{"id":787995,"name":"@actions/http-client","ecosystem":"npm","description":"Actions Http Client","homepage":"https://github.com/actions/toolkit/tree/main/packages/http-client","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/actions/toolkit","keywords_array":["github","actions","http"],"namespace":"actions","versions_count":25,"first_release_published_at":"2020-01-10T04:31:14.445Z","latest_release_published_at":"2026-04-21T21:42:26.809Z","latest_release_number":"4.0.1","last_synced_at":"2026-09-28T00:23:10.061Z","created_at":"2022-04-07T13:03:13.807Z","updated_at":"2026-09-28T19:51:20.580Z","registry_url":"https://www.npmjs.com/package/@actions/http-client","install_command":"npm install @actions/http-client","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"4.0.1"},"contentPolicy":null},"repo_metadata":{"id":37793145,"uuid":"182299236","full_name":"actions/toolkit","owner":"actions","description":"The GitHub ToolKit for developing GitHub Actions.","archived":false,"fork":false,"pushed_at":"2026-09-25T18:33:51.000Z","size":12712,"stargazers_count":5858,"open_issues_count":591,"forks_count":1809,"subscribers_count":154,"default_branch":"main","last_synced_at":"2026-09-27T15:55:07.048Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://github.com/features/actions","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/actions.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2019-04-19T17:08:00.000Z","updated_at":"2026-09-26T10:36:59.000Z","dependencies_parsed_at":"2026-09-05T23:25:52.686Z","dependency_job_id":"edb81f10-46b2-4164-8a5a-eed032bd20b4","html_url":"https://github.com/actions/toolkit","commit_stats":{"total_commits":1115,"total_committers":159,"mean_commits":7.012578616352202,"dds":0.8887892376681614,"last_synced_commit":"ee93b05ee9979c0f7c22e6b648d9fb11b024eeb2"},"previous_names":[],"tags_count":19,"template":false,"template_full_name":null,"purl":"pkg:github/actions/toolkit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/actions","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/sbom","scorecard":{"id":163799,"data":{"date":"2025-08-11","repo":{"name":"github.com/actions/toolkit","commit":"227b1ce741a925ae9f5fdef91fd10415f2d0ca45"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.1,"checks":[{"name":"Maintained","score":10,"reason":"30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":9,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected: packages/tool-cache/scripts/externals/7zdec.exe:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE.md:0","Info: FSF or OSI recognized license: MIT License: LICENSE.md:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/releases.yml:68","Warn: no topLevel permission defined: .github/workflows/artifact-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/audit.yml:1","Warn: no topLevel permission defined: .github/workflows/cache-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/cache-windows-test.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql.yml:1","Warn: no topLevel permission defined: .github/workflows/releases.yml:1","Warn: no topLevel permission defined: .github/workflows/unit-tests.yml:1","Warn: no topLevel permission defined: .github/workflows/update-github.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":1,"reason":"dependency not pinned by hash detected -- score normalized to 1","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/artifact-tests.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/artifact-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/artifact-tests.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/artifact-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/artifact-tests.yml:99: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/artifact-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/artifact-tests.yml:168: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/artifact-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/artifact-tests.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/artifact-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/artifact-tests.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/artifact-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/artifact-tests.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/artifact-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/audit.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/audit.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-tests.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/cache-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-tests.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/cache-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-windows-test.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/cache-windows-test.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-windows-test.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/cache-windows-test.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/codeql.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releases.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/releases.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releases.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/releases.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releases.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/releases.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/releases.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/releases.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-tests.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/unit-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-tests.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/unit-tests.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-github.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/update-github.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-github.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/actions/toolkit/update-github.yaml/main?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/audit.yml:30","Warn: npmCommand not pinned by hash: .github/workflows/releases.yml:43","Warn: npmCommand not pinned by hash: .github/workflows/unit-tests.yml:39","Warn: npmCommand not pinned by hash: .github/workflows/update-github.yaml:17","Info:   0 out of  25 GitHub-owned GitHubAction dependencies pinned","Info:   6 out of  10 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":6,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'","Info: 'stale review dismissal' is required to merge on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Info: codeowner review is required on branch 'main'","Info: 'last push approval' is required to merge on branch 'main'","Warn: no status checks found to merge onto branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"10 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8","Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q","Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38","Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc","Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-52f5-9888-hmc6","Warn: Project is vulnerable to: GHSA-cxrh-j4jr-qwg3"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-16T14:18:14.187Z","repository_id":37793145,"created_at":"2025-08-16T14:18:14.187Z","updated_at":"2025-08-16T14:18:14.187Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37767337,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-27T02:00:07.257Z","response_time":91,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"actions","name":"GitHub Actions","uuid":"44036562","kind":"organization","description":"Automate your GitHub workflows","email":null,"website":"https://github.com/features/actions","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/44036562?v=4","repositories_count":84,"last_synced_at":"2026-09-24T22:58:13.632Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/actions","funding_links":[],"total_stars":103573,"followers":11023,"following":0,"created_at":"2022-11-02T16:25:53.210Z","updated_at":"2026-09-24T22:58:13.645Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/actions","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/actions/repositories"},"tags":[{"name":"@actions/cache@4.0.0","sha":"b7a00a3203cfa62623760990f5171f9b4a2ab1a7","kind":"commit","published_at":"2024-12-04T19:09:19.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/cache@4.0.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/cache@4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fcache%404.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcache@4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcache@4.0.0/manifests"},{"name":"@actions/artifact@2.0.1","sha":"0389dcd5e45f77675a9d06a8da8bdc331f07e883","kind":"tag","published_at":"2024-01-10T15:50:20.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/artifact@2.0.1","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/artifact@2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fartifact%402.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fartifact@2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fartifact@2.0.1/manifests"},{"name":"@actions/cache@3.2.2","sha":"f74ff155bd3211486732923c2801c20523450d06","kind":"tag","published_at":"2023-08-07T17:37:08.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/cache@3.2.2","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/cache@3.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fcache%403.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcache@3.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcache@3.2.2/manifests"},{"name":"@actions/http-client@2.1.1","sha":"19e00168782d1936225228c0fcf47b8a0e76f868","kind":"tag","published_at":"2023-08-04T19:20:02.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/http-client@2.1.1","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/http-client@2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fhttp-client%402.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fhttp-client@2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fhttp-client@2.1.1/manifests"},{"name":"@actions/artifact@1.1.1","sha":"91d3933eb52b351f437151400a88ba7d57442a9b","kind":"commit","published_at":"2023-06-22T09:03:38.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/artifact@1.1.1","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/artifact@1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fartifact%401.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fartifact@1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fartifact@1.1.1/manifests"},{"name":"@actions/http-client@2.0.1-test-tag","sha":"0d44da2b87f9ed48ae889d15c6cc19667aa37ec0","kind":"commit","published_at":"2023-03-07T11:11:44.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/http-client@2.0.1-test-tag","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/http-client@2.0.1-test-tag","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fhttp-client%402.0.1-test-tag","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fhttp-client@2.0.1-test-tag","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fhttp-client@2.0.1-test-tag/manifests"},{"name":"@actions/tool-cache@1.1.1","sha":"a2ab4bcf78e4f7080f0d45856e6eeba16f0bbc52","kind":"tag","published_at":"2019-09-05T15:03:19.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/tool-cache@1.1.1","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/tool-cache@1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Ftool-cache%401.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Ftool-cache@1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Ftool-cache@1.1.1/manifests"},{"name":"@actions/io@1.0.1","sha":"a2ab4bcf78e4f7080f0d45856e6eeba16f0bbc52","kind":"tag","published_at":"2019-09-05T15:03:19.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/io@1.0.1","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/io@1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fio%401.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fio@1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fio@1.0.1/manifests"},{"name":"@actions/github@1.1.0","sha":"a2ab4bcf78e4f7080f0d45856e6eeba16f0bbc52","kind":"tag","published_at":"2019-09-05T15:03:19.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/github@1.1.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/github@1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fgithub%401.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fgithub@1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fgithub@1.1.0/manifests"},{"name":"@actions/exec@1.0.1","sha":"a2ab4bcf78e4f7080f0d45856e6eeba16f0bbc52","kind":"tag","published_at":"2019-09-05T15:03:19.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/exec@1.0.1","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/exec@1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fexec%401.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fexec@1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fexec@1.0.1/manifests"},{"name":"@actions/core@1.1.0","sha":"a2ab4bcf78e4f7080f0d45856e6eeba16f0bbc52","kind":"tag","published_at":"2019-09-05T15:03:19.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/core@1.1.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/core@1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fcore%401.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcore@1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcore@1.1.0/manifests"},{"name":"@actions/tool-cache@1.0.0","sha":"a40bce7c8d382aa3dbadaa327acbc696e9390e55","kind":"tag","published_at":"2019-08-07T17:33:06.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/tool-cache@1.0.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/tool-cache@1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Ftool-cache%401.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Ftool-cache@1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Ftool-cache@1.0.0/manifests"},{"name":"@actions/io@1.0.0","sha":"a40bce7c8d382aa3dbadaa327acbc696e9390e55","kind":"tag","published_at":"2019-08-07T17:33:06.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/io@1.0.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/io@1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fio%401.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fio@1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fio@1.0.0/manifests"},{"name":"@actions/github@1.0.0","sha":"a40bce7c8d382aa3dbadaa327acbc696e9390e55","kind":"tag","published_at":"2019-08-07T17:33:06.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/github@1.0.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/github@1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fgithub%401.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fgithub@1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fgithub@1.0.0/manifests"},{"name":"@actions/exec@1.0.0","sha":"a40bce7c8d382aa3dbadaa327acbc696e9390e55","kind":"tag","published_at":"2019-08-07T17:33:06.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/exec@1.0.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/exec@1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fexec%401.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fexec@1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fexec@1.0.0/manifests"},{"name":"@actions/core@1.0.0","sha":"a40bce7c8d382aa3dbadaa327acbc696e9390e55","kind":"tag","published_at":"2019-08-07T17:33:06.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/@actions/core@1.0.0","html_url":"https://github.com/actions/toolkit/releases/tag/@actions/core@1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@%40actions%2Fcore%401.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcore@1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/@actions%2Fcore@1.0.0/manifests"},{"name":"0.0.2","sha":"a327d577602d304759e2c4150ac2e91ad8c57391","kind":"commit","published_at":"2019-06-25T12:43:54.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/0.0.2","html_url":"https://github.com/actions/toolkit/releases/tag/0.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@0.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/0.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/0.0.2/manifests"},{"name":"0.0.1","sha":"a327d577602d304759e2c4150ac2e91ad8c57391","kind":"commit","published_at":"2019-06-25T12:43:54.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/0.0.1","html_url":"https://github.com/actions/toolkit/releases/tag/0.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@0.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/0.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/0.0.1/manifests"},{"name":"0.0.0","sha":"a327d577602d304759e2c4150ac2e91ad8c57391","kind":"commit","published_at":"2019-06-25T12:43:54.000Z","download_url":"https://codeload.github.com/actions/toolkit/tar.gz/0.0.0","html_url":"https://github.com/actions/toolkit/releases/tag/0.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/actions/toolkit@0.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/0.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/tags/0.0.0/manifests"}]},"repo_metadata_updated_at":"2026-09-27T17:47:39.886Z","dependent_packages_count":41,"downloads":63889108,"downloads_period":"last-month","dependent_repos_count":104097,"rankings":{"downloads":0.0964101639056816,"dependent_repos_count":0.09593399517052863,"dependent_packages_count":0.7924370409667755,"stargazers_count":1.411868309654209,"forks_count":0.9688073065571515,"docker_downloads_count":0.3338783131190369,"average":0.6165558548955639},"purl":"pkg:npm/%40actions/http-client","advisories":[{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTl3NnYtbTd3cC1qd2c0","url":"https://github.com/advisories/GHSA-9w6v-m7wp-jwg4","title":"Http request which redirect to another hostname do not strip authorization header in @actions/http-client","description":"### Impact\nIf consumers of the http-client:\n  1. make an http request with an authorization header\n  2. that request leads to a redirect (302) and\n  3. the redirect url redirects to another domain or hostname \n\nThe authorization header will get passed to the other domain.\n\nNote that since this library is for actions, the GITHUB_TOKEN that is available in actions is generated and scoped per job with [these permissions](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token#permissions-for-the-github_token).