fix(package-manager): prevent CWE-78 OS command injection across all Windows spawn paths #12898
alan-agius4pr.yml
on: pull_request
build
4m 57s
analyze
4s
build-e2e-windows-subset
5m 2s
lint
1m 51s
test
10m 44s
Matrix: e2e-package-managers
Matrix: e2e
Matrix: e2e-snapshots
e2e-windows-subset
3m 45s
Annotations
4 errors and 24 warnings
|
lint
Process completed with exit code 1.
|
|
lint:
packages/angular_devkit/schematics/tasks/package-manager/executor.ts#L13
More than 2 blank lines not allowed
|
|
lint:
packages/angular_devkit/build_angular/src/builders/ssr-dev-server/utils.ts#L11
`node:net` import should occur before import of `node:os`
|
|
lint:
packages/angular/cli/src/package-managers/host.ts#L175
Expected blank line before this statement
|
|
build
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
build-e2e-windows-subset
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, bun, 1)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, bun, 2)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, pnpm, 2)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, pnpm, 1)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, bun, 0)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, pnpm, 0)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, yarn, 1)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, yarn, 2)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, esbuild, 5)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, webpack, 4)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e-package-managers (22, yarn, 0)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, webpack, 3)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, webpack, 1)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, esbuild, 1)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, esbuild, 3)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, esbuild, 4)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, webpack, 5)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, esbuild, 0)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, esbuild, 2)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
test
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, webpack, 2)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
e2e (22, webpack, 0)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: angular/dev-infra/github-actions/bazel/configure-remote@2f6d3ae5b1db37b5165f200fb53f30b9330983e4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
packages
|
3.54 MB |
sha256:40c1c8f2368fea72f8a792d67be8c3c61abc566b2006772300dfbdc7b77707b7
|
|
|
win-e2e-build-artifacts
Expired
|
163 MB |
sha256:ee04c1483e63b5f8869c7daafd501d602501dcb91b9372c34f3e4058942a454a
|
|