This repository was archived by the owner on Apr 7, 2026. It is now read-only.
Upgrade GitHub Actions to address CVE-2024-42471#117
Merged
Conversation
Upgrade actions/download-artifact from v2 to v4 to fix zip-slip arbitrary file write vulnerability (GHSA-cxww-7g56-2vh6). Also upgrades all other outdated actions (checkout, setup-node, upload-artifact, docker actions) to current major versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Member
|
@initharrington I believe this is not maintained anymore, and I removed it from the Sauce docs some weeks ago. I think we can archive this repository. What do you think? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrade GitHub Actions to address CVE-2024-42471
One-line summary
Upgrade all GitHub Actions to current major versions to fix a known zip-slip vulnerability in
actions/download-artifact@v2.Description
The
actions/download-artifact@v2action used innpm-publish.ymlis vulnerable to an arbitrary file write via path traversal during artifact extraction (CVE-2024-42471, GHSA-cxww-7g56-2vh6). This PR upgrades it to v4, which includes proper path sanitization. All other outdated actions across the three workflow files are also upgraded to their current major versions to stay on supported releases.actions/checkoutactions/setup-nodeactions/upload-artifactactions/download-artifactdocker/setup-buildx-actiondocker/login-actiondocker/build-push-actionTypes of Changes
Tasks
actions/download-artifactv2 → v4 (CVE-2024-42471)actions/upload-artifactv2 → v4actions/checkoutv2 → v4actions/setup-nodev1 → v4Review
Deployment Notes
No migrations or feature toggles. These are CI-only changes. The
npm-publish.ymlworkflow isworkflow_dispatchonly, so it will need a manual trigger to verify. Thetest.ymlworkflow will run automatically on the next push/PR.