Compare commits

..

2 Commits

Author SHA1 Message Date
semantic-release-bot 7bfa3a4717 build(release): 1.9.3 [skip ci]
## [1.9.3](https://github.com/actions/create-github-app-token/compare/v1.9.2...v1.9.3) (2024-04-04)

### Bug Fixes

* **deps:** bump undici from 6.10.2 to 6.11.1 ([#125](https://github.com/actions/create-github-app-token/issues/125)) ([3c223c7](https://github.com/actions/create-github-app-token/commit/3c223c7336e276235eb843dd4e6ad42147199cbf)), closes [#3024](https://github.com/actions/create-github-app-token/issues/3024) [nodejs/undici#3044](https://github.com/nodejs/undici/issues/3044) [#3023](https://github.com/actions/create-github-app-token/issues/3023) [nodejs/undici#3025](https://github.com/nodejs/undici/issues/3025) [nodejs/undici#3024](https://github.com/nodejs/undici/issues/3024) [nodejs/undici#3034](https://github.com/nodejs/undici/issues/3034) [nodejs/undici#3038](https://github.com/nodejs/undici/issues/3038) [nodejs/undici#2947](https://github.com/nodejs/undici/issues/2947) [nodejs/undici#3040](https://github.com/nodejs/undici/issues/3040) [nodejs/undici#3036](https://github.com/nodejs/undici/issues/3036) [nodejs/undici#3041](https://github.com/nodejs/undici/issues/3041) [#3024](https://github.com/actions/create-github-app-token/issues/3024) [#3041](https://github.com/actions/create-github-app-token/issues/3041) [#3036](https://github.com/actions/create-github-app-token/issues/3036)
2024-04-04 17:10:12 +00:00
dependabot[bot] 3c223c7336 fix(deps): bump undici from 6.10.2 to 6.11.1 (#125)
Bumps [undici](https://github.com/nodejs/undici) from 6.10.2 to 6.11.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nodejs/undici/releases">undici's
releases</a>.</em></p>
<blockquote>
<h2>v6.11.1</h2>
<h1>⚠️ Security Release ⚠️</h1>
<h2>What's Changed</h2>
<ul>
<li>Fixes <a
href="https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7">https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7</a>
CVE-2024-30260</li>
<li>Fixes <a
href="https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672">https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672</a>
CVE-2024-30261</li>
<li>Revert &quot;fix: don't leak internal class (<a
href="https://redirect.github.com/nodejs/undici/issues/3024">#3024</a>)&quot;
by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in
<a
href="https://redirect.github.com/nodejs/undici/pull/3044">nodejs/undici#3044</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v6.11.0...v6.11.1">https://github.com/nodejs/undici/compare/v6.11.0...v6.11.1</a></p>
<h2>v6.11.0</h2>
<h2>What's Changed</h2>
<ul>
<li>refactor(<a
href="https://redirect.github.com/nodejs/undici/issues/3023">#3023</a>):
Pass headers as array instead by <a
href="https://github.com/metcoder95"><code>@​metcoder95</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/3025">nodejs/undici#3025</a></li>
<li>fix: don't leak internal class by <a
href="https://github.com/ronag"><code>@​ronag</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/3024">nodejs/undici#3024</a></li>
<li>build(deps): bump codecov/codecov-action from 4.1.0 to 4.1.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/3034">nodejs/undici#3034</a></li>
<li>build(deps-dev): bump tsd from 0.30.7 to 0.31.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/3038">nodejs/undici#3038</a></li>
<li>build(deps-dev): bump borp from 0.9.1 to 0.10.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/2947">nodejs/undici#2947</a></li>
