Skip to content

Dostm 9007 fix vulnerabilities#59

Open
UtkarshBagariaDigicert wants to merge 8 commits intomasterfrom
DOSTM-9007_fix_Vulnerabilities
Open

Dostm 9007 fix vulnerabilities#59
UtkarshBagariaDigicert wants to merge 8 commits intomasterfrom
DOSTM-9007_fix_Vulnerabilities

Conversation

@UtkarshBagariaDigicert
Copy link
Collaborator

@UtkarshBagariaDigicert UtkarshBagariaDigicert commented Mar 6, 2026

This pull request introduces improvements to Windows tool installation handling, updates a dependency version, and adds a new error message. The most important changes are grouped below by theme.

Windows tool installation improvements:

  • Updated toolInstaller in src/index.ts to skip caching for MSI-installed tools on Windows adding the install path directly to PATH to avoid archive extraction errors. [1] [2]

Dependency update:

  • Bumped @digicert/ssm-client-tools-installer version from 1.6.1 to 1.6.2 in package.json for improved compatibility and bug fixes.

Error messaging:

  • Added a new error message LIB_UndefinedNodeVersion to build/lib.json for clearer diagnostics when Node version is undefined.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the GitHub Action’s tool installation flow—especially on Windows—by adjusting how MSI-installed tools are handled, bumping the @digicert/ssm-client-tools-installer dependency, and extending the bundled build output with updated dependency code and improved diagnostics.

Changes:

  • Skip @actions/tool-cache directory caching for MSI-installed Windows tools and add the installation directory directly to PATH.
  • Bump @digicert/ssm-client-tools-installer from ^1.6.1 to ^1.6.2 (with corresponding lockfile updates).
  • Add a new localization string (LIB_UndefinedNodeVersion) and update the bundled build/index.js to include new installer logic and dependency updates.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
src/index.ts Adjusts Windows MSI tool handling (skip caching, PATH updates) and improves Windows zip extraction behavior for Mage.
package.json Bumps @digicert/ssm-client-tools-installer version.
package-lock.json Updates resolved dependency tree for the bumped installer package (and transitive deps).
build/lib.json Adds LIB_UndefinedNodeVersion localization string used by bundled code.
build/index.js Updates the committed ncc bundle with new Windows installer path/locking logic and updated transitive dependencies.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants