ReDoS vulnerabilities found in @actions/glob

[yuzurihaaa]

Description:
Hi. We have a vulnerabilities report on @actions/glob about ReDoS in this repo due to the package is being used in this repo and @action/cache. I have a PR here to address on this issue (originated from actions/toolkit#2057).

1. The PR stated is for addressing the issue.
2. Once PR is merged, requires @actions/glob to release a new version.
3. Update @actions/cache to use the version with this fix (dependabot will be able to create this orI can help to create a PR)
4. Update @actions/setup-node to bump @actions/glob and @actions/cache with the ReDoS vulnerabilities fix (dependabot will be able to create this orI can help to create a PR)

The tricky part is @actions/cache latest version is ESM-only. This will require for a patch on 5.x so that @actions/setup-node can bump the version with minimum changes.

Justification:

Are you willing to submit a PR?
Yes.

[gowridurgad]

Hi @yuzurihaaa,
Thank you for creating this feature request. We will investigate it and provide feedback as soon as we have some updates.

[priyagupta108]

Thanks for the detailed write-up and for driving the upstream work!

setup-node’s direct @actions/glob dependency has been updated to 0.7.0, which uses minimatch@^10.x instead of the custom regex responsible for the ReDoS vulnerability.

There are no open Dependabot alerts for the @actions/glob ReDoS in this repository, so we’re closing this issue as resolved on our side.

Please let us know if you continue to experience any issues. Thank you!