Summary
The current pnpm/action-setup release bundles brace-expansion 1.1.12, which is covered by GHSA-3jxr-9vmj-r5cp, an exponential-time denial-of-service vulnerability.
Current release
The v6 branch and v6.0.9 release resolve brace-expansion 1.1.12 in pnpm-lock.yaml. The checked-in dist/index.js bundle also includes the vulnerable implementation.
The patched 1.x floor is 1.1.16. The advisory was published after v6.0.9, and I could not find an existing issue or pull request tracking it.
Requested remediation
Please update brace-expansion to at least 1.1.16, regenerate the lockfile, rebuild dist/index.js, and publish a patched release. Verifying the generated bundle is important because consumers pin and execute the committed JavaScript rather than installing the repository lockfile.
Exploitability depends on whether a workflow exposes brace patterns to untrusted input, but downstream repositories and security scanners still inherit the bundled vulnerable code.
Summary
The current
pnpm/action-setuprelease bundlesbrace-expansion1.1.12, which is covered by GHSA-3jxr-9vmj-r5cp, an exponential-time denial-of-service vulnerability.Current release
The
v6branch andv6.0.9release resolvebrace-expansion1.1.12 inpnpm-lock.yaml. The checked-indist/index.jsbundle also includes the vulnerable implementation.The patched 1.x floor is
1.1.16. The advisory was published afterv6.0.9, and I could not find an existing issue or pull request tracking it.Requested remediation
Please update
brace-expansionto at least 1.1.16, regenerate the lockfile, rebuilddist/index.js, and publish a patched release. Verifying the generated bundle is important because consumers pin and execute the committed JavaScript rather than installing the repository lockfile.Exploitability depends on whether a workflow exposes brace patterns to untrusted input, but downstream repositories and security scanners still inherit the bundled vulnerable code.