updating release info

.github/workflows/artifact-tests.yml

@@ -25,7 +25,7 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Set Node.js 12.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v1
       with:
         node-version: 12.x
 

.github/workflows/audit.yml

@@ -21,7 +21,7 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Set Node.js 12.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v1
       with:
         node-version: 12.x
 

.github/workflows/cache-tests.yml

@@ -25,7 +25,7 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Set Node.js 12.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v1
       with:
         node-version: 12.x
 

.github/workflows/releases.yml

@@ -19,7 +19,7 @@ jobs:
         run: ls packages/${{ github.event.inputs.package }}
 
       - name: Set Node.js 12.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v1
         with:
           node-version: 12.x
 

.github/workflows/unit-tests.yml

@@ -26,7 +26,7 @@ jobs:
       uses: actions/checkout@v2
 
     - name: Set Node.js 12.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v1
       with:
         node-version: 12.x
 

docs/action-types.md

@@ -32,7 +32,7 @@ jobs:
         os: [ubuntu-16.04, windows-2019]
     runs-on: ${{matrix.os}}
     actions:
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v1
       with:
         version: ${{matrix.node}}
     - run: | 

docs/container-action.md

@@ -18,7 +18,7 @@ e.g. To use https://github.com/actions/setup-node, users will author:
 
 ```yaml
 steps:
-    using: actions/setup-node@v3
+    using: actions/setup-node@v1
 ```
 
 # Define Metadata

packages/io/RELEASES.md

@@ -1,5 +1,7 @@
 # @actions/io Releases
 
+### 1.1.3
+- [Fixed a security bug where we used child_proccess.exec instead of execFile for windows](https://github.com/actions/toolkit/pull/1255)
 ### 1.1.2
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 
 

packages/io/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/io",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Actions io lib",
   "keywords": [
     "github",

packages/io/src/io.ts

@@ -4,7 +4,6 @@ import * as path from 'path'
 import {promisify} from 'util'
 import * as ioUtil from './io-util'
 
-const exec = promisify(childProcess.exec)
 const execFile = promisify(childProcess.execFile)
 
 /**
@@ -129,11 +128,11 @@ export async function rmRF(inputPath: string): Promise<void> {
     try {
       const cmdPath = ioUtil.getCmdPath()
       if (await ioUtil.isDirectory(inputPath, true)) {
-        await exec(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
           env: {inputPath}
         })
       } else {
-        await exec(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
           env: {inputPath}
         })
       }