From 19240e34e2246fdae42e56839f6745fc205fdc2a Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 17 Aug 2026 07:22:54 +0000
Subject: [PATCH 1/2] fix:
 yaml.github-actions.security.run-shell-injection.run-shell-injection security
 vulnerability

Automated security fix generated by OrbisAI Security
---
 setup-js/action.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/setup-js/action.yml b/setup-js/action.yml
index 77b0161..9334bf2 100644
--- a/setup-js/action.yml
+++ b/setup-js/action.yml
@@ -53,7 +53,8 @@ runs:
 
     - name: Install dependencies
       shell: bash
-      run:
-        ${{ inputs.package-manager }} install ${{ inputs.no-frozen-lockfile ==
-        'true' && '--no-frozen-lockfile' || '' }}
+      env:
+        PACKAGE_MANAGER: ${{ inputs.package-manager }}
+        NO_FROZEN_LOCKFILE: ${{ inputs.no-frozen-lockfile == 'true' && '--no-frozen-lockfile' || '' }}
+      run: "$PACKAGE_MANAGER install $NO_FROZEN_LOCKFILE"
       if: ${{ inputs.auto-install }}

From b7728194fb09f98230616ba8ef4f9a540bbed98c Mon Sep 17 00:00:00 2001
From: Kevin Deng <sxzz@sxzz.moe>
Date: Tue, 18 Aug 2026 14:03:36 +0900
Subject: [PATCH 2/2] format

---
 setup-js/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup-js/action.yml b/setup-js/action.yml
index 9334bf2..539a903 100644
--- a/setup-js/action.yml
+++ b/setup-js/action.yml
@@ -56,5 +56,5 @@ runs:
       env:
         PACKAGE_MANAGER: ${{ inputs.package-manager }}
         NO_FROZEN_LOCKFILE: ${{ inputs.no-frozen-lockfile == 'true' && '--no-frozen-lockfile' || '' }}
-      run: "$PACKAGE_MANAGER install $NO_FROZEN_LOCKFILE"
+      run: $PACKAGE_MANAGER install $NO_FROZEN_LOCKFILE
       if: ${{ inputs.auto-install }}