Revert "Bump eslint-plugin-github from 4.9.0 to 5.0.1" #278

tgodzik · 2025-12-10T11:47:57Z

Reverts #194

Ok, looks like we would need to update a lot of things here. Postponing it

github-actions · 2025-12-10T11:50:57Z

Dependency Review

The following issues were found:

❌ 5 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.

Consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

sbt-plugin/build.sbt

Name	Version	Vulnerability	Severity
com.squareup.okhttp3:okhttp	3.14.2	Square OkHttp can accept the wrong certificate	high
com.squareup.okio:okio	1.17.2	Okio Signed to Unsigned Conversion Error vulnerability	moderate
org.apache.logging.log4j:log4j-core	2.17.0	Improper Input Validation and Injection in Apache Log4j2	moderate
org.scala-sbt:io_2.12	1.5.1	sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)	low
org.scala-sbt:sbt	1.5.8	sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)	low

Scanned Manifest Files

package-lock.json

sbt-plugin/build.sbt

com.squareup.okhttp3:[email protected]
com.squareup.okio:[email protected]
org.apache.logging.log4j:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.eed3si9n:[email protected]
com.github.ben-manes.caffeine:[email protected]
com.google.errorprone:[email protected]
com.jcraft:[email protected]
com.lmax:[email protected]
com.squareup.okhttp3:[email protected]
com.swoval:[email protected]
com.typesafe:[email protected]
com.typesafe:[email protected]
com.typesafe:[email protected]
com.typesafe:[email protected]
io.get-coursier:[email protected]
jline:[email protected]
junit:[email protected]
net.java.dev.jna:[email protected]
net.java.dev.jna:[email protected]
net.openhft:[email protected]
org.apache.logging.log4j:[email protected]
org.apache.logging.log4j:[email protected]
org.checkerframework:[email protected]
org.fusesource.jansi:[email protected]
org.hamcrest:[email protected]
org.jline:[email protected]
org.jline:[email protected]
org.jline:[email protected]
org.jline:[email protected]
org.jline:[email protected]
org.jline:[email protected]
org.reactivestreams:[email protected]
org.reactivestreams:[email protected]
org.scala-lang.modules:[email protected]
org.scala-lang.modules:[email protected]
org.scala-lang.modules:[email protected]
org.scala-lang:[email protected]
org.scala-lang:[email protected]
org.scala-lang:[email protected]
org.scala-sbt.ipcsocket:[email protected]
org.scala-sbt.ivy:[email protected]
org.scala-sbt.jline:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scala-sbt:[email protected]
org.scalameta:[email protected]
org.scalameta:[email protected]
org.scalameta:[email protected]
org.scalameta:[email protected]
org.slf4j:[email protected]
org.slf4j:[email protected]

Revert "Bump eslint-plugin-github from 4.9.0 to 5.0.1"

e9a345d

tgodzik merged commit 6f50cfd into main Dec 10, 2025
6 of 8 checks passed

tgodzik deleted the revert-194-dependabot/npm_and_yarn/eslint-plugin-github-5.0.1 branch December 10, 2025 11:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Revert "Bump eslint-plugin-github from 4.9.0 to 5.0.1" #278

Revert "Bump eslint-plugin-github from 4.9.0 to 5.0.1" #278

Uh oh!

tgodzik commented Dec 10, 2025

Uh oh!

github-actions bot commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Revert "Bump eslint-plugin-github from 4.9.0 to 5.0.1" #278

Revert "Bump eslint-plugin-github from 4.9.0 to 5.0.1" #278

Uh oh!

Conversation

tgodzik commented Dec 10, 2025

Uh oh!

github-actions bot commented Dec 10, 2025

Dependency Review

Snapshot Warnings

Vulnerabilities

sbt-plugin/build.sbt

Scanned Manifest Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants