You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/07/14 12:01:37 UTC

(superset) branch fix-security/setup-node-ref-version-mismatch-translations created (now debb37b139a)

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix-security/setup-node-ref-version-mismatch-translations
in repository https://gitbox.apache.org/repos/asf/superset.git


      at debb37b139a fix(security): correct mismatched version comment for actions/setup-node pin

This branch includes the following new commits:

     new debb37b139a fix(security): correct mismatched version comment for actions/setup-node pin

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: fix(security): correct mismatched version comment for actions/setup-node pin

Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix-security/setup-node-ref-version-mismatch-translations
in repository https://gitbox.apache.org/repos/asf/superset.git

commit debb37b139a62100fa1aa7738c4310ffdf35bff6
Author: Evan <ev...@preset.io>
AuthorDate: Tue Jul 14 05:01:09 2026 -0700

    fix(security): correct mismatched version comment for actions/setup-node pin
    
    The pinned SHA 48b55a01...4041e in superset-translations.yml resolves to
    tag v6.4.0, not v6 as annotated (v6 points to a different commit,
    249970729cb0). Update the trailing comment to match, consistent with
    other workflows that already pin this SHA as v6.4.0.
    
    Resolves code-scanning alert #2579 (zizmor/ref-version-mismatch).
    
    Co-Authored-By: Claude Sonnet 5 <no...@anthropic.com>
---
 .github/workflows/superset-translations.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/superset-translations.yml b/.github/workflows/superset-translations.yml
index 6af773ff137..8a440ddc359 100644
--- a/.github/workflows/superset-translations.yml
+++ b/.github/workflows/superset-translations.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.check.outputs.frontend
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: "./superset-frontend/.nvmrc"
           cache: "npm"