Skip to content

Fix reviewdog/action-shellcheck security alert #491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dev-yakuza
Copy link

@dev-yakuza dev-yakuza commented May 9, 2025

There is a security alert on this repository.

Security Alert

スクリーンショット 2025-05-10 7 13 40

Cause

Normally, reviewdog/action-shellcheck@v1 means the latest of v1, but reviewdog/action-shellcheck uses v1 for the specific tag.

スクリーンショット 2025-05-10 7 11 48

So, reviewdog/action-shellcheck@v1 doesn't means the latest of v1. It points to the oldest version of v1.

Solve

I think the latest version is required to solve this security alert.

Currently, v1.30.0 is latest.

スクリーンショット 2025-05-10 7 18 15

@dev-yakuza dev-yakuza requested a review from johnboyes as a code owner May 9, 2025 22:21
@johnboyes johnboyes self-assigned this May 11, 2025
@dev-yakuza
Copy link
Author

@johnboyes I understand you're very busy. But, could you review this PR please? 🙏

@johnboyes
Copy link
Contributor

Hi @dev-yakuza, thanks for the PR. Apologies for the delay, I have had some unavoidable short-term full-time commitments this last month. I will be able to look at your PR next week, if not before.

So, reviewdog/action-shellcheck@v1 doesn't means the latest of v1. It points to the oldest version of v1.

This would be counter-intuitive if the case, so I will have to look into it carefully.

@dev-yakuza
Copy link
Author

@johnboyes Thank you for your reply. I appreciate the update and will wait for your review. 🙇

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants