Skip to content

[Snyk] Upgrade actions-toolkit from 1.6.0 to 1.10.0#1

Open
snyk-bot wants to merge 1 commit intomasterfrom
snyk-upgrade-018b5697f9f91c7bd292ccf2a2a66d87
Open

[Snyk] Upgrade actions-toolkit from 1.6.0 to 1.10.0#1
snyk-bot wants to merge 1 commit intomasterfrom
snyk-upgrade-018b5697f9f91c7bd292ccf2a2a66d87

Conversation

@snyk-bot
Copy link
Copy Markdown

@snyk-bot snyk-bot commented Sep 6, 2021

Snyk has created this PR to upgrade actions-toolkit from 1.6.0 to 1.10.0.

merge advice
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 6 versions ahead of your current version.
  • The recommended version was released 2 years ago, on 2019-03-31.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Arbitrary Code Execution
SNYK-JS-JSYAML-174129
405/1000
Why? CVSS 8.1
No Known Exploit
Denial of Service
SNYK-JS-NODEFETCH-674311
405/1000
Why? CVSS 8.1
No Known Exploit
Prototype Pollution
SNYK-JS-MINIMIST-559764
405/1000
Why? CVSS 8.1
Proof of Concept
Prototype Pollution
SNYK-JS-MINIMIST-559764
405/1000
Why? CVSS 8.1
Proof of Concept
Denial of Service (DoS)
SNYK-JS-JSYAML-173999
405/1000
Why? CVSS 8.1
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: actions-toolkit
  • 1.10.0 - 2019-03-31

    Testing!

    This release improves the CLI scaffold template with a new file: index.test.js. It outlines a pattern for testing GItHub Actions with actions-toolkit, leveraging Toolkit.run. Try it out with:

    npx actions-toolkit <folder>
    

    I'll be sharing some docs on this soon!

    What’s Changed

  • 1.9.1 - 2019-03-29

    What’s Changed

  • 1.9.0 - 2019-03-27

    New feature

    This release introduces the secrets option. If present, the Action will exit and fail if required secrets have not been set. Here's an example:

    action "My action" {
      uses = "JasonEtco/secrets@master"
      secrets = ["API_KEY"]
    }
    // This will fail because `API_SECRET` wasn't passed!
    new Toolkit({ secrets: ['API_KEY', 'API_SECRET'] })

    Check out #66 for all the details ✨

    What’s Changed

  • 1.8.1 - 2019-03-27

    What’s Changed

  • 1.8.0 - 2019-03-27

    New feature

    In #63, @ jclem added a new static method to the Toolkit class: #run. It takes a function argument and runs that function, as a way of enabling easier async/await patterns and modularity. Check it out!

    const { Toolkit } = require('actions-toolkit')

    Toolkit.run(async tools => {
    tools.log.success('We did it team!')
    })

    What’s Changed

  • 1.7.0 - 2019-03-23

    Enhanced CLI

    This release introduces a wonderfully enhanced CLI tool for creating a new GitHub Action, courtesy of @ macklinu. Check out #57 for the full details ✨ You can run it through npx:

    npx actions-toolkit my-action
    

    What’s Changed

  • 1.6.0 - 2019-03-16

    New feature

    This release introduces Toolkit#command, a new method that will run the provided function when a matching slash-command is found. From the README:

    Respond to a slash-command posted in a GitHub issue, comment, pull request, pull request review or commit comment. Arguments to the slash command are parsed by minimist. You can use a slash command in a larger comment, but the command must be at the start of the line:

    Hey, let's deploy this!
    /deploy --app example --container node:alpine
    
    tools.command('deploy', async (args: ParsedArgs, match: RegExpExecArray) => {
      console.log(args)
      // -> { app: 'example', container: 'node:alpine' }
    })

    What’s Changed

from actions-toolkit GitHub release notes
Commit messages
Package name: actions-toolkit
  • c727adb 1.10.0
  • 5ed87f0 Merge pull request #73 from JasonEtco/testing-setup
  • 8f8c3ec Need to actually require our entrypoint
  • cc40024 Add npm scripts
  • 28a29fb Add index.test.js to README
  • c5317c7 Add index.test.js file
  • 39c8f45 Update template again
  • afe1171 Update snapshots, include Jest in package.json
  • 799eacf Improve the index.js file
  • 10f060e Rename the entrypoint to index.js
  • 1d9343a Merge pull request #72 from JasonEtco/fix-publish-workflow
  • 5c5b437 Hopefully fix the publish action for realsies
  • 428bacf Remove prepare script
  • 5340f4f Correct publish action's tag file path
  • d497ce1 1.9.1
  • f22f54d Merge pull request #71 from JasonEtco/dont-warn-optional-env-vars
  • ec23cfc Merge branch 'master' into dont-warn-optional-env-vars
  • a13e036 Merge pull request #69 from JasonEtco/fix-log-disable
  • 4f6302f Remove GITHUB_REF and GITHUB_TOKEN from required env vars
  • d9d8290 Improve types
  • 1bd0fc3 More methods to type
  • 267f2b6 Update Signale and @ types/signale
  • 85a8817 Add comments, prefer `logger` as prototype
  • e215b28 Object.setPrototypeOf is black magic

Compare


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant