GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Bundle includes apache-arrow code generation (new Function) since v4.38.3 · Issue #4252 · github/codeql-action

Bundle includes apache-arrow code generation (new Function) since v4.38.3 #4252

New issue
Copy link
New issue
Copy link
Open
Open
Bundle includes apache-arrow code generation (new Function) since v4.38.3#4252
Copy link

Description

@p-linnane
p-linnane
opened on Oct 16, 2026
Issue body actions

Since v4.38.3, lib/entry-points.js includes apache-arrow's createIsValidFunction, which builds a predicate with new Function from runtime values. It comes in through @azure/storage-blob 12.34.0 (via @actions/artifact and @actions/cache), which lazily imports apache-arrow for its Arrow blob-list parser. v4.38.2 didn't include it; v4.39.0 still does.

Static analysis can't verify the generated function, so supply-chain auditing tools treat these releases as unverifiable. As far as I can tell nothing in the action lists blobs, so the parser is unreachable. The upstream fix is apache/arrow-js#501.

Would you consider excluding apache-arrow from the bundle in build.mjs, or overriding to the fixed apache-arrow once it's released?

Activity

  1. jketema commented on Oct 19, 2026

    @jketema
    jketema
    on Oct 19, 2026
    More actions

    Hi @p-linnane,

    Thanks for your report. You might also want to flag this up at https://github.com/Azure/azure-sdk-for-js, as we're probably not the only action with this problem.

  2. jketema commented on Oct 19, 2026

    @jketema
    jketema
    on Oct 19, 2026
    More actions

    We had some internal discussion about this, and our bundler should already exclude unreachable code. So if the code is still there, then either there is an actual dependency, or this is some shortcoming in the bundler.

    Irrespective of this and for unrelated reasons, we're currently looking at downgrading to earlier versions of @actions/artifact and @actions/cache, which should also resolve the problem you're observing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.