Getting security alerts while using this action for enterprise project
manoj27730 opened this issue · comments
Hi Team,
I need this actions to be used by my project and since it's not allowed by default our enterprise GitHub Team need to review and add it for our project. Our GitHub Team has found alert and mentioned below point.
"The actions requested are available on our github instance but we are seeing dependabot alerts. Since those repo have vulnerabilities, we won’t be able to make it public. Look like it’s patched on the master but they haven’t release it. Please file issue with the actions owner to release patched version. After that, we can make it available for your team to use."
Can you please look into it and help.
Hi @manoj27730 I bumped the npm dependencies for the other MATLAB actions. I am not seeing the same vulnerabilities present in this action. It looks like the attached screenshot is for run-command. Are you able to confirm that your organization is using this action, and if so, can you let us know which dependencies you are seeing in your alerts?
Thanks,
David
Hi David,
Our Enterprise GitHub Team has confirmed it doesn't have any vulnerabilities. Please close this request.
Thanks,
Manoj