mirror of
https://github.com/gradle/actions.git
synced 2026-11-08 19:14:54 +00:00
A dependency graph file downloaded from another workflow run may come from an untrusted fork. Passing the parsed file whole to octokit.request() let keys such as 'url' override the request destination and leak the token.