<li>missing commits by <a
href="https://github.com/ronag"><code>@​ronag</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/3040">nodejs/undici#3040</a></li>
<li>build(deps): bump actions/checkout from 4.1.1 to 4.1.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/3036">nodejs/undici#3036</a></li>
<li>fix: regexp pattern by <a
href="https://github.com/tsctx"><code>@​tsctx</code></a> in <a
href="https://redirect.github.com/nodejs/undici/pull/3041">nodejs/undici#3041</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nodejs/undici/compare/v6.10.2...v6.11.0">https://github.com/nodejs/undici/compare/v6.10.2...v6.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodejs/undici/commit/6df3c738d03dc4014a26640316bf699950d62024"><code>6df3c73</code></a>
Bumped v6.11.1</li>
<li><a
href="https://github.com/nodejs/undici/commit/c346b66287c873f3c81a71b3cedd2bb222c4bb8b"><code>c346b66</code></a>
Revert &quot;fix: don't leak internal class (<a
href="https://redirect.github.com/nodejs/undici/issues/3024">#3024</a>)&quot;</li>
<li><a
href="https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3"><code>d542b8c</code></a>
Merge pull request from GHSA-9qxr-qj54-h672</li>
<li><a
href="https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75"><code>6805746</code></a>
Merge pull request from GHSA-m4v8-wqvr-p9f7</li>
<li><a
href="https://github.com/nodejs/undici/commit/ee5f892f3955eaca37730ed30349153ba203e9cd"><code>ee5f892</code></a>
Bumped v6.11.0</li>
<li><a
href="https://github.com/nodejs/undici/commit/71a6d749b200e25359fdb0142dd398bfa52dc46d"><code>71a6d74</code></a>
Merge branch 'main' of github.com:nodejs/undici</li>
<li><a
href="https://github.com/nodejs/undici/commit/0f0f239d939ec617ac4f4278c6f64fccc8928283"><code>0f0f239</code></a>
fix: regexp pattern (<a
href="https://redirect.github.com/nodejs/undici/issues/3041">#3041</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/31f9e67368bf98464c7d99eac08a63894ddc05f9"><code>31f9e67</code></a>
build(deps): bump actions/checkout from 4.1.1 to 4.1.2 (<a
href="https://redirect.github.com/nodejs/undici/issues/3036">#3036</a>)</li>
<li><a
href="https://github.com/nodejs/undici/commit/c8a43aed8e08e278471eb7dee27b5d782098a7bc"><code>c8a43ae</code></a>
fixup</li>
<li><a
href="https://github.com/nodejs/undici/commit/8b5e2c8f3667c2fdfbcf956b20bcaa159ab8082f"><code>8b5e2c8</code></a>
fixup</li>
<li>Additional commits viewable in <a
href="https://github.com/nodejs/undici/compare/v6.10.2...v6.11.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=undici&package-manager=npm_and_yarn&previous-version=6.10.2&new-version=6.11.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/actions/create-github-app-token/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-04 10:09:43 -07:00
4 changed files with 178 additions and 106 deletions
+85 -49
View File
@@ -13168,8 +13168,6 @@ var require_util = __commonJS({
return tree.lookup(value) ?? value.toString("latin1").toLowerCase();
}
function parseHeaders(headers, obj) {
if (!Array.isArray(headers))
return headers;
if (obj === void 0)
obj = {};
for (let i = 0; i < headers.length; i += 2) {
@@ -14962,9 +14960,9 @@ var require_data_url = __commonJS({
var assert = require("node:assert");
var encoder = new TextEncoder();
var HTTP_TOKEN_CODEPOINTS = /^[!#$%&'*+-.^_|~A-Za-z0-9]+$/;
var HTTP_WHITESPACE_REGEX = /[\u000A|\u000D|\u0009|\u0020]/;
var HTTP_WHITESPACE_REGEX = /[\u000A\u000D\u0009\u0020]/;
var ASCII_WHITESPACE_REPLACE_REGEX = /[\u0009\u000A\u000C\u000D\u0020]/g;
var HTTP_QUOTED_STRING_TOKENS = /[\u0009|\u0020-\u007E|\u0080-\u00FF]/;
var HTTP_QUOTED_STRING_TOKENS = /[\u0009\u0020-\u007E\u0080-\u00FF]/;
function dataURLProcessor(dataURL) {
assert(dataURL.protocol === "data:");
let input = URLSerializer(dataURL, true);
@@ -15726,9 +15724,12 @@ var require_util2 = __commonJS({
var assert = require("node:assert");
var { isUint8Array } = require("node:util/types");
var { webidl } = require_webidl();
var supportedHashes = [];
var crypto4;
try {
crypto4 = require("node:crypto");
const possibleRelevantHashes = ["sha256", "sha384", "sha512"];
supportedHashes = crypto4.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
} catch {
}
function responseURL(response) {
@@ -16009,45 +16010,37 @@ var require_util2 = __commonJS({
if (parsedMetadata.length === 0) {
return true;
}
const list = parsedMetadata.sort((c, d) => d.algo.localeCompare(c.algo));
const strongest = list[0].algo;
const metadata = list.filter((item) => item.algo === strongest);
const strongest = getStrongestMetadata(parsedMetadata);
const metadata = filterMetadataListByAlgorithm(parsedMetadata, strongest);
for (const item of metadata) {
const algorithm = item.algo;
let expectedValue = item.hash;
if (expectedValue.endsWith("==")) {
expectedValue = expectedValue.slice(0, -2);
}
const expectedValue = item.hash;
let actualValue = crypto4.createHash(algorithm).update(bytes).digest("base64");
if (actualValue.endsWith("==")) {
actualValue = actualValue.slice(0, -2);
if (actualValue[actualValue.length - 1] === "=") {
if (actualValue[actualValue.length - 2] === "=") {
actualValue = actualValue.slice(0, -2);
} else {
actualValue = actualValue.slice(0, -1);
}
}
if (actualValue === expectedValue) {
return true;
}
let actualBase64URL = crypto4.createHash(algorithm).update(bytes).digest("base64url");
if (actualBase64URL.endsWith("==")) {
actualBase64URL = actualBase64URL.slice(0, -2);
}
if (actualBase64URL === expectedValue) {
if (compareBase64Mixed(actualValue, expectedValue)) {
return true;
}
}
return false;
}
var parseHashWithOptions = /(?<algo>sha256|sha384|sha512)-(?<hash>[A-Za-z0-9+/]+={0,2}(?=\s|$))( +[!-~]*)?/i;
var parseHashWithOptions = /(?<algo>sha256|sha384|sha512)-((?<hash>[A-Za-z0-9+/]+|[A-Za-z0-9_-]+)={0,2}(?:\s|$)( +[!-~]*)?)?/i;
function parseMetadata(metadata) {
const result = [];
let empty = true;
const supportedHashes = crypto4.getHashes();
for (const token of metadata.split(" ")) {
empty = false;
const parsedToken = parseHashWithOptions.exec(token);
if (parsedToken === null || parsedToken.groups === void 0) {
if (parsedToken === null || parsedToken.groups === void 0 || parsedToken.groups.algo === void 0) {
continue;
}
const algorithm = parsedToken.groups.algo;
if (supportedHashes.includes(algorithm.toLowerCase())) {
const algorithm = parsedToken.groups.algo.toLowerCase();
if (supportedHashes.includes(algorithm)) {
result.push(parsedToken.groups);
}
}
@@ -16056,6 +16049,51 @@ var require_util2 = __commonJS({
}
return result;
}
function getStrongestMetadata(metadataList) {
let algorithm = metadataList[0].algo;
if (algorithm[3] === "5") {
return algorithm;
}
for (let i = 1; i < metadataList.length; ++i) {
const metadata = metadataList[i];
if (metadata.algo[3] === "5") {
algorithm = "sha512";
break;
} else if (algorithm[3] === "3") {
continue;
} else if (metadata.algo[3] === "3") {
algorithm = "sha384";
}
}
return algorithm;
}
function filterMetadataListByAlgorithm(metadataList, algorithm) {
if (metadataList.length === 1) {
return metadataList;
}
let pos = 0;
for (let i = 0; i < metadataList.length; ++i) {
if (metadataList[i].algo === algorithm) {
metadataList[pos++] = metadataList[i];
}
}
metadataList.length = pos;
return metadataList;
}
function compareBase64Mixed(actualValue, expectedValue) {
if (actualValue.length !== expectedValue.length) {
return false;
}
for (let i = 0; i < actualValue.length; ++i) {
if (actualValue[i] !== expectedValue[i]) {
if (actualValue[i] === "+" && expectedValue[i] === "-" || actualValue[i] === "/" && expectedValue[i] === "_") {
continue;
}
return false;
}
}
return true;
}
function tryUpgradeRequestToAPotentiallyTrustworthyURL(request2) {
}
function sameOrigin(A, B) {
@@ -18499,6 +18537,14 @@ var require_client_h2 = __commonJS({
HTTP2_HEADER_STATUS
}
} = http2;
function parseH2Headers(headers) {
headers = Object.entries(headers).flat(2);
const result = [];
for (const header of headers) {
result.push(Buffer.from(header));
}
return result;
}
async function connectH2(client, socket) {
client[kSocket] = socket;
if (!h2ExperimentalWarned) {
@@ -18734,7 +18780,13 @@ var require_client_h2 = __commonJS({
stream.once("response", (headers2) => {
const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers2;
request2.onResponseStarted();
if (request2.onHeaders(Number(statusCode), realHeaders, stream.resume.bind(stream), "") === false) {
if (request2.aborted || request2.completed) {
const err = new RequestAbortedError();
errorRequest(client, request2, err);
util.destroy(stream, err);
return;
}
if (request2.onHeaders(Number(statusCode), parseH2Headers(realHeaders), stream.resume.bind(stream), "") === false) {
stream.pause();
}
stream.on("data", (chunk) => {
@@ -19054,9 +19106,9 @@ var require_redirect_handler = __commonJS({
if (removeContent && util.headerNameToString(header).startsWith("content-")) {
return true;
}
if (unknownOrigin && (header.length === 13 || header.length === 6)) {
if (unknownOrigin && (header.length === 13 || header.length === 6 || header.length === 19)) {
const name = util.headerNameToString(header);
return name === "authorization" || name === "cookie";
return name === "authorization" || name === "cookie" || name === "proxy-authorization";
}
return false;
}
@@ -22379,6 +22431,8 @@ var require_pending_interceptors_formatter = __commonJS({
"use strict";
var { Transform } = require("node:stream");
var { Console } = require("node:console");
var PERSISTENT = process.versions.icu ? "\u2705" : "Y ";
var NOT_PERSISTENT = process.versions.icu ? "\u274C" : "N ";
module2.exports = class PendingInterceptorsFormatter {
constructor({ disableColors } = {}) {
this.transform = new Transform({
@@ -22400,7 +22454,7 @@ var require_pending_interceptors_formatter = __commonJS({
Origin: origin,
Path: path,
"Status code": statusCode,
Persistent: persist ? "\u2705" : "\u274C",
Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
Invocations: timesInvoked,
Remaining: persist ? Infinity : times - timesInvoked
})
@@ -22670,7 +22724,7 @@ var require_headers = __commonJS({
} = require_util2();
var { webidl } = require_webidl();
var assert = require("node:assert");
var util = require("util");
var util = require("node:util");
var kHeadersMap = Symbol("headers map");
var kHeadersSortedMap = Symbol("headers map sorted");
function isHTTPWhiteSpaceCharCode(code) {
@@ -25161,24 +25215,6 @@ var require_fetch = __commonJS({
codings = contentEncoding.toLowerCase().split(",").map((x) => x.trim());
}
location = headersList.get("location", true);
} else {
const keys = Object.keys(rawHeaders);
for (let i = 0; i < keys.length; ++i) {
const key = keys[i];
const value = rawHeaders[key];
if (key === "set-cookie") {
for (let j = 0; j < value.length; ++j) {
headersList.append(key, value[j], true);
}
} else {
headersList.append(key, value, true);
}
}
const contentEncoding = rawHeaders["content-encoding"];
if (contentEncoding) {
codings = contentEncoding.toLowerCase().split(",").map((x) => x.trim()).reverse();
}
location = rawHeaders.location;
}
this.body = new Readable({ read: resume });
const decoders = [];
+85 -49
View File
@@ -2928,8 +2928,6 @@ var require_util = __commonJS({
return tree.lookup(value) ?? value.toString("latin1").toLowerCase();
}
function parseHeaders(headers, obj) {
if (!Array.isArray(headers))
return headers;
if (obj === void 0)
obj = {};
for (let i = 0; i < headers.length; i += 2) {
@@ -4722,9 +4720,9 @@ var require_data_url = __commonJS({
var assert = require("node:assert");
var encoder = new TextEncoder();
var HTTP_TOKEN_CODEPOINTS = /^[!#$%&'*+-.^_|~A-Za-z0-9]+$/;
var HTTP_WHITESPACE_REGEX = /[\u000A|\u000D|\u0009|\u0020]/;
var HTTP_WHITESPACE_REGEX = /[\u000A\u000D\u0009\u0020]/;
var ASCII_WHITESPACE_REPLACE_REGEX = /[\u0009\u000A\u000C\u000D\u0020]/g;
var HTTP_QUOTED_STRING_TOKENS = /[\u0009|\u0020-\u007E|\u0080-\u00FF]/;
var HTTP_QUOTED_STRING_TOKENS = /[\u0009\u0020-\u007E\u0080-\u00FF]/;
function dataURLProcessor(dataURL) {
assert(dataURL.protocol === "data:");
let input = URLSerializer(dataURL, true);
@@ -5486,9 +5484,12 @@ var require_util2 = __commonJS({
var assert = require("node:assert");
var { isUint8Array } = require("node:util/types");
var { webidl } = require_webidl();
var supportedHashes = [];
var crypto4;
try {
crypto4 = require("node:crypto");
const possibleRelevantHashes = ["sha256", "sha384", "sha512"];
supportedHashes = crypto4.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
} catch {
}
function responseURL(response) {
@@ -5769,45 +5770,37 @@ var require_util2 = __commonJS({
if (parsedMetadata.length === 0) {
return true;
}
const list = parsedMetadata.sort((c, d) => d.algo.localeCompare(c.algo));
const strongest = list[0].algo;
const metadata = list.filter((item) => item.algo === strongest);
const strongest = getStrongestMetadata(parsedMetadata);
const metadata = filterMetadataListByAlgorithm(parsedMetadata, strongest);
for (const item of metadata) {
const algorithm = item.algo;
let expectedValue = item.hash;
if (expectedValue.endsWith("==")) {
expectedValue = expectedValue.slice(0, -2);
}
const expectedValue = item.hash;
let actualValue = crypto4.createHash(algorithm).update(bytes).digest("base64");
if (actualValue.endsWith("==")) {
actualValue = actualValue.slice(0, -2);
if (actualValue[actualValue.length - 1] === "=") {
if (actualValue[actualValue.length - 2] === "=") {
actualValue = actualValue.slice(0, -2);
} else {
actualValue = actualValue.slice(0, -1);
}
}
if (actualValue === expectedValue) {
return true;
}
let actualBase64URL = crypto4.createHash(algorithm).update(bytes).digest("base64url");
if (actualBase64URL.endsWith("==")) {
actualBase64URL = actualBase64URL.slice(0, -2);
}
if (actualBase64URL === expectedValue) {
if (compareBase64Mixed(actualValue, expectedValue)) {
return true;
}
}
return false;
}
var parseHashWithOptions = /(?<algo>sha256|sha384|sha512)-(?<hash>[A-Za-z0-9+/]+={0,2}(?=\s|$))( +[!-~]*)?/i;
var parseHashWithOptions = /(?<algo>sha256|sha384|sha512)-((?<hash>[A-Za-z0-9+/]+|[A-Za-z0-9_-]+)={0,2}(?:\s|$)( +[!-~]*)?)?/i;
function parseMetadata(metadata) {
const result = [];
let empty = true;
const supportedHashes = crypto4.getHashes();
for (const token of metadata.split(" ")) {
empty = false;
const parsedToken = parseHashWithOptions.exec(token);
if (parsedToken === null || parsedToken.groups === void 0) {
if (parsedToken === null || parsedToken.groups === void 0 || parsedToken.groups.algo === void 0) {
continue;
}
const algorithm = parsedToken.groups.algo;
if (supportedHashes.includes(algorithm.toLowerCase())) {
const algorithm = parsedToken.groups.algo.toLowerCase();
if (supportedHashes.includes(algorithm)) {
result.push(parsedToken.groups);
}
}
@@ -5816,6 +5809,51 @@ var require_util2 = __commonJS({
}
return result;
}
function getStrongestMetadata(metadataList) {
let algorithm = metadataList[0].algo;
if (algorithm[3] === "5") {
return algorithm;
}
for (let i = 1; i < metadataList.length; ++i) {
const metadata = metadataList[i];
if (metadata.algo[3] === "5") {
algorithm = "sha512";
break;
} else if (algorithm[3] === "3") {
continue;
} else if (metadata.algo[3] === "3") {
algorithm = "sha384";
}
}
return algorithm;
}
function filterMetadataListByAlgorithm(metadataList, algorithm) {
if (metadataList.length === 1) {
return metadataList;
}
let pos = 0;
for (let i = 0; i < metadataList.length; ++i) {
if (metadataList[i].algo === algorithm) {
metadataList[pos++] = metadataList[i];
}
}
metadataList.length = pos;
return metadataList;
}
function compareBase64Mixed(actualValue, expectedValue) {
if (actualValue.length !== expectedValue.length) {
return false;
}
for (let i = 0; i < actualValue.length; ++i) {
if (actualValue[i] !== expectedValue[i]) {
if (actualValue[i] === "+" && expectedValue[i] === "-" || actualValue[i] === "/" && expectedValue[i] === "_") {
continue;
}
return false;
}
}
return true;
}
function tryUpgradeRequestToAPotentiallyTrustworthyURL(request2) {
}
function sameOrigin(A, B) {
@@ -8259,6 +8297,14 @@ var require_client_h2 = __commonJS({
HTTP2_HEADER_STATUS
}
} = http2;
function parseH2Headers(headers) {
headers = Object.entries(headers).flat(2);
const result = [];
for (const header of headers) {
result.push(Buffer.from(header));
}
return result;
}
async function connectH2(client, socket) {
client[kSocket] = socket;
if (!h2ExperimentalWarned) {
@@ -8494,7 +8540,13 @@ var require_client_h2 = __commonJS({
stream.once("response", (headers2) => {
const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers2;
request2.onResponseStarted();
if (request2.onHeaders(Number(statusCode), realHeaders, stream.resume.bind(stream), "") === false) {
if (request2.aborted || request2.completed) {
const err = new RequestAbortedError();
errorRequest(client, request2, err);
util.destroy(stream, err);
return;
}
if (request2.onHeaders(Number(statusCode), parseH2Headers(realHeaders), stream.resume.bind(stream), "") === false) {
stream.pause();
}
stream.on("data", (chunk) => {
@@ -8814,9 +8866,9 @@ var require_redirect_handler = __commonJS({
if (removeContent && util.headerNameToString(header).startsWith("content-")) {
return true;
}
if (unknownOrigin && (header.length === 13 || header.length === 6)) {
if (unknownOrigin && (header.length === 13 || header.length === 6 || header.length === 19)) {
const name = util.headerNameToString(header);
return name === "authorization" || name === "cookie";
return name === "authorization" || name === "cookie" || name === "proxy-authorization";
}
return false;
}
@@ -12139,6 +12191,8 @@ var require_pending_interceptors_formatter = __commonJS({
"use strict";
var { Transform } = require("node:stream");
var { Console } = require("node:console");
var PERSISTENT = process.versions.icu ? "\u2705" : "Y ";
var NOT_PERSISTENT = process.versions.icu ? "\u274C" : "N ";
module2.exports = class PendingInterceptorsFormatter {
constructor({ disableColors } = {}) {
this.transform = new Transform({
@@ -12160,7 +12214,7 @@ var require_pending_interceptors_formatter = __commonJS({
Origin: origin,
Path: path,
"Status code": statusCode,
Persistent: persist ? "\u2705" : "\u274C",
Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
Invocations: timesInvoked,
Remaining: persist ? Infinity : times - timesInvoked
})
@@ -12430,7 +12484,7 @@ var require_headers = __commonJS({
} = require_util2();
var { webidl } = require_webidl();
var assert = require("node:assert");
var util = require("util");
var util = require("node:util");
var kHeadersMap = Symbol("headers map");
var kHeadersSortedMap = Symbol("headers map sorted");
function isHTTPWhiteSpaceCharCode(code) {
@@ -14921,24 +14975,6 @@ var require_fetch = __commonJS({
codings = contentEncoding.toLowerCase().split(",").map((x) => x.trim());
}
location = headersList.get("location", true);
} else {
const keys = Object.keys(rawHeaders);
for (let i = 0; i < keys.length; ++i) {
const key = keys[i];
const value = rawHeaders[key];
if (key === "set-cookie") {
for (let j = 0; j < value.length; ++j) {
headersList.append(key, value[j], true);
}
} else {
headersList.append(key, value, true);
}
}
const contentEncoding = rawHeaders["content-encoding"];
if (contentEncoding) {
codings = contentEncoding.toLowerCase().split(",").map((x) => x.trim()).reverse();
}
location = rawHeaders.location;
}
this.body = new Readable({ read: resume });
const decoders = [];
+6 -6
View File
@@ -1,19 +1,19 @@
{
"name": "create-github-app-token",
"version": "1.9.1",
"version": "1.9.2",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "create-github-app-token",
"version": "1.9.1",
"version": "1.9.2",
"license": "MIT",
"dependencies": {
"@actions/core": "^1.10.1",
"@octokit/auth-app": "^6.0.4",
"@octokit/request": "^9.0.1",
"p-retry": "^6.2.0",
"undici": "^6.10.2"
"undici": "^6.11.1"
},
"devDependencies": {
"@sinonjs/fake-timers": "^11.2.2",
@@ -3687,9 +3687,9 @@
}
},
"node_modules/undici": {
"version": "6.10.2",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.10.2.tgz",
"integrity": "sha512-HcVuBy7ACaDejIMdwCzAvO22OsiE6ir6ziTIr9kAE0vB+PheVe29ZvRN8p7FXCO2uZHTjEoUs5bPiFpuc/hwwQ==",
"version": "6.11.1",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.11.1.tgz",
"integrity": "sha512-KyhzaLJnV1qa3BSHdj4AZ2ndqI0QWPxYzaIOio0WzcEJB9gvuysprJSLtpvc2D9mhR9jPDUk7xlJlZbH2KR5iw==",
"engines": {
"node": ">=18.0"
}
+2 -2
View File
@@ -2,7 +2,7 @@
"name": "create-github-app-token",
"private": true,
"type": "module",
"version": "1.9.2",
"version": "1.9.3",
"description": "GitHub Action for creating a GitHub App Installation Access Token",
"scripts": {
"build": "esbuild main.js post.js --bundle --outdir=dist --out-extension:.js=.cjs --platform=node --target=node20.0.0",
@@ -16,7 +16,7 @@
"@octokit/auth-app": "^6.0.4",
"@octokit/request": "^9.0.1",
"p-retry": "^6.2.0",
"undici": "^6.10.2"
"undici": "^6.11.1"
},
"devDependencies": {
"@sinonjs/fake-timers": "^11.2.2",