\n\n### Patches\nThe problem is fixed in 1.0.8 at [npm here](https://www.npmjs.com/package/@actions/http-client).  In 1.0.8, the authorization header is stripped before making the redirected request if the hostname is different.\n\n### Workarounds\nNone.\n\n### References\nhttps://github.com/actions/http-client/pull/27\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/actions/http-client/issues","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2020-04-29T17:58:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.3,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","references":["https://github.com/actions/http-client/security/advisories/GHSA-9w6v-m7wp-jwg4","https://github.com/actions/http-client/pull/27","https://github.com/actions/http-client/commit/f6aae3dda4f4c9dc0b49737b36007330f78fd53a","https://nvd.nist.gov/vuln/detail/CVE-2020-11021","https://github.com/advisories/GHSA-9w6v-m7wp-jwg4"],"source_kind":"github","identifiers":["GHSA-9w6v-m7wp-jwg4","CVE-2020-11021"],"repository_url":"https://github.com/actions/http-client","blast_radius":0.0,"created_at":"2022-12-21T16:13:25.030Z","updated_at":"2026-09-28T19:18:43.834Z","epss_percentage":0.01781,"epss_percentile":0.77013,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTl3NnYtbTd3cC1qd2c0","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTl3NnYtbTd3cC1qd2c0","packages":[{"ecosystem":"npm","package_name":"@actions/http-client","versions":[{"first_patched_version":"1.0.8","vulnerable_version_range":"\u003c 1.0.8"}],"purl":"pkg:npm/%40actions%2Fhttp-client","statistics":{"dependent_packages_count":41,"dependent_repos_count":104097,"downloads":63889108,"downloads_period":"last-month"},"affected_versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7"],"unaffected_versions":["1.0.8","1.0.9","1.0.10","1.0.11","2.0.0","2.0.1","2.1.0","2.1.1","2.2.0","2.2.1","2.2.2","2.2.3","3.0.0","3.0.1","3.0.2","4.0.0","4.0.1"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTl3NnYtbTd3cC1qd2c0/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/@actions/http-client","docker_dependents_count":405,"docker_downloads_count":1734975536,"usage_url":"https://repos.ecosyste.ms/usage/npm/@actions/http-client","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/@actions/http-client/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-26T22:01:39.476Z","issues_count":343,"pull_requests_count":905,"avg_time_to_close_issue":22161979.736842107,"avg_time_to_close_pull_request":5049116.719269103,"issues_closed_count":95,"pull_requests_closed_count":602,"pull_request_authors_count":267,"issue_authors_count":278,"avg_comments_per_issue":2.2682215743440235,"avg_comments_per_pull_request":0.7779005524861878,"merged_pull_requests_count":371,"bot_issues_count":0,"bot_pull_requests_count":118,"past_year_issues_count":31,"past_year_pull_requests_count":146,"past_year_avg_time_to_close_issue":216806.0,"past_year_avg_time_to_close_pull_request":1824694.3580246915,"past_year_issues_closed_count":4,"past_year_pull_requests_closed_count":81,"past_year_pull_request_authors_count":48,"past_year_issue_authors_count":29,"past_year_avg_comments_per_issue":0.9354838709677419,"past_year_avg_comments_per_pull_request":0.6232876712328768,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":81,"past_year_merged_pull_requests_count":38,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/actions%2Ftoolkit/issues","maintainers":[{"login":"joshmgross","count":26,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/joshmgross"},{"login":"robherley","count":21,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/robherley"},{"login":"Link-","count":18,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Link-"},{"login":"thboop","count":15,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/thboop"},{"login":"rentziass","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/rentziass"},{"login":"bryanmacfarlane","count":5,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/bryanmacfarlane"},{"login":"philip-gai","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/philip-gai"},{"login":"JamesMGreene","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/JamesMGreene"},{"login":"dhadka","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dhadka"},{"login":"TingluoHuang","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/TingluoHuang"},{"login":"pje","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/pje"},{"login":"gr2m","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/gr2m"}],"active_maintainers":[{"login":"Link-","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Link-"},{"login":"philip-gai","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/philip-gai"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@actions%2Fhttp-client/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@actions%2Fhttp-client/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@actions%2Fhttp-client/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@actions%2Fhttp-client/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@actions%2Fhttp-client/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@actions%2Fhttp-client/codemeta","maintainers":[{"uuid":"thboop","login":"thboop","name":null,"email":"thboop@github.com","url":null,"packages_count":14,"html_url":"https://www.npmjs.com/~thboop","role":null,"created_at":"2022-11-08T13:33:48.367Z","updated_at":"2022-11-08T13:33:48.367Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/thboop/packages"},{"uuid":"bdehamer","login":"bdehamer","name":null,"email":"brian@dehamer.com","url":null,"packages_count":43,"html_url":"https://www.npmjs.com/~bdehamer","role":null,"created_at":"2026-02-11T08:53:00.286Z","updated_at":"2026-02-11T08:53:00.286Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/bdehamer/packages"},{"uuid":"ericsciple","login":"ericsciple","name":null,"email":"ericsciple@github.com","url":null,"packages_count":14,"html_url":"https://www.npmjs.com/~ericsciple","role":null,"created_at":"2026-02-25T20:31:37.948Z","updated_at":"2026-02-25T20:31:37.948Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/ericsciple/packages"}]}