Fixes Artifact poisoning vulnerability in action-download-artifact v5 and earlier #1

Ed-Pavlov · Ed-Pavlov · commit 065986190586 · 2025-03-16T22:49:47.000+01:00
diff --git a/.github/workflows/release-to-market.yml b/.github/workflows/release-to-market.yml
@@ -14,7 +14,7 @@ jobs:
       # https://github.com/dawidd6/action-download-artifact
       -
         name: Download artifact
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@v9
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           workflow:     build-and-test.yml         # Required, workflow file name or ID

Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ jobs:`
`14`	`14`	`# https://github.com/dawidd6/action-download-artifact`
`15`	`15`	`-`
`16`	`16`	`name: Download artifact`
`17`		`- uses: dawidd6/action-download-artifact@v2`
	`17`	`+ uses: dawidd6/action-download-artifact@v9`
`18`	`18`	`with:`
`19`	`19`	`github_token: ${{ secrets.GITHUB_TOKEN }}`
`20`	`20`	`workflow: build-and-test.yml # Required, workflow file name or ID`