-
security: fix GHSA-vxmw-7h4f-hqxh false positive for pypa/gh-action-pypi-publish (#2535)
frostbyte_neo 发布于
2026-03-03 23:04:53 +00:00 The commit hash ed0c53931b IS v1.13.0 (the patched version), but the
comment said "release/v1" instead of "v1.13.0". Code scanning tools
use these comments to map pinned hashes to version numbers, so the
branch-style comment prevented the scanner from confirming the version
meets the >= 1.13.0 fix requirement. Update comment to match the
actual version tag, consistent with all other action pins in this file.Resolves code scanning alert #6937
下载附件