Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2021-21421: Fix #17 do not report secret on error, add github action · creharmony/node-etsy-client@b4beb8e

node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.

CVE
#ubuntu#nodejs#js#git#auth

@@ -0,0 +1,66 @@

node-etsy-client continuous integration

name: etsy_client_ci

Controls when the action will run.

on:

Triggers the workflow on pull request or push (only for the npmjs branch)

push:

branches: [ npmjs ]

pull_request:

Allows you to run this workflow manually from the Actions tab

workflow_dispatch:

A workflow run is made up of one or more jobs that can run sequentially or in parallel

jobs:

This workflow contains a single job called “build”

build:

The type of runner that the job will run on

runs-on: ubuntu-latest

env:

ETSY_SHOP: fakefakefakefake

strategy:

matrix:

See supported Node.js release schedule at https://nodejs.org/en/about/releases/

node-version: [10.x, 12.x, 14.x, 15.x]

node-version: [12.x]

steps:

- name: Checkout code

uses: actions/checkout@v2

- name: Use Node.js ${{ matrix.node-version }}

uses: actions/setup-node@v1

with:

node-version: ${{ matrix.node-version }}

- name: Cache dependencies

uses: actions/cache@v2

with:

path: |

**/node_modules

key: ${{ runner.os }}-${{ hashFiles(‘**/package-lock.json’) }}

- name: Install dependencies

- run: npm ci # need package.json.lock

run: npm install

- name: Run ci-tests with code coverage

run: npm run ci-test

- name: Report coverage to the PR

continue-on-error: true

uses: romeovs/[email protected]

with:

github-token: ${{ secrets.GITHUB_TOKEN }}

lcov-file: ./coverage/lcov.info

- name: Publish NpmJS package

if: github.ref == ‘refs/heads/npmjs’

run: |

echo “//registry.npmjs.org/:_authToken=${{ secrets.NPM_DEPLOY_TOKEN }}” > .npmrc

npm whoami # rely on .npmrc

npm publish

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907