Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

getArtifact function using deprecated (due to security and usability issues) buffer function #1618

Open
twalshOG opened this issue Jan 5, 2024 · 2 comments
Labels
bug Something isn't working

Comments

@twalshOG
Copy link

twalshOG commented Jan 5, 2024

Describe the bug
Receive a deprecation warning when using downloading an artifact

To Reproduce
Steps to reproduce the behavior:

  1. Use the the downloadArtifact functionality in a Github actions pipeline
  2. Note you get the following error

(node:1671) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use node --trace-deprecation ... to show where the warning was created)

Code producing the warning

import * as artifact from '@actions/artifact';
.........
  const response = await artifact.default.getArtifact(artifactName);
  const artifactClient = artifact.default;
  await artifactClient.downloadArtifact(response.artifact.id, {
    path: downloadFolder,
  });

Expected behavior
Would not get the error.
This error is due to the fact that @actions/artifact is depending on archiver 5.3.1 which in turn depends on archiver-utils 2.1.0 which use using the depreciated buffer call.

Screenshots
Screenshot 2024-01-05 at 1 05 40 PM

**Where produced **

  • Github Actions Agent: ubuntu-latest
  • Node version: Default version installed on ubuntu-latest

Additional context
Updating to a new version (3.0.0 or above) would address this issue.
The fix/update to this was already released for archiver-utils.

@TWiStErRob
Copy link

TWiStErRob commented Feb 3, 2024

To finish the amazing investigation, and give actionable steps for this project:

"archiver": "^5.3.1",

The above line needs to be updated from 5.3.1 to at least 6.0.0, which doesn't look like a big jump, as the only breaking change listed is dropping Node 10. 6.0.0 uses archiver-utils 3.0.0.

@hubert-rutkowski85
Copy link

Bump - it seems like a simple and useful change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants