chore(core): upgrade @octokit deps to fix CVE-2025-25288 (paginate-rest ReDoS)

.github/actions/build-cache/action.yml

@@ -5,7 +5,7 @@ runs:
   using: "composite"
   steps:
     - name: build cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           node_modules

.github/actions/install-deps/action.yml

@@ -5,12 +5,12 @@ runs:
   using: "composite"
   steps:
     - name: Use nodejs
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
-        node-version: 16.18
+        node-version: 20
 
     - name: restore workspace cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       id: node_modules
       with:
         path: |
@@ -25,7 +25,7 @@ runs:
       shell: bash
 
     - name: restore pkg cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       id: pkg
       with:
         path: ~/.pkg-cache
@@ -37,6 +37,6 @@ runs:
       if: steps.pkg.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        yarn pkg-fetch -n node16 -p macos -a x64
-        yarn pkg-fetch -n node16 -p win -a x64
-        yarn pkg-fetch -n node16 -p linux -a x64
+        yarn pkg-fetch -n node18 -p macos -a x64
+        yarn pkg-fetch -n node18 -p win -a x64
+        yarn pkg-fetch -n node18 -p linux -a x64

.github/workflows/build.yml

@@ -24,14 +24,14 @@ jobs:
   install:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/install-deps
 
   build:
     runs-on: ubuntu-latest
     needs: install
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Prepare repository
         run: git fetch --unshallow --tags
       - uses: ./.github/actions/install-deps
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/install-deps
       - uses: ./.github/actions/build-cache
       - uses: 8BitJonny/gh-get-current-pr@2.2.0
@@ -60,7 +60,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/install-deps
       - uses: ./.github/actions/build-cache
       - run: yarn lint
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/install-deps
       - uses: ./.github/actions/build-cache
       - name: Prepare repository
@@ -85,7 +85,7 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'ci skip') && !contains(github.event.head_commit.message, 'skip ci')"
     needs: build
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: 8BitJonny/gh-get-current-pr@2.2.0
         id: PR
         with:

package.json

@@ -46,6 +46,7 @@
     "@fortawesome/react-fontawesome": "^0.1.9",
     "@types/jest": "^26.0.0",
     "@types/mock-fs": "^4.13.0",
+    "@types/node": "^18.19.0",
     "@types/parse-github-url": "1.0.0",
     "@types/tapable": "2.2.2",
     "@typescript-eslint/eslint-plugin": "^4.1.1",
@@ -78,9 +79,13 @@
     "simple-react-lightbox": "^3.1.2-3",
     "title-case": "^3.0.2",
     "ts-jest": "^26.1.3",
-    "typescript": "~4.2.3",
+    "typescript": "~4.9.5",
     "webpack": "^4.46.0"
   },
+  "resolutions": {
+    "@types/node": "^18.19.0",
+    "@types/readable-stream": "^4.0.0"
+  },
   "husky": {
     "hooks": {
       "pre-commit": "lint-staged"

packages/core/package.json

@@ -38,12 +38,12 @@
   },
   "dependencies": {
     "@auto-it/bot-list": "link:../../packages/bot-list",
-    "@endemolshinegroup/cosmiconfig-typescript-loader": "^3.0.2",
-    "@octokit/core": "^3.5.1",
-    "@octokit/plugin-enterprise-compatibility": "1.3.0",
-    "@octokit/plugin-retry": "^3.0.9",
-    "@octokit/plugin-throttling": "^3.6.2",
-    "@octokit/rest": "^18.12.0",
+    "cosmiconfig-typescript-loader": "^4.4.0",
+    "@octokit/core": "^5.2.2",
+    "@octokit/plugin-enterprise-compatibility": "^4.1.0",
+    "@octokit/plugin-retry": "^6.1.0",
+    "@octokit/plugin-throttling": "^8.2.0",
+    "@octokit/rest": "^20.1.2",
     "await-to-js": "^3.0.0",
     "chalk": "^4.0.0",
     "cosmiconfig": "7.0.0",
@@ -92,7 +92,7 @@
     "@types/graphql": "^14.2.0",
     "@types/jest": "~26.0.7",
     "@types/lodash.chunk": "^4.2.6",
-    "@types/node": "^13.1.8",
+    "@types/node": "^18.19.0",
     "@types/node-fetch": "2.6.1",
     "@types/semver": "^7.1.0",
     "@types/signale": "^1.2.1",

packages/core/src/__tests__/git.test.ts

@@ -383,7 +383,7 @@ describe("github", () => {
     });
 
     expect(issuesAndPullRequests).toHaveBeenCalledWith({
-      advanced_search: true,
+      advanced_search: "true",
       q: "repo:Adam Dierkens/test AND (is:pr AND is:open)",
       order: "desc",
     });

packages/core/src/config.ts

@@ -2,7 +2,7 @@ import { cosmiconfig } from "cosmiconfig";
 import merge from "deepmerge";
 import fetch from "node-fetch";
 import * as path from "path";
-import TypeScriptLoader from "@endemolshinegroup/cosmiconfig-typescript-loader";
+import { TypeScriptLoader as createTypeScriptLoader } from "cosmiconfig-typescript-loader";
 
 import { getVersionMap } from "./release";
 import { ILogger } from "./utils/logger";
@@ -88,7 +88,7 @@ export default class Config {
         `${name}.config.js`,
       ],
       loaders: {
-        ".ts": TypeScriptLoader,
+        ".ts": createTypeScriptLoader(),
       },
     });
     const result = await explorer.search();

packages/core/src/git.ts

@@ -98,8 +98,6 @@ const makePrBodyIdentifier = (context: string) =>
   makeIdentifier("PR BODY", context);
 
 interface ThrottleOpts {
-  /** The request object */
-  request: { /** What retry we are on */ retryCount: number };
   /** API method that was throttled */
   method: string;
   /** URL that was throttled */
@@ -136,26 +134,30 @@ export default class Git {
     this.github = new GitHub({
       baseUrl: this.baseUrl,
       auth: this.options.token,
-      previews: ["symmetra-preview"],
       request: { agent: this.options.agent },
       throttle: {
         /** Add a wait once rate limit is hit */
-        onRateLimit: (retryAfter: number, opts: ThrottleOpts) => {
+        onRateLimit: (
+          retryAfter: number,
+          opts: ThrottleOpts,
+          _octokit: unknown,
+          retryCount: number
+        ) => {
           this.logger.log.warn(
             `Request quota exhausted for request ${opts.method} ${opts.url}`
           );
 
-          if (opts.request.retryCount < 5) {
+          if (retryCount < 5) {
             this.logger.log.log(
               `Retrying after ${prettyMs(retryAfter * 1000)}!`
             );
             return true;
           }
         },
-        /** wait after abuse */
-        onAbuseLimit: (retryAfter: number, opts: ThrottleOpts) => {
+        /** wait after hitting a secondary rate limit */
+        onSecondaryRateLimit: (retryAfter: number, opts: ThrottleOpts) => {
           this.logger.log.error(
-            `Went over abuse rate limit ${opts.method} ${
+            `Hit secondary rate limit ${opts.method} ${
               opts.url
             }, retrying in ${prettyMs(retryAfter * 1000)}.`
           );
@@ -519,7 +521,10 @@ export default class Git {
   ) {
     const repo = `repo:${this.options.owner}/${this.options.repo}`;
     options.q = `${repo} AND (${options.q})`;
-    options.advanced_search = true;
+    // The REST search endpoint uses the new "advanced search" engine; the
+    // parameter isn't in the typed surface of @octokit/rest, so attach it
+    // via an index cast.
+    (options as Record<string, unknown>).advanced_search = "true";
 
     this.logger.verbose.info("Searching repo using:\n", options);
 

packages/core/src/utils/omit.ts

@@ -6,5 +6,7 @@ export const omit = <Props, Prop extends keyof Props>(
   keys: Prop[]
 ) =>
   fromEntries(
-    Object.entries(obj).filter(([key]) => !keys.includes(key as Prop))
+    Object.entries(obj as Record<string, unknown>).filter(
+      ([key]) => !keys.includes(key as Prop)
+    )
   ) as Omit<Props, Prop>;

packages/core/src/utils/verify-auth.ts

@@ -27,7 +27,10 @@ export default function verifyAuth(remote: string, branch: string) {
 
       timeout = setTimeout(() => {
         // Kill the spawned process and it's children
-        process.kill(-child.pid);
+        if (child.pid) {
+          process.kill(-child.pid);
+        }
+
         resolve(false);
       }, 5 * 1000);
 

plugins/all-contributors/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@auto-it/bot-list": "link:../../packages/bot-list",
     "@auto-it/core": "link:../../packages/core",
-    "@octokit/rest": "^18.12.0",
+    "@octokit/rest": "^20.1.2",
     "all-contributors-cli": "6.19.0",
     "anymatch": "^3.1.1",
     "await-to-js": "^3.0.0",

plugins/exec/src/index.ts

@@ -27,7 +27,7 @@ function makeHooksType<HookObject, ExcludedHook extends keyof HookObject>(
   exclude: ExcludedHook[]
 ) {
   type HookType = keyof HookObject;
-  const hooks = Object.keys(hookCreatorFn()) as HookType[];
+  const hooks = Object.keys(hookCreatorFn() as Record<string, unknown>) as HookType[];
 
   return t.partial(
     fromEntries(
@@ -84,7 +84,8 @@ const runExecSync = (
       .join("\n")}
     `);
 
-    execResult = trim(execSync(command, options));
+    const output = execSync(command, options);
+    execResult = trim(typeof output === "string" ? output : output.toString());
   } catch (e) {
     if (e && e.code === "E2BIG") {
       auto.logger.log.error(endent`

plugins/first-time-contributor/package.json

@@ -44,7 +44,7 @@
     "url-join": "^4.0.0"
   },
   "devDependencies": {
-    "@octokit/rest": "^18.12.0",
+    "@octokit/rest": "^20.1.2",
     "@types/array.prototype.flatmap": "^1.2.0"
   }
 }

plugins/microsoft-teams/src/index.ts

@@ -168,7 +168,7 @@ export default class MicrosoftTeamsPlugin {
         ],
       }),
       headers: { "Content-Type": "application/json" },
-      agent,
+      agent: agent as any,
     });
 
     auto.logger.verbose.info("Posted release notes to microsoft teams.");

plugins/npm/package.json

@@ -54,7 +54,7 @@
     "user-home": "^2.0.0"
   },
   "devDependencies": {
-    "@octokit/rest": "^18.12.0",
+    "@octokit/rest": "^20.1.2",
     "@types/env-ci": "^3.1.0",
     "@types/semver": "^7.1.0",
     "@types/url-join": "^4.0.0",

plugins/protected-branch/package.json

@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "@auto-it/core": "link:../../packages/core",
-    "@octokit/rest": "^18.12.0",
+    "@octokit/rest": "^20.1.2",
     "fp-ts": "^2.5.3",
     "io-ts": "^2.1.2",
     "tslib": "1.10.0"

plugins/released/package.json

@@ -46,6 +46,6 @@
     "tslib": "2.1.0"
   },
   "devDependencies": {
-    "@octokit/rest": "^18.12.0"
+    "@octokit/rest": "^20.1.2"
   }
 }

plugins/released/src/index.ts

@@ -173,10 +173,10 @@ export default class ReleasedLabelPlugin implements IPlugin {
 
     const issues = messages
       .map((message) => message.match(closeIssue))
-      .filter((r): r is string[] => Boolean(r))
-      .reduce((all, arr) => [...all, ...arr], [])
+      .filter((r): r is RegExpMatchArray => Boolean(r))
+      .reduce<string[]>((all, arr) => [...all, ...arr], [])
       .map((issue) => issue.match(/#(\d+)/i))
-      .filter((r: RegExpMatchArray | null): r is RegExpMatchArray => Boolean(r))
+      .filter((r): r is RegExpMatchArray => Boolean(r))
       .map((match) => Number(match[1]));
 
     await Promise.all(

plugins/slack/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@atomist/slack-messages": "^1.2.2",
     "@auto-it/core": "link:../../packages/core",
-    "@octokit/rest": "^18.12.0",
+    "@octokit/rest": "^20.1.2",
     "fp-ts": "^2.5.3",
     "https-proxy-agent": "^5.0.0",
     "io-ts": "^2.1.2",

plugins/slack/src/index.ts

@@ -430,7 +430,7 @@ export default class SlackPlugin implements IPlugin {
                 "Content-Type": "application/json; charset=utf-8",
                 Authorization: `Bearer ${token}`,
               },
-              agent,
+              agent: agent as any,
             });
           }, Promise.resolve());
         } else {
@@ -449,7 +449,7 @@ export default class SlackPlugin implements IPlugin {
                 "application/x-www-form-urlencoded; charset=utf-8",
               Authorization: `Bearer ${token}`,
             },
-            agent,
+            agent: agent as any,
           });
         }
       }, Promise.resolve());
@@ -464,7 +464,7 @@ export default class SlackPlugin implements IPlugin {
           channel: this.options.channel,
         }),
         headers: { "Content-Type": "application/json" },
-        agent,
+        agent: agent as any,
       });
     }
 

plugins/upload-assets/package.json

@@ -48,6 +48,6 @@
     "tslib": "2.1.0"
   },
   "devDependencies": {
-    "@octokit/rest": "^18.12.0"
+    "@octokit/rest": "^20.1.2"
   }
 }

tsconfig.json

@@ -10,6 +10,8 @@
     "importHelpers": true, // Use tslib for helper code
     /* Syntax: */
     "strict": true,
+    "useUnknownInCatchVariables": false,
+    "skipLibCheck": true,
     "downlevelIteration": true,
     "resolveJsonModule": true,
     "allowSyntheticDefaultImports": true,