chore(deps): bump slackapi/slack-github-action from 3.0.5 to 4.0.0

[dependabot]

Bumps slackapi/slack-github-action from 3.0.5 to 4.0.0.

Release notes

Sourced from slackapi/slack-github-action's releases.

Slack GitHub Action v4.0.0

Major Changes

• b1974f0: build: parse yaml with more strict multiline indentation rules

  Internal dependencies of js-yaml@v5 make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.

  See the YAML line prefixes spec for the expected indentation rule:

    channel: "C0123"
    text: "first line
  
  second line"
  
  
  second line"

Patch Changes

• 654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages

Changelog

Sourced from slackapi/slack-github-action's changelog.

4.0.0

Major Changes

• b1974f0: build: parse yaml with more strict multiline indentation rules

  Internal dependencies of js-yaml@v5 make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.

  See the YAML line prefixes spec for the expected indentation rule:

    channel: "C0123"
    text: "first line
  
  second line"
  
  
  second line"

Patch Changes

• 654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages

Commits

• dcb1066 chore: release
• 53861e0 chore: release (#645)
• b1974f0 build!: parse yaml with more strict multiline indentation rules (#640)
• 947ed06 build(deps): bump undici from 7.28.0 to 8.7.0 (#653)
• 03922a9 chore: track undici-types to the resolved undici version (#652)
• 31d473e build(deps-dev): bump typescript from 6.0.3 to 7.0.2 (#651)
• 3ca6997 build(deps-dev): bump sinon and @​types/sinon (#649)
• 26a5ad3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#647)
• 5092efb build(deps-dev): bump @​biomejs/biome from 2.5.3 to 2.5.4 (#650)
• 3548c3e build(deps): bump slackapi/slack-github-action from 3.0.3 to 3.0.5 (#646)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: ci/cd. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

g0 security scan

Score 55/100 (F)

Severity	Count
Critical	6
High	49
Medium	10
Low	1

Findings

• CRITICAL /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:226 — Docker socket mounted into container — full container escape possible. Address AA-SC-130: Docker socket mounted into container — full container escape possible
• CRITICAL analyzers/pipeline-taint.ts:4 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• CRITICAL .:0 — Cross-tool risk: fetch-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: db-code-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: write-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: shell-network. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH analyzers/parsers/mcp.ts:102 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:52 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:54 — Database tool without input validation. Use parameterized queries and validate all input before database operations.
• HIGH analyzers/rules/code-execution.ts:440 — child_process.exec() usage detected. Use child_process.execFile() or child_process.spawn() instead of exec/execSync to avoid shell injection.

57 more findings

• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).
• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH testing/payloads/openclaw-attacks.ts:66 — OpenAI API key detected in source code. Move secrets to environment variables or a secret manager. Never commit secrets to source code.
• HIGH analyzers/rules/code-execution.ts:16 — eval() with dynamic input. Remove eval() usage. Use safe alternatives like JSON.parse() or ast.literal_eval().
• HIGH analyzers/rules/code-execution.ts:163 — new Function() constructor used. Remove new Function() usage. Use safe alternatives.
• HIGH analyzers/parsers/langchain.ts:177 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/parsers/mcp.ts:145 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/rules/code-execution.ts:804 — Unsandboxed Docker socket access. Avoid mounting the Docker socket directly. Use a restricted Docker API proxy or rootless Docker.
• HIGH analyzers/rules/code-execution.ts:167 — Function() constructor with dynamic input. Avoid new Function() with dynamic input. Use safe alternatives or a sandboxed environment.
• HIGH analyzers/rules/code-execution.ts:980 — Template engine SSTI risk. Never pass user input directly into template strings. Use render_template() with named templates instead.
• HIGH analyzers/rules/code-execution.ts:1840 — ptrace/debugging syscall detected. Block ptrace and debugging syscalls via seccomp profiles. Set Yama ptrace_scope to restricted.
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:85 — LLM-generated code execution. Sandbox code execution or use allowlisted operations only
• HIGH /home/runner/work/g0/g0/src/endpoint/agentic-browser-scanner.ts:61 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:10 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:56 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/process-detector.ts:75 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — All environment variables dumped — credential exposure. Address AA-DL-109: All environment variables dumped — credential exposure
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:41 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:63 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:80 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:97 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:114 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:131 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:146 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:161 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:179 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/auditd-rules.ts:55 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:63 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:70 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:570 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:637 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:210 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:369 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:513 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:544 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:545 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH analyzers/parsers/langchain.ts:666 — System prompt has no scope boundaries. Add explicit role definition, allowed actions, and behavioral boundaries to the system prompt.
• HIGH analyzers/rules/tool-safety.ts:1074 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH endpoint/tetragon-rules.ts:372 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH .:0 — Cross-tool risk: read-then-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH .:0 — Cross-tool risk: db-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:128 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• MEDIUM /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:734 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• MEDIUM analyzers/parsers/langchain.ts:55 — Filesystem tool without path validation. Validate and sanitize file paths. Use allowlists for permitted directories.
• MEDIUM analyzers/rules/code-execution.ts:399 — os.system call detected. Validate and sanitize all inputs before passing to subprocess.
• MEDIUM enforcement/edm.ts:23 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM testing/judge/llm-prompts.ts:69 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/sensitive-paths.ts:60 — Untrusted input flows to file path operation — path traversal risk. Address AA-CE-052: Untrusted input flows to file path operation — path traversal risk
• MEDIUM /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — Agent accesses environment variables. Address AA-RA-043: Agent accesses environment variables
• MEDIUM /home/runner/work/g0/g0/src/endpoint/agent-config-scanner.ts:257 — Tool has email sending capability — phishing and data exfiltration risk. Address AA-TS-105: Tool has email sending capability — phishing and data exfiltration risk
• MEDIUM analyzers/parsers/langchain.ts:56 — Tool has unrestricted network access. Address AA-TS-062: Tool has unrestricted network access
• LOW analyzers/parsers/langchain.ts:204 — Agent has no system prompt — vulnerable to unbounded behavior. Address AA-GI-073: Agent has no system prompt — vulnerable to unbounded behavior
• INFO analyzers/parsers/langchain.ts:204 — Agent has no error handler configured. Address AA-CF-064: Agent has no error handler configured

Gate: PASSED ✅

— See findings across every repo in your org → https://guard0.ai/signup?utm_source=github&utm_medium=pr_comment&utm_campaign=g0_action