Repository: r5py/r5py (language: python)

Issue:
GitHub’s `download-artifact` action is vulnerable
https://github.com/advisories/GHSA-cxww-7g56-2vh6


Discussion / hints:

Fix patch:
diff --git a/.github/workflows/build-merged-pull-requests.yml b/.github/workflows/build-merged-pull-requests.yml
index 38c40c2a..d48acee5 100644
--- a/.github/workflows/build-merged-pull-requests.yml
+++ b/.github/workflows/build-merged-pull-requests.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4
       - name: Install Python
         uses: actions/setup-python@v4
         with:
diff --git a/.github/workflows/release-and-deploy-v-tags.yml b/.github/workflows/release-and-deploy-v-tags.yml
index 596d1691..96fbafca 100644
--- a/.github/workflows/release-and-deploy-v-tags.yml
+++ b/.github/workflows/release-and-deploy-v-tags.yml
@@ -21,7 +21,7 @@ jobs:
     permissions: write-all
     steps:
       - name: Clone repository, check-out stable
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: stable
@@ -37,12 +37,12 @@ jobs:
     needs: [build]
     steps:
       - name: Download built artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: package
           path: dist/
       - name: Upload package to PyPi
-        uses: pypa/gh-action-pypi-publish@release/v1.5
+        uses: pypa/gh-action-pypi-publish@release/v1.10
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}
@@ -57,12 +57,12 @@ jobs:
       contents: write
     steps:
       - name: Download built artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: package
           path: dist/
       - name: Create release and upload package
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: dist/*
 
@@ -75,12 +75,12 @@ jobs:
       contents: write
     steps:
       - name: Download built artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: package
           path: dist/
       - name: Create release and upload package
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: dist/*
           prerelease: true


Test patch:
diff --git a/.github/workflows/lint-test-upon-push.yml b/.github/workflows/lint-test-upon-push.yml
index 53184ce8..579ce549 100644
--- a/.github/workflows/lint-test-upon-push.yml
+++ b/.github/workflows/lint-test-upon-push.yml
@@ -18,7 +18,7 @@ jobs:
     name: Linting code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: 3.12
@@ -46,7 +46,7 @@ jobs:
           - '3.9'
 
     steps:
-      -  uses: actions/checkout@v4.1.1
+      -  uses: actions/checkout@v4
 
       - uses: actions/setup-java@v4
         with: