From 3fd436836b21f2000f387b5cf5e9b1162e656334 Mon Sep 17 00:00:00 2001 From: Nick Cooke Date: Wed, 29 Jul 2026 15:37:44 -0400 Subject: [PATCH 1/4] fix(ci): add read permissions and pin checkout action --- .github/workflows/spm.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/spm.yml b/.github/workflows/spm.yml index 7d0295eb7..96ca457e7 100644 --- a/.github/workflows/spm.yml +++ b/.github/workflows/spm.yml @@ -8,9 +8,11 @@ on: jobs: swiftpm-build-tests: + permissions: + contents: read runs-on: macOS-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Set Xcode version run: sudo xcode-select -s /Applications/Xcode_16.4.app - name: Initialize xcodebuild From e79e224e08f80a35c810e160a6f932f7d64d2406 Mon Sep 17 00:00:00 2001 From: Nick Cooke Date: Wed, 29 Jul 2026 15:37:44 -0400 Subject: [PATCH 2/4] build: replace xml.etree with defusedxml to prevent XXE --- absl/abseil.podspec.gen.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/absl/abseil.podspec.gen.py b/absl/abseil.podspec.gen.py index e19f95119..4a64119ff 100755 --- a/absl/abseil.podspec.gen.py +++ b/absl/abseil.podspec.gen.py @@ -13,7 +13,7 @@ import os import re import subprocess -import xml.etree.ElementTree +import defusedxml.ElementTree # Template of root podspec. SPEC_TEMPLATE = """ @@ -100,7 +100,7 @@ def read_build(package): """Runs bazel query on given package file and returns all cc rules.""" result = subprocess.check_output( ["bazel", "query", package + ":all", "--output", "xml"]) - root = xml.etree.ElementTree.fromstring(result) + root = defusedxml.ElementTree.fromstring(result) return [ parse_rule(elem, package) for elem in root From 4ea62701610c6193619bf78755a656d5410dc45f Mon Sep 17 00:00:00 2001 From: Nick Cooke Date: Wed, 29 Jul 2026 15:38:40 -0400 Subject: [PATCH 3/4] Revert "build: replace xml.etree with defusedxml to prevent XXE" This reverts commit e79e224e08f80a35c810e160a6f932f7d64d2406. --- absl/abseil.podspec.gen.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/absl/abseil.podspec.gen.py b/absl/abseil.podspec.gen.py index 4a64119ff..e19f95119 100755 --- a/absl/abseil.podspec.gen.py +++ b/absl/abseil.podspec.gen.py @@ -13,7 +13,7 @@ import os import re import subprocess -import defusedxml.ElementTree +import xml.etree.ElementTree # Template of root podspec. SPEC_TEMPLATE = """ @@ -100,7 +100,7 @@ def read_build(package): """Runs bazel query on given package file and returns all cc rules.""" result = subprocess.check_output( ["bazel", "query", package + ":all", "--output", "xml"]) - root = defusedxml.ElementTree.fromstring(result) + root = xml.etree.ElementTree.fromstring(result) return [ parse_rule(elem, package) for elem in root From 5fd44e0c4e7f693d61c6cdb094c4d5f1404ac3d5 Mon Sep 17 00:00:00 2001 From: Nick Cooke <36927374+ncooke3@users.noreply.github.com> Date: Wed, 29 Jul 2026 22:33:03 -0400 Subject: [PATCH 4/4] Apply suggestion from @ncooke3 --- .github/workflows/spm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/spm.yml b/.github/workflows/spm.yml index 96ca457e7..f26371512 100644 --- a/.github/workflows/spm.yml +++ b/.github/workflows/spm.yml @@ -14,7 +14,7 @@ jobs: steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Set Xcode version - run: sudo xcode-select -s /Applications/Xcode_16.4.app + run: sudo xcode-select -s /Applications/Xcode_26.4.app - name: Initialize xcodebuild run: xcodebuild -list - name: iOS Simulator Build Tests