[agoldis]

Owner: @agoldis

Fixes the open Dependabot alerts for undici (SOC 2 / Vanta: vulnerabilities identified in packages are addressed).

Advisories fixed

Package	Old → new	Advisory
undici (via @actions/core → @actions/http-client)	6.29.0 → 6.29.1	GHSA-xjj6-f33q-929c (high, >=6.23.0 <6.29.1)
		GHSA-4qv8-2p9j-2685 (moderate, >=6.5.0 <6.29.1)

Changes

• package-lock.json: only the node_modules/undici entry changes. @actions/http-client@3.0.2 requires undici@^6.23.0, so no override is needed.
• dist/index.js, dist/post.js: rebuilt with npm run bundle. The action ships undici inside the ncc bundle, so the fix only reaches users once dist is rebuilt. Before the bump I checked that npm ci && npm run bundle on main reproduces the committed dist with no diff, so the dist changes here come only from undici.

This doesn't overlap with the open Dependabot PRs #104 / #97, which bump @actions/core / @actions/exec to new majors.

Verification

• npm ci (npm 11, matching the lockfile): passes
• npm ls undici --all: @actions/core@2.0.3 → @actions/http-client@3.0.2 → undici@6.29.1 (only copy)
• npm audit --package-lock-only: no undici advisories remain
• npm run bundle: passes; git diff dist/ contains only the rebuilt undici code
• npm run format:check: passes
• npm run lint: passes
• npm test: 39/39 passed
• npx tsc --noEmit: passes

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Upgrade undici to 6.29.1 through @actions/http-client to address reported security advisories. Rebuild the ncc bundles so the action’s bundled HTTP, EventSource, fetch, and WebSocket fixes reach users.

Topics

Topic	Details
Runtime Bundles	Rebuild the distributed action bundles with updated undici behavior, including EventSource size limits, safer fetch handling, and WebSocket backpressure. Modified files (2) dist/index.js dist/post.js Latest Contributors(2) User Commit Date noreply@anthropic.com chore(deps): bump undi... October 27, 2026 dj@currents.dev chore: refresh dist/ f... October 05, 2026
Dependency Security	Upgrade the transitive undici dependency to remediate GHSA advisories without adding an override. Modified files (1) package-lock.json Latest Contributors(2) User Commit Date noreply@anthropic.com chore(deps): bump undi... October 27, 2026 gimenez.maxi@gmail.com fix(deps): bump brace-... October 23, 2026

---

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}