Skip to content

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fix: Resolve critical crypto vulnerabilities (CVE-2025-9288, CVE-2025-9287) #1534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
583cfc4
fix: update sha.js to 2.4.12 to fix critical hash vulnerability (CVE…
Naq302 Sep 5, 2025
932bc4e
Also changed to cipher-base@^1.0.5
Naq302 Sep 5, 2025
cd3fa94
Pinned versions
Naq302 Sep 5, 2025
9eef0d4
Pinned versions
Naq302 Sep 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,9 @@
"word-wrap": "1.2.4",
"undici": "5.29.0",
"form-data": "4.0.4",
"elliptic": "^6.6.1"
"elliptic": "^6.6.1",
"sha.js": "2.4.12",
"cipher-base": "1.0.6"
},
"devDependencies": {
"@actions/core": "1.10.0",
Expand Down
40 changes: 26 additions & 14 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5782,13 +5782,13 @@ __metadata:
languageName: node
linkType: hard

"cipher-base@npm:^1.0.1, cipher-base@npm:^1.0.3":
version: 1.0.4
resolution: "cipher-base@npm:1.0.4"
"cipher-base@npm:1.0.6":
version: 1.0.6
resolution: "cipher-base@npm:1.0.6"
dependencies:
inherits: "npm:^2.0.1"
safe-buffer: "npm:^5.0.1"
checksum: 10c0/d8d005f8b64d8a77b3d3ce531301ae7b45902c9cab4ec8b66bdbd2bf2a1d9fceb9a2133c293eb3c060b2d964da0f14c47fb740366081338aa3795dd1faa8984b
inherits: "npm:^2.0.4"
safe-buffer: "npm:^5.2.1"
checksum: 10c0/f73268e0ee6585800875d9748f2a2377ae7c2c3375cba346f75598ac6f6bc3a25dec56e984a168ced1a862529ffffe615363f750c40349039d96bd30fba0fca8
languageName: node
linkType: hard

Expand Down Expand Up @@ -11472,7 +11472,7 @@ __metadata:
languageName: node
linkType: hard

"safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:~5.2.0":
"safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
version: 5.2.1
resolution: "safe-buffer@npm:5.2.1"
checksum: 10c0/6501914237c0a86e9675d4e51d89ca3c21ffd6a31642efeba25ad65720bce6921c9e7e974e5be91a786b25aa058b5303285d3c15dbabf983a919f5f630d349f3
Expand Down Expand Up @@ -11610,15 +11610,16 @@ __metadata:
languageName: node
linkType: hard

"sha.js@npm:2, sha.js@npm:^2.4.0, sha.js@npm:^2.4.8":
version: 2.4.11
resolution: "sha.js@npm:2.4.11"
"sha.js@npm:2.4.12":
version: 2.4.12
resolution: "sha.js@npm:2.4.12"
dependencies:
inherits: "npm:^2.0.1"
safe-buffer: "npm:^5.0.1"
inherits: "npm:^2.0.4"
safe-buffer: "npm:^5.2.1"
to-buffer: "npm:^1.2.0"
bin:
sha.js: ./bin.js
checksum: 10c0/b7a371bca8821c9cc98a0aeff67444a03d48d745cb103f17228b96793f455f0eb0a691941b89ea1e60f6359207e36081d9be193252b0f128e0daf9cfea2815a5
sha.js: bin.js
checksum: 10c0/9d36bdd76202c8116abbe152a00055ccd8a0099cb28fc17c01fa7bb2c8cffb9ca60e2ab0fe5f274ed6c45dc2633d8c39cf7ab050306c231904512ba9da4d8ab1
languageName: node
linkType: hard

Expand Down Expand Up @@ -12293,6 +12294,17 @@ __metadata:
languageName: node
linkType: hard

"to-buffer@npm:^1.2.0":
version: 1.2.1
resolution: "to-buffer@npm:1.2.1"
dependencies:
isarray: "npm:^2.0.5"
safe-buffer: "npm:^5.2.1"
typed-array-buffer: "npm:^1.0.3"
checksum: 10c0/bbf07a2a7d6ff9e3ffe503c689176c7149cf3ec25887ce7c4aa5c4841a8845cc71121cd7b4a4769957f823b3f31dbf6b1be6e0a5955798ad864bf2245ee8b5e4
languageName: node
linkType: hard

"to-regex-range@npm:^5.0.1":
version: 5.0.1
resolution: "to-regex-range@npm:5.0.1"
Expand Down