Repository navigation
ci: grant release job contents: write for asset upload (SEC-842) - #596
Draft
Matt Sutkus (msuitcase) wants to merge 3 commits into
Draft
Matt Sutkus (msuitcase) wants to merge 3 commits into
Matt Sutkus (msuitcase) wants to merge 3 commits into
Conversation
… entries Fixes GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp in @vitest/mocker. Lockfile only; package.json ranges are unchanged. Removes GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx from audit-ci.jsonc, which audit-ci reports as no longer matching anything.
1 of 4 tasks
Justin Hammond (Justintime50)
added a commit
that referenced
this pull request
Oct 27, 2026
# Description Preps v9.0.0 (GA) for release, promoting v9.0.0-rc.1: bumps the version in `package.json`/`package-lock.json` and dates the CHANGELOG entry. Follows the v6.0.0 GA-after-RC precedent: the v9.0.0 entry lists the changes since rc.1 and points to the rc.1 entry (with its full breaking-changes list) and the Upgrade Guide. See our [Upgrade Guide](UPGRADE_GUIDE.md#upgrading-from-8x-to-90) for more details. Includes all of the changes made in v9.0.0-rc.1 below plus the following: - Adds `surcharges` property and model to `Rate` object - Removes the deprecated, unusable `addCreditCard` function - Stripe has disabled the ability to pass plain credit card details over the wire and now requires using [Stripe.js/Elements/Checkout](https://support.stripe.com/questions/card-tokenization-restrictions-using-publishable-keys). Follow the [Decentralized (EasyPost-Manage Billing) Guide](https://docs.easypost.com/guides/get-started-with-forge/easypost-managed-billing-guide#referralcustomer-billing-management) for more details on the new flow to use. - Makes `referralCustomer.retrieveEasyPostStripeApiKey` public to help facilitate adding credit cards using Stripe.js - Adds support for `FedexDefaultAccount`, `GofoWalletAccount`, `UpsDapAccount`, `UniUniWalletAccount`, and `VehoWalletAccount` by properly routing carrier-account create requests to the `/carrier_accounts/open` endpoint. - Also pins CI runners from `ubuntu-latest` to `ubuntu-24.04`: `ubuntu-latest` moved to Ubuntu 26.04, which dropped older language versions from our test matrix, so this keeps CI on 24.04 until a later modernization effort. - Also runs `npm update` to refresh `package-lock.json` within existing semver ranges, clearing the dev-dependency advisories (vitest, body-parser, qs, markdown-it) that were failing the `audit-ci` scan. <!-- Please provide a general summary of your PR changes and link any related issues or other pull requests. --> # Testing <!-- Please provide details on how you tested this code. See below. - All pull requests must be tested (unit tests where possible with accompanying cassettes, or provide a screenshot of end-to-end testing when unit tests are not possible) - New features must get a new unit test - Bug fixes/refactors must re-record existing cassettes --> # Pull Request Type Please select the option(s) that are relevant to this PR. - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [x] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Improvement (fixing a typo, updating readme, renaming a variable name, etc) ## Reviewer notes - Draft PR #596 (`ci: grant release job contents: write for asset upload`, SEC-842) is still open and may need to land before this release so the release workflow can upload assets. - This is a major (GA) release: see the v9.0.0-rc.1 breaking changes and `UPGRADE_GUIDE.md` ("Upgrading from 8.x to 9.0"). The deprecated `addCreditCard` removal rides along with the major.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Why
#586 added a workflow-level
permissions: contents: readtorelease.yml. TheUpload assets to releasestep (AButler/upload-release-assets) callsrepos.uploadReleaseAsset, which needscontents: write. No release has run since #586: the last one (v9.0.0-rc.1, 2026-09-08) predates it and gotContents: writefrom the repo default. The next release would publish to npm, then fail the upload with a 403 and leave the release withouteasypost.js/easypost.mjs.Change
permissionsblock.permissionson thereleasejob instead:id-token: write(npm trusted publishing) andcontents: write(asset upload).Related: #592 (
ci.ymlleast-privilege permissions).Part of SEC-842.
Testing
release.ymlonly runs on a published release orworkflow_dispatch, so this PR's CI does not exercise it. Verify on the next release thatUpload assets to releasesucceeds and the release shows both assets.Pull Request Type