Description:
npm audit --audit-level=high is failing due to several packages so multiple PR builds are failing here's one example
https://github.com/actions/setup-dotnet/actions/runs/24462641267/job/71480852112?pr=730
4 high, 4 moderate vulns
ajv <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv
brace-expansion <1.1.13 || >=4.0.0 <5.0.5
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/@typescript-eslint/eslint-plugin/node_modules/brace-expansion
node_modules/@typescript-eslint/parser/node_modules/brace-expansion
node_modules/@typescript-eslint/type-utils/node_modules/brace-expansion
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion
fast-xml-parser 5.0.0 - 5.5.6
Severity: high
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder - https://github.com/advisories/GHSA-fj3w-jwp8-x2g3
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) - https://github.com/advisories/GHSA-8gc5-j5rx-235r
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser - https://github.com/advisories/GHSA-jp2q-39xq-3w4g
fix available via `npm audit fix`
node_modules/fast-xml-parser
flatted <=3.4.1
Severity: high
flatted vulnerable to unbounded recursion DoS in parse() revive phase - https://github.com/advisories/GHSA-25h7-pfq9-p65f
Prototype Pollution via parse() in NodeJS flatted - https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
fix available via `npm audit fix`
node_modules/flatted
picomatch <=2.3.1
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch
undici <=6.23.0
Severity: high
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion - https://github.com/advisories/GHSA-g9mf-h72j-4rw9
Undici has an HTTP Request/Response Smuggling issue - https://github.com/advisories/GHSA-2mjp-6q6p-2qxm
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression - https://github.com/advisories/GHSA-vrm6-8vpv-qv8q
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation - https://github.com/advisories/GHSA-v9p9-hfj2-hcw8
Undici has CRLF Injection in undici via `upgrade` option - https://github.com/advisories/GHSA-4992-7rv2-5pvq
fix available via `npm audit fix --force`
Will install @actions/github@9.1.0, which is a breaking change
node_modules/undici
@actions/http-client 2.2.0 - 3.0.1
Depends on vulnerable versions of undici
node_modules/@actions/github/node_modules/@actions/http-client
node_modules/@actions/glob/node_modules/@actions/http-client
node_modules/@actions/http-client
@actions/github 6.0.0 - 6.0.1
Depends on vulnerable versions of @actions/http-client
node_modules/@actions/github
8 vulnerabilities (4 moderate, 4 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Task version:
N/A
Platform:
Runner type:
Repro steps:
Run CI
Expected behavior:
CI not blocked by high vuln, removing the moderate to reduce the noise is beneficial as well
Actual behavior:
CI is failing due to npm audit --audit-level=high catching 4 high vulns
Description:
npm audit --audit-level=highis failing due to several packages so multiple PR builds are failing here's one examplehttps://github.com/actions/setup-dotnet/actions/runs/24462641267/job/71480852112?pr=730
4 high, 4 moderate vulns
Task version:
N/A
Platform:
Runner type:
Repro steps:
Run CI
Expected behavior:
CI not blocked by high vuln, removing the moderate to reduce the noise is beneficial as well
Actual behavior:
CI is failing due to
npm audit --audit-level=highcatching 4 high vulns