Skip to content

Fix stored XSS via YAML frontmatter (GHSA-vfhj-c636-h59x) #1123

Fix stored XSS via YAML frontmatter (GHSA-vfhj-c636-h59x)

Fix stored XSS via YAML frontmatter (GHSA-vfhj-c636-h59x) #1123

Triggered via push July 19, 2026 13:15
Status Success
Total duration 47m 4s
Artifacts 1

ci-macos.yml

on: push
Matrix: Build On MacOS
Fit to window
Zoom out
Zoom in

Annotations

9 warnings
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v2, actions/setup-python@v5, actions/upload-artifact@v4, johnwbyrd/update-release@v1.0.0, jurplel/install-qt-action/action@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
Failed to save: <h2>Our services aren't available right now</h2><p>We're working to restore all services as soon as possible. Please check back soon.</p>0bc5cagAAAABJ5FofyXx/S4r95rHwN1GXTEFYMzExMDAwMTExMDUxAEVkZ2U=
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
Failed to restore: Cache service responded with 400
Build On MacOS (Build on Arm64, macos-latest, universal, 6.9.3)
The following taps are not trusted: aws/tap Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required. Untap them with: brew untap aws/tap Trust specific formulae, casks and commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> Whole-tap trust is broader and includes all current and future formulae, casks and commands from the listed taps. Trust whole taps with: brew trust aws/tap To disable trust checks: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release. For more information, see: https://docs.brew.sh/Tap-Trust

Artifacts

Produced during runtime
Name Size Digest
VNote-4.2.0-mac-universal
271 MB
sha256:5ee998ac345b2b5f8f279194671661330b7fb267f4352f810828b5a49a65415c