Repository navigation
fix: rebuild action bundles with patched Undici 6.29.1 - #1296
KirilsTurkins wants to merge 4 commits into
Conversation
Undici 6.29.1 already satisfies @actions/http-client's ^6.23.0 range, so it can resolve through that dependency without a pin. The lockfile and rebuilt dist/ bundles are unchanged. Co-authored-by: Copilot App <[email protected]>
The cached Licensed record still listed undici 6.29.0, so `licensed status` failed with "dependency record out of date" after the lockfile moved to 6.29.1. The LICENSE text, summary, and homepage are unchanged; only the version differs. Co-authored-by: Copilot App <[email protected]>
|
Follow-up from the Latent Service Fabric (LSF) security baseline: GitHub reviewed GHSA-gcqx-w48m-w2h4 for |
|
The core issue has been resolved in #1308: the action bundles now use Undici 6.29.1 and the license record is updated. For the new security alert, we will wait for dependencies to be updated and for Dependabot to trigger the alert. Not meaningfully affected. No action is needed.
At most, the advisory affects local test runs, and Jest only merges its own trusted config. Dependabot may still flag the lockfile entry; you can safely dismiss it as dev-only. |
Description:
Pin the bundled Undici runtime to 6.29.1 and rebuild the setup and cleanup entry points. This fixes GHSA-4qv8-2p9j-2685 and GHSA-xjj6-f33q-929c. The lockfile also uses the public npm URL for the existing TypeScript tarball, retaining its integrity hash.
Found while hardening CI for Latent Service Fabric (LSF). The patched production dependency graph has zero OSV findings across 44 packages.
Related issue:
The two security advisories linked above.
Check list:
npm run checklocally (format, lint, build, test) and all checks pass: Linux, Node 24.19.0; 45 suites, 1,594 tests passed, two existing skips.Existing tests are unchanged; this updates the dependency lock and generated bundles.