updating release info

README.md

@@ -221,7 +221,7 @@ console.log(`We can even get context data, like the repo: ${context.repo.repo}`)
 ## Contributing
 
 We welcome contributions.  See [how to contribute](.github/CONTRIBUTING.md).
-hi
+
 ## Code of Conduct
 
 See [our code of conduct](CODE_OF_CONDUCT.md).

packages/io/RELEASES.md

@@ -1,5 +1,7 @@
 # @actions/io Releases
 
+### 1.1.3
+- [Fixed a security bug where we used child_proccess.exec instead of execFile for windows](https://github.com/actions/toolkit/pull/1255)
 ### 1.1.2
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 
 

packages/io/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/io",
-  "version": "1.1.3",
+  "version": "1.1.2",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/io",
-      "version": "1.1.3",
+      "version": "1.1.2",
       "license": "MIT"
     }
   }

packages/io/src/io.ts

@@ -4,8 +4,6 @@ import * as path from 'path'
 import {promisify} from 'util'
 import * as ioUtil from './io-util'
 
-// const exec = promisify(childProcess.exec)
-// const fork = promisify(childProcess.fork)
 const execFile = promisify(childProcess.execFile)
 
 /**
@@ -132,18 +130,10 @@ export async function rmRF(inputPath: string): Promise<void> {
       if (await ioUtil.isDirectory(inputPath, true)) {
         await execFile(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
           env: {inputPath}
-        }).catch(err => {
-          // if you try to delete a file that doesn't exist, desired result is achieved
-          // other errors are valid
-          if (err.code !== 'ENOENT') throw err
         })
       } else {
         await execFile(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
           env: {inputPath}
-        }).catch(err => {
-          // if you try to delete a file that doesn't exist, desired result is achieved
-          // other errors are valid
-          if (err.code !== 'ENOENT') throw err
         })
       }
     } catch (err) {