Repository navigation
Bundle includes apache-arrow code generation (new Function) since v4.38.3 #4252
Description
Since v4.38.3, lib/entry-points.js includes apache-arrow's createIsValidFunction, which builds a predicate with new Function from runtime values. It comes in through @azure/storage-blob 12.34.0 (via @actions/artifact and @actions/cache), which lazily imports apache-arrow for its Arrow blob-list parser. v4.38.2 didn't include it; v4.39.0 still does.
Static analysis can't verify the generated function, so supply-chain auditing tools treat these releases as unverifiable. As far as I can tell nothing in the action lists blobs, so the parser is unreachable. The upstream fix is apache/arrow-js#501.
Would you consider excluding apache-arrow from the bundle in build.mjs, or overriding to the fixed apache-arrow once it's released?
Activity
jketema commentedon Oct 19, 2026
Hi @p-linnane,
Thanks for your report. You might also want to flag this up at https://github.com/Azure/azure-sdk-for-js, as we're probably not the only action with this problem.
jketema commentedon Oct 19, 2026
We had some internal discussion about this, and our bundler should already exclude unreachable code. So if the code is still there, then either there is an actual dependency, or this is some shortcoming in the bundler.
Irrespective of this and for unrelated reasons, we're currently looking at downgrading to earlier versions of
@actions/artifactand@actions/cache, which should also resolve the problem you're observing.