chore: npm audit fix for hashFiles dependencies

Bump github/codeql-action from 3 to 4 (#4072 )
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 05:37:01 +00:00 · 2025-10-13 07:02:58 +00:00 · 2025-10-12 22:08:56 -04:00 · 2025-10-12 21:45:22 -04:00 · 2025-09-29 13:19:05 +00:00 · 2025-09-29 13:09:56 +00:00
9 changed files with 125 additions and 42 deletions
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
      # Override language selection by uncommenting this and choosing your languages
      # with:
      #   languages: go, javascript, csharp, python, cpp, java
@@ -38,4 +38,4 @@ jobs:
      working-directory: src

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -31,7 +31,7 @@ jobs:
    steps:
      - uses: actions/checkout@v5
      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: "20"

--- a/.github/workflows/node-upgrade.yml
+++ b/.github/workflows/node-upgrade.yml
@@ -13,93 +13,174 @@ jobs:
      - name: Get latest Node versions
        id: node-versions
        run: |
-          set -e
+          # Get latest Node.js releases from official GitHub releases
          echo "Fetching latest Node.js releases..."
+
          # Get latest v20.x release
          LATEST_NODE20=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
            jq -r '.[] | select(.tag_name | startswith("v20.")) | .tag_name' | \
            head -1 | sed 's/^v//')
+
          # Get latest v24.x release  
          LATEST_NODE24=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
            jq -r '.[] | select(.tag_name | startswith("v24.")) | .tag_name' | \
            head -1 | sed 's/^v//')
+
          echo "Found Node.js releases: 20=$LATEST_NODE20, 24=$LATEST_NODE24"
+
          # Verify these versions are available in alpine_nodejs releases
          echo "Verifying availability in alpine_nodejs..."
          ALPINE_RELEASES=$(curl -s https://api.github.com/repos/actions/alpine_nodejs/releases | jq -r '.[].tag_name')
-          if ! echo "$ALPINE_RELEASES" | grep -q "^node20-$LATEST_NODE20$"; then
+
+          if ! echo "$ALPINE_RELEASES" | grep -q "^v$LATEST_NODE20$"; then
            echo "::warning title=Node 20 Fallback::Node 20 version $LATEST_NODE20 not found in alpine_nodejs releases, using fallback"
-            LATEST_NODE20=$(echo "$ALPINE_RELEASES" | grep "^node20-" | head -1 | sed 's/^node20-//')
+            # Fall back to latest available alpine_nodejs v20 release
+            LATEST_NODE20=$(echo "$ALPINE_RELEASES" | grep "^v20\." | head -1 | sed 's/^v//')
            echo "Using latest available alpine_nodejs Node 20: $LATEST_NODE20"
          fi
-          if ! echo "$ALPINE_RELEASES" | grep -q "^node24-$LATEST_NODE24$"; then
+
+          if ! echo "$ALPINE_RELEASES" | grep -q "^v$LATEST_NODE24$"; then
            echo "::warning title=Node 24 Fallback::Node 24 version $LATEST_NODE24 not found in alpine_nodejs releases, using fallback"
-            LATEST_NODE24=$(echo "$ALPINE_RELEASES" | grep "^node24-" | head -1 | sed 's/^node24-//')
+            # Fall back to latest available alpine_nodejs v24 release
+            LATEST_NODE24=$(echo "$ALPINE_RELEASES" | grep "^v24\." | head -1 | sed 's/^v//')
            echo "Using latest available alpine_nodejs Node 24: $LATEST_NODE24"
          fi
-          # Abort if no valid Node versions are found
-          if [ -z "$LATEST_NODE20" ] && [ -z "$LATEST_NODE24" ]; then
-            echo "::error title=Node Version Update::Could not find valid Node 20 or Node 24 version in alpine_nodejs releases. Aborting."
+
+          # Validate that we have non-empty version numbers
+          if [ -z "$LATEST_NODE20" ] || [ "$LATEST_NODE20" = "" ]; then
+            echo "::error title=Invalid Node 20 Version::Failed to determine valid Node 20 version. Got: '$LATEST_NODE20'"
+            echo "Available alpine_nodejs releases:"
+            echo "$ALPINE_RELEASES" | head -10
            exit 1
          fi
+
+          if [ -z "$LATEST_NODE24" ] || [ "$LATEST_NODE24" = "" ]; then
+            echo "::error title=Invalid Node 24 Version::Failed to determine valid Node 24 version. Got: '$LATEST_NODE24'"
+            echo "Available alpine_nodejs releases:"
+            echo "$ALPINE_RELEASES" | head -10
+            exit 1
+          fi
+
+          # Additional validation: ensure versions match expected format (x.y.z)
+          if ! echo "$LATEST_NODE20" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 20 Format::Node 20 version '$LATEST_NODE20' does not match expected format (x.y.z)"
+            exit 1
+          fi
+
+          if ! echo "$LATEST_NODE24" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 24 Format::Node 24 version '$LATEST_NODE24' does not match expected format (x.y.z)"
+            exit 1
+          fi
+
+          echo "✅ Validated Node versions: 20=$LATEST_NODE20, 24=$LATEST_NODE24"
+          echo "latest_node20=$LATEST_NODE20" >> $GITHUB_OUTPUT
+          echo "latest_node24=$LATEST_NODE24" >> $GITHUB_OUTPUT
+
          # Check current versions in externals.sh
          CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
          CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+
