Skip to content

@unional/createutils@1.1.4

Choose a tag to compare

@github-actions github-actions released this 02 Sep 02:55
· 44 commits to main since this release
dcc6ab2

Patch Changes

  • 8c5f489: Fix two CodeQL findings in the git helpers.

    getGitConfig built its command as a template string and ran it through a shell,
    so the key argument reached the shell unescaped
    (js/shell-command-constructed-from-input). It now uses execFileSync with an
    argument array, which never involves a shell.

    getGitRepositoryName used two unanchored regexes whose .* groups backtracked
    polynomially on hostile input (js/polynomial-redos). Both are now anchored with
    bounded character classes. Recognized remote URLs parse the same way.

  • 0a1b238: Rebuild with TypeScript 7. The emitted output changes: the CJS build now targets
    ES2022 under module: node16 instead of downlevelling to ES5, and the ESM build
    targets ES2022 as well. target: es5 and moduleResolution: node10 were both
    removed in TypeScript 7, so the previous settings no longer compile.

    No public API changes, and the published file list is unchanged.