CodeVetter · Repo Unpack · Risk map
semantic-release/semantic-release
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include executable configuration, plugins receiving environment data, authenticated Git subprocesses, and durable remote publication. The main operational hazards arise from partial publication, dry-run side effects, and coupling between branch history and note metadata.
- Shareable configurations and plugins execute imported modules; plugin context includes cloned environment data, so these extension inputs cross a code-execution and credential-trust boundary.
- Authentication fallback embeds selected Git credentials in repository URLs passed to Git; masking covers raw and encoded environment values, but does not remove credentials from subprocess arguments.
- Redaction only selects matching environment names with trimmed values of at least five characters, excludes GOPRIVATE, and only replaces strings; hideSensitiveValues visits direct properties rather than recursively traversing objects.
- Git subprocesses use argument arrays and remote operations include -- before repository URLs; verify additionally rejects URLs beginning with -, with explicit regression tests for Git option injection.
- Dry-run still resolves authentication and fetches branch/tag/note state before lifecycle publication is skipped; it is not a no-network or no-local-Git-write execution mode.
- Hypothesis: a failing publish or success plugin can leave a partially completed release because tags and notes are already pushed, provider hooks run sequentially, and the inspected failure handler performs logging/notification without rollback. (inferred)
- getTagsNotes ignores JSON parse failures, but does not validate parsed note shape before get-tags assigns channels; downstream last-release and promotion logic assume channel arrays.
- The inspected release workflow independently triggers on pushes and has no declared dependency on test jobs; it grants repository/issue/PR write permissions and runs published semantic-release@25.0.1 rather than the checked-out executable.