          echo "current_node20=$CURRENT_NODE20" >> $GITHUB_OUTPUT
          echo "current_node24=$CURRENT_NODE24" >> $GITHUB_OUTPUT
+
          # Determine if updates are needed
          NEEDS_UPDATE20="false"
          NEEDS_UPDATE24="false"
-          if [ -n "$LATEST_NODE20" ] && [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
+
+          if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
            NEEDS_UPDATE20="true"
            echo "::notice title=Node 20 Update Available::Current: $CURRENT_NODE20 → Latest: $LATEST_NODE20"
          fi
-          if [ -n "$LATEST_NODE24" ] && [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
+
+          if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
            NEEDS_UPDATE24="true"
            echo "::notice title=Node 24 Update Available::Current: $CURRENT_NODE24 → Latest: $LATEST_NODE24"
          fi
+
          if [ "$NEEDS_UPDATE20" == "false" ] && [ "$NEEDS_UPDATE24" == "false" ]; then
            echo "::notice title=No Updates Needed::All Node.js versions are up to date"
          fi
-          echo "latest_node20=$LATEST_NODE20" >> $GITHUB_OUTPUT
-          echo "latest_node24=$LATEST_NODE24" >> $GITHUB_OUTPUT
+
          echo "needs_update20=$NEEDS_UPDATE20" >> $GITHUB_OUTPUT
          echo "needs_update24=$NEEDS_UPDATE24" >> $GITHUB_OUTPUT
+
      - name: Update externals.sh and create PR
        if: steps.node-versions.outputs.needs_update20 == 'true' || steps.node-versions.outputs.needs_update24 == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
-          set -e
-          # Only update if a valid version is found
-          if [ "${{ steps.node-versions.outputs.needs_update20 }}" == "true" ] && [ -n "${{ steps.node-versions.outputs.latest_node20 }}" ]; then
-            sed -i 's/NODE20_VERSION="[^"]*"/NODE20_VERSION="${{ steps.node-versions.outputs.latest_node20 }}"/' src/Misc/externals.sh
+          # Final validation before making changes
+          NODE20_VERSION="${{ steps.node-versions.outputs.latest_node20 }}"
+          NODE24_VERSION="${{ steps.node-versions.outputs.latest_node24 }}"
+          
+          echo "Final validation of versions before PR creation:"
+          echo "Node 20: '$NODE20_VERSION'"
+          echo "Node 24: '$NODE24_VERSION'"
+          
+          # Validate versions are not empty and match expected format
+          if [ -z "$NODE20_VERSION" ] || ! echo "$NODE20_VERSION" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 20 Version::Refusing to create PR with invalid Node 20 version: '$NODE20_VERSION'"
+            exit 1
          fi
-          if [ "${{ steps.node-versions.outputs.needs_update24 }}" == "true" ] && [ -n "${{ steps.node-versions.outputs.latest_node24 }}" ]; then
-            sed -i 's/NODE24_VERSION="[^"]*"/NODE24_VERSION="${{ steps.node-versions.outputs.latest_node24 }}"/' src/Misc/externals.sh
+          
+          if [ -z "$NODE24_VERSION" ] || ! echo "$NODE24_VERSION" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error title=Invalid Node 24 Version::Refusing to create PR with invalid Node 24 version: '$NODE24_VERSION'"
+            exit 1
          fi
+          
+          echo "✅ All versions validated successfully"
+
+          # Update the files
+          if [ "${{ steps.node-versions.outputs.needs_update20 }}" == "true" ]; then
+            sed -i 's/NODE20_VERSION="[^"]*"/NODE20_VERSION="'"$NODE20_VERSION"'"/' src/Misc/externals.sh
+          fi
+
+          if [ "${{ steps.node-versions.outputs.needs_update24 }}" == "true" ]; then
+            sed -i 's/NODE24_VERSION="[^"]*"/NODE24_VERSION="'"$NODE24_VERSION"'"/' src/Misc/externals.sh
+          fi
+
+          # Verify the changes were applied correctly
+          echo "Verifying changes in externals.sh:"
+          grep "NODE20_VERSION=" src/Misc/externals.sh
+          grep "NODE24_VERSION=" src/Misc/externals.sh
+          
+          # Ensure we actually have valid versions in the file
+          UPDATED_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+          UPDATED_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+          
+          if [ -z "$UPDATED_NODE20" ] || [ -z "$UPDATED_NODE24" ]; then
+            echo "::error title=Update Failed::Failed to properly update externals.sh"
+            echo "Updated Node 20: '$UPDATED_NODE20'"
+            echo "Updated Node 24: '$UPDATED_NODE24'"
+            exit 1
+          fi
+
          # Configure git
          git config --global user.name "github-actions[bot]"
          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
+
          # Create branch and commit changes
          branch_name="chore/update-node"
          git checkout -b "$branch_name"
-          git commit -a -m "chore: update Node versions (20: ${{ steps.node-versions.outputs.latest_node20 }}, 24: ${{ steps.node-versions.outputs.latest_node24 }})"
+          git commit -a -m "chore: update Node versions (20: $NODE20_VERSION, 24: $NODE24_VERSION)"
          git push --force origin "$branch_name"
+
          # Create PR body using here-doc for proper formatting
          cat > pr_body.txt << EOF
          Automated Node.js version update:

