, 2026
View reviewed changes
@v-HarithaVattikuti
v-HarithaVattikuti merged commit 8549b9f into actions:main Aug 3, 2026
1015 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@take-i-osk take-i-osk mentioned this pull request Oct 18, 2026
chore(deps): update github-actions (major) kpool09122/kpool-backend#733
Merged
1 task
luketainton pushed a commit to luketainton/actions_gha-workflows that referenced this pull request Oct 24, 2026
renovate[bot] @luketainton
chore(deps): update actions/setup-python action to v7.1.0 (#132)
3dd8454 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/setup-python](https://github.com/actions/setup-python) | action | minor | `v7.0.0` → `v7.1.0` |

---

### Release Notes

<details>
<summary>actions/setup-python</summary>

### [`v7.1.0`](https://github.com/actions/setup-python/releases/tag/v7.1.0)

[Compare Source](actions/setup-python@v7.0.0...v7.1.0)

##### What's Changed

##### Enhancements

- Add `mirror` and `mirror-token` inputs for custom Python distribution sources by [@&#8203;luhenry](https://github.com/luhenry) in [#&#8203;1302](actions/setup-python#1302)
- Improve error message clarity by [@&#8203;v-lmvysakh](https://github.com/v-lmvysakh) in [#&#8203;1351](actions/setup-python#1351)

##### Dependency Upgrade

- Upgrade browserslist from 4.28.2 to 4.28.9 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1353](actions/setup-python#1353)
- Upgrade [@&#8203;typescript-eslint/parser](https://github.com/typescript-eslint/parser) from 8.62.0 to 8.70.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1343](actions/setup-python#1343)
- Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1342](actions/setup-python#1342)
- Upgrade [@&#8203;vercel/ncc](https://github.com/vercel/ncc) from 0.44.0 to 0.45.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1357](actions/setup-python#1357)
- Upgrade [@&#8203;types/semver](https://github.com/types/semver) from 7.7.1 to 7.8.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1359](actions/setup-python#1359)
- Upgrade undici from 6.28.0 to 6.29.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1364](actions/setup-python#1364)
- Upgrade ts-jest from 29.4.11 to 29.4.14 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1361](actions/setup-python#1361)
- Upgrade brace-expansion from 5.0.9 to 5.0.12 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1365](actions/setup-python#1365)
- Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1363](actions/setup-python#1363)
- Upgrade [@&#8203;typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/eslint-plugin) from 8.62.0 to 8.71.1 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1369](actions/setup-python#1369)
- Upgrade actions/checkout from 7.0.0 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1345](actions/setup-python#1345)
- Upgrade cache to 6.3.0 by [@&#8203;v-HarithaVattikuti](https://github.com/v-HarithaVattikuti) in [#&#8203;1370](actions/setup-python#1370)
- Resolve Basic Validation audit failures by [@&#8203;v-HarithaVattikuti](https://github.com/v-HarithaVattikuti) in [#&#8203;1347](actions/setup-python#1347)
- Resolve npm audit failures by [@&#8203;v-HarithaVattikuti](https://github.com/v-HarithaVattikuti) in [#&#8203;1350](actions/setup-python#1350)

##### New Contributors

- [@&#8203;luhenry](https://github.com/luhenry) made their first contribution in [#&#8203;1302](actions/setup-python#1302)

**Full Changelog**: <actions/setup-python@v7.0.0...v7.1.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjAuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL2RlcGVuZGVuY2llcyJdfQ==-->

Reviewed-on: https://git.tainton.uk/actions/gha-workflows/pulls/132
Reviewed-by: Luke Tainton <[email protected]>
Co-authored-by: renovate[bot] <[email protected]>
@robhanlon22 robhanlon22 mentioned this pull request Nov 2, 2026
Implement lean, dependency-free CLJC Sqids sqids/sqids-clojure#10
Open
rljacob added a commit to E3SM-Project/E3SM-Project.github.io that referenced this pull request Nov 9, 2026
@rljacob
Bump actions/setup-python from 7.0.0 to 7.1.0 (#37)
4b8776b 
Enhancements

Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in actions/setup-python#1302
Improve error message clarity by @​v-lmvysakh in actions/setup-python#1351

Dependency Upgrade
Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in actions/setup-python#1353
Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-python#1343
Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-python#1342
Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-python#1357
Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-python#1359
Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in actions/setup-python#1364
Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in actions/setup-python#1361
Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in actions/setup-python#1365
Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-python#1363
Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in actions/setup-python#1369
Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-python#1345
Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in actions/setup-python#1370
Resolve Basic Validation audit failures by @​v-HarithaVattikuti in actions/setup-python#1347
Resolve npm audit failures by @​v-HarithaVattikuti in actions/setup-python#1350
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@v-priya-kinthali v-priya-kinthali v-priya-kinthali approved these changes
@v-priyagupta108 v-priyagupta108 v-priyagupta108 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@v-HarithaVattikuti @v-priya-kinthali @v-priyagupta108
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.