Repository navigation
chore: update deno.lock and freeze install during build - #40038
Merged
Merged
RC - Layne / Layne Security Scan
succeeded
Apr 9, 2026 in 6s
Layne — success
Found 2 issue(s): 0 critical, 2 high, 0 medium, 0 low.
Excepted findings:
- LAYNE-bc53564af2f571b1 [semgrep/app.config.semgrep.rules.nodejs.child-process-execution] packages/apps-engine/scripts/deno-cache.js:39 — excepted by @julio-rocketchat: "Both findings are safe implementation of spawn/exec - one of them is hardcoded and the other one is an envvar."
- LAYNE-d65ee2923b3981c6 [semgrep/app.config.semgrep.rules.nodejs.child-process-execution] packages/apps-engine/scripts/deno-cache.js:82 — excepted by @julio-rocketchat: "Both findings are safe implementation of spawn/exec - one of them is hardcoded and the other one is an envvar."
All findings are still annotated below for reference.
Annotations
Check failure on line 39 in packages/apps-engine/scripts/deno-cache.js
rc-layne / Layne Security Scan
[semgrep] app.config.semgrep.rules.nodejs.child-process-execution
[R39] Child process execution detected. Ensure command and arguments are not user-controlled.
Command injection (CWE-78) can occur if untrusted input flows into spawn/exec calls.
Remediation:
- Use allowlists for permitted commands
- Validate/sanitize all arguments
- Avoid shell=True or string-based command interpolation
- Prefer execFile/spawn over exec when possible
Check failure on line 82 in packages/apps-engine/scripts/deno-cache.js
rc-layne / Layne Security Scan
[semgrep] app.config.semgrep.rules.nodejs.child-process-execution
[R82] Child process execution detected. Ensure command and arguments are not user-controlled.
Command injection (CWE-78) can occur if untrusted input flows into spawn/exec calls.
Remediation:
- Use allowlists for permitted commands
- Validate/sanitize all arguments
- Avoid shell=True or string-based command interpolation
- Prefer execFile/spawn over exec when possible
Loading