- Node 20: ${{ steps.node-versions.outputs.current_node20 }} → ${{ steps.node-versions.outputs.latest_node20 }}
- Node 24: ${{ steps.node-versions.outputs.current_node24 }} → ${{ steps.node-versions.outputs.latest_node24 }}
+          - Node 20: ${{ steps.node-versions.outputs.current_node20 }} → $NODE20_VERSION
+          - Node 24: ${{ steps.node-versions.outputs.current_node24 }} → $NODE24_VERSION

          This update ensures we're using the latest stable Node.js versions for security and performance improvements.

          **Note**: When updating Node versions, remember to also create a new release of alpine_nodejs at the updated version following the instructions at: https://github.com/actions/alpine_nodejs

          ---
+
          Autogenerated by [Node Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/node-upgrade.yml)
          EOF
+
          # Create PR
          gh pr create -B main -H "$branch_name" \
            --title "chore: update Node versions" \
@@ -109,4 +190,5 @@ EOF
            --label "node" \
            --label "javascript" \
            --body-file pr_body.txt
+
          echo "::notice title=PR Created::Successfully created Node.js version update PR on branch $branch_name"
--- a/.github/workflows/npm-audit-typescript.yml
+++ b/.github/workflows/npm-audit-typescript.yml
@@ -9,7 +9,7 @@ jobs:
    steps:
      - uses: actions/checkout@v5
      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: "20"
      - name: NPM install and audit fix with TypeScript auto-repair
--- a/.github/workflows/npm-audit.yml
+++ b/.github/workflows/npm-audit.yml
@@ -12,7 +12,7 @@ jobs:
      - uses: actions/checkout@v5
      
      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: "20"
          
--- a/images/Dockerfile
+++ b/images/Dockerfile
@@ -5,8 +5,8 @@ ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=28.4.0
-ARG BUILDX_VERSION=0.28.0
+ARG DOCKER_VERSION=28.5.1
+ARG BUILDX_VERSION=0.29.1

 RUN apt update -y && apt install curl unzip -y

--- a/src/Misc/expressionFunc/hashFiles/package-lock.json
+++ b/src/Misc/expressionFunc/hashFiles/package-lock.json
@@ -1815,10 +1815,11 @@
      }
    },
    "node_modules/eslint-plugin-github/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
      "dev": true,
+      "license": "MIT",
      "dependencies": {
        "balanced-match": "^1.0.0"
      }
@@ -5904,9 +5905,9 @@
          }
        },
        "brace-expansion": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-          "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+          "version": "2.0.2",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+          "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
          "dev": true,
          "requires": {
            "balanced-match": "^1.0.0"
--- a/src/Misc/externals.sh
+++ b/src/Misc/externals.sh
@@ -7,7 +7,7 @@ NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
 NODE20_VERSION="20.19.5"
-NODE24_VERSION="24.7.0"
+NODE24_VERSION="24.9.0"

 get_abs_path() {
  # exploits the fact that pwd will print abs path when no args
--- a/src/Sdk/Sdk.csproj
+++ b/src/Sdk/Sdk.csproj
@@ -14,7 +14,7 @@
    </PropertyGroup>

    <ItemGroup>
-        <PackageReference Include="Azure.Storage.Blobs" Version="12.25.0" />
+        <PackageReference Include="Azure.Storage.Blobs" Version="12.25.1" />
        <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
        <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
        <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
Author	SHA1	Message	Date
github-actions[bot]	0aa2229f08	chore: npm audit fix for hashFiles dependencies	2025-10-13 07:02:58 +00:00
dependabot[bot]	2c5f29c3ca	Bump github/codeql-action from 3 to 4 (#4072 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-10-12 22:08:56 -04:00
github-actions[bot]	c9de9a8699	Update Docker to v28.5.0 and Buildx to v0.29.1 (#4069 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-10-12 21:45:22 -04:00
dependabot[bot]	68ff57dbc4	Bump Azure.Storage.Blobs from 12.25.0 to 12.25.1 (#4058 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-09-29 13:19:05 +00:00
dependabot[bot]	c774eb8d46	Bump actions/setup-node from 4 to 5 (#4037 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Salman Chishti <salmanmkc@GitHub.com>	2025-09-29 13:09:56 +00:00
github-actions[bot]	f184048a9a	chore: update Node versions (#4057 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-09-29 08:26:46 -04:00
Salman Chishti	338d83a941	fix: prevent Node.js upgrade workflow from creating PRs with empty versions (#4055 )	2025-09-23 15:30:36 +01:00