Security vulnerabilities and automated fixes for composite actions issues
1 post found
A Node.js library's composite GitHub Action was using mutable version tags (`@v6`, `@v4.36.3`) for action dependencies, creating a supply-chain attack vector. The fix pins both `actions/setup-node` and `github/codeql-action/upload-sarif` to specific 40-character commit SHAs, eliminating the risk of silent repointing attacks.