github-featured / composiohq--composio

发布

0 发布 1,233 Git 标签

RSS 订阅源
  • @composio/cli@0.2.32-beta.286 72eac88133
    比较

    fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767)

    frostbyte_neo 发布于 2026-07-07 14:58:17 +00:00

    This PR:

    • replaces decompress (unmaintained; the zip-slip fix in the GHSA
      advisory was never published to npm past 4.2.1) with extract-zip
      across the CLI's four zip-extraction call sites: install-skill.ts,
      run-companion-modules.ts, upgrade-binary.ts, and
      cli-local-tools/bundled-binaries.ts
    • extract-zip validates each entry resolves inside the target
      directory before writing, closing the path-traversal issue pnpm audit
      flags as critical
    • replaces the one .tgz-extracting call site
      (scripts/_acp-adapters.ts, used to vendor ACP adapter binaries at
      build time) with tar, since extract-zip only handles zip archives
    • removes @types/decompress; both extract-zip and tar ship their
      own type definitions
    • pnpm audit --prod --audit-level=high now passes (previously failing
      on next, unrelated to #3766)

    Verified extract-zip and tar extract nested directories correctly
    with a local smoke test (real .zip/.tgz archives), in addition to
    the existing @composio/cli (724 tests) and @composio/cli-local-tools
    (13 tests) suites passing.

    下载附件