Merge pull request #3934 from github/dependabot/npm_and_yarn/npm-minor-86fb5ccea6

Bump the npm-minor group across 1 directory with 2 updates

.github/workflows/__rubocop-multi-language.yml

@@ -59,7 +59,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

lib/entry-points.js

@@ -125031,7 +125031,7 @@ var require_tmp = __commonJS({
             cb(null, path28.join(parentDir, path28.basename(pathToResolve)));
           });
         } else {
-          fs30.realpath(path28, cb);
+          fs30.realpath(pathToResolve, cb);
         }
       });
     }
@@ -125063,16 +125063,31 @@ var require_tmp = __commonJS({
       ].join("");
       return path28.join(tmpDir, opts.dir, name);
     }
+    function _assertPath(option, value) {
+      if (typeof value !== "string") {
+        throw new Error(`${option} option must be a string, got "${typeof value}".`);
+      }
+      if (value.includes("..")) {
+        throw new Error("Relative value not allowed");
+      }
+      return value;
+    }
     function _assertOptionsBase(options) {
       if (!_isUndefined(options.name)) {
         const name = options.name;
         if (path28.isAbsolute(name)) throw new Error(`name option must not contain an absolute path, found "${name}".`);
         const basename2 = path28.basename(name);
-        if (basename2 === ".." || basename2 === "." || basename2 !== name)
+        if (basename2 === ".." || basename2 === "." || basename2 !== name) {
           throw new Error(`name option must not contain a path, found "${name}".`);
+        }
       }
-      if (!_isUndefined(options.template) && !options.template.match(TEMPLATE_PATTERN)) {
-        throw new Error(`Invalid template, found "${options.template}".`);
+      if (!_isUndefined(options.template)) {
+        if (typeof options.template !== "string") {
+          throw new Error(`template option must be a string, got "${typeof options.template}".`);
+        }
+        if (!options.template.match(TEMPLATE_PATTERN)) {
+          throw new Error(`Invalid template, found "${options.template}".`);
+        }
       }
       if (!_isUndefined(options.tries) && isNaN(options.tries) || options.tries < 0) {
         throw new Error(`Invalid tries, found "${options.tries}".`);
@@ -125082,15 +125097,16 @@ var require_tmp = __commonJS({
       options.detachDescriptor = !!options.detachDescriptor;
       options.discardDescriptor = !!options.discardDescriptor;
       options.unsafeCleanup = !!options.unsafeCleanup;
-      options.prefix = _isUndefined(options.prefix) ? "" : options.prefix;
-      options.postfix = _isUndefined(options.postfix) ? "" : options.postfix;
+      options.prefix = _isUndefined(options.prefix) ? "" : _assertPath("prefix", options.prefix);
+      options.postfix = _isUndefined(options.postfix) ? "" : _assertPath("postfix", options.postfix);
+      options.template = _isUndefined(options.template) ? void 0 : _assertPath("template", options.template);
     }
     function _getRelativePath(option, name, tmpDir, cb) {
       if (_isUndefined(name)) return cb(null);
       _resolvePath(name, tmpDir, function(err, resolvedPath) {
         if (err) return cb(err);
         const relativePath = path28.relative(tmpDir, resolvedPath);
-        if (!resolvedPath.startsWith(tmpDir)) {
+        if (relativePath.startsWith("..") || path28.isAbsolute(relativePath)) {
           return cb(new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath}".`));
         }
         cb(null, relativePath);
@@ -125100,7 +125116,7 @@ var require_tmp = __commonJS({
       if (_isUndefined(name)) return;
       const resolvedPath = _resolvePathSync(name, tmpDir);
       const relativePath = path28.relative(tmpDir, resolvedPath);
-      if (!resolvedPath.startsWith(tmpDir)) {
+      if (relativePath.startsWith("..") || path28.isAbsolute(relativePath)) {
         throw new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath}".`);
       }
       return relativePath;

package.json

@@ -31,7 +31,7 @@
     "@actions/io": "^2.0.0",
     "@actions/tool-cache": "^3.0.1",
     "@octokit/plugin-retry": "^8.1.0",
-    "archiver": "^8.0.0",
+    "archiver": "^7.0.1",
     "fast-deep-equal": "^3.1.3",
     "follow-redirects": "^1.16.0",
     "get-folder-size": "^5.0.0",
@@ -69,7 +69,7 @@
     "nock": "^14.0.15",
     "sinon": "^22.0.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.3"
+    "typescript-eslint": "^8.59.4"
   },
   "overrides": {
     "@actions/tool-cache": {

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+    uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

pr-checks/package.json

@@ -11,6 +11,6 @@
   },
   "devDependencies": {
     "@types/node": "^20.19.41",
-    "tsx": "^4.21.0"
+    "tsx": "^4.22.3"
   }
 }