Skip to content

Commit

Permalink
[Aikido] Fix security issue in undici via major version upgrade from …
Browse files Browse the repository at this point in the history
…5.28.4 to 6.15.0 (#36)

This PR will resolve the following CVEs:
| CVE ID | Severity | Description |
| --- | --- | --- |
|
<pre>[AIKIDO-2024-10065](https://app.aikido.dev/issues/3744841/detail?groupId=324#AIKIDO-2024-10065)</pre>
| <pre>MEDIUM</pre> | Affected versions of the `undici` library are
vulnerable to memory leaks. By making multiple fetch requests with the
same `AbortSignal`, undici adds event listeners without removing them,
leading to excessive memory consumption. |

## Summary by Sourcery

Bug Fixes:
- Fix memory leaks when making multiple fetch requests with the same
`AbortSignal` in `undici`.

Co-authored-by: aikido-autofix[bot] <119856028+aikido-autofix[bot]@users.noreply.github.com>
  • Loading branch information
aikido-autofix[bot] authored Jan 16, 2025
1 parent c477333 commit d4e7ac4
Show file tree
Hide file tree
Showing 2 changed files with 31 additions and 21 deletions.
19 changes: 4 additions & 15 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

33 changes: 27 additions & 6 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,11 @@
"bugs": {
"url": "https://github.com/actions/typescript-action/issues"
},
"keywords": ["actions", "node", "setup"],
"keywords": [
"actions",
"node",
"setup"
],
"exports": {
".": "./dist/index.js"
},
Expand All @@ -37,15 +41,29 @@
"verbose": true,
"clearMocks": true,
"testEnvironment": "node",
"moduleFileExtensions": ["js", "ts"],
"testMatch": ["**/*.test.ts"],
"testPathIgnorePatterns": ["/node_modules/", "/dist/"],
"moduleFileExtensions": [
"js",
"ts"
],
"testMatch": [
"**/*.test.ts"
],
"testPathIgnorePatterns": [
"/node_modules/",
"/dist/"
],
"transform": {
"^.+\\.ts$": "ts-jest"
},
"coverageReporters": ["json-summary", "text", "lcov"],
"coverageReporters": [
"json-summary",
"text",
"lcov"
],
"collectCoverage": true,
"collectCoverageFrom": ["./src/**"]
"collectCoverageFrom": [
"./src/**"
]
},
"dependencies": {
"@actions/core": "^1.11.1"
Expand All @@ -63,5 +81,8 @@
"ts-jest": "^29.2.5",
"typescript": "^5.7.3",
"ultracite": "^4.1.15"
},
"overrides": {
"undici@<=6.15.0": "6.15.0"
}
}

0 comments on commit d4e7ac4

Please sign in to comment.