Override vulnerable Undici transitives

[sgoedecke]

Summary

• Resolve the current Undici findings for ModelsAIModeratorAction / Security: #198168, #225845, and #230188. The findings are assigned to @sgoedecke for this remediation.
• Add exact-version npm overrides for @actions/github@6.0.1 and @actions/github@7.0.0, the two packages that directly request vulnerable Undici 5.x copies under @github/local-action@7.0.1.
• Keep the safe production/root undici@6.28.0 unchanged and avoid a global Undici override.

Dependency graph

Before:

• @github/local-action@7.0.1 > @actions/artifact@5.0.3 > @actions/github@6.0.1 > undici@5.29.0
• @github/local-action@7.0.1 > @actions/artifact@5.0.3 > @actions/github@6.0.1 > @actions/http-client@2.2.3 > undici@5.29.0 (deduped)
• @github/local-action@7.0.1 > @actions/github@7.0.0 > undici@5.29.0
• Production/root: undici@6.28.0

After:

• Every lineage above resolves to the existing root undici@6.28.0.
• Both nested undici@5.29.0 lockfile nodes are removed.
• The now-orphaned @fastify/busboy@2.1.1 lockfile node is removed.
• Production/root remains undici@6.28.0.

The initially considered @github/local-action@7.0.1 ancestor override covered only one physical npm subtree because @actions/artifact is hoisted. Exact overrides on the two dependency owners cover both lineages without broadening the production dependency graph.

Validation

• npm ci with the repository-pinned Node.js 20.9.0
• npm run format:check
• npm run lint
• npm run ci-test — 3 suites, 22 tests passed
• npm run bundle; dist/ remains unchanged
• npm ls undici @fastify/busboy @actions/github --all — all Undici paths resolve to 6.28.0; Busboy is absent
• npm audit --package-lock-only — Undici finding removed; total pre-existing dev findings reduced from 9 to 4
• npm audit --package-lock-only --omit=dev — 0 vulnerabilities
• Licensed Check Licenses and enterprise license compliance checks passed in PR CI
• All PR CI, CodeQL, lint, tests, action integration tests, and generated dist/ checks passed

Vulnerability scanner re-evaluation and robot-managed finding closure are automatic after merge; no findings should be manually closed.

[Copilot]

Pull request overview

Remediates vulnerable transitive Undici 5.x dependencies without altering the production Undici version.

Changes:

• Adds package-specific overrides to Undici 6.28.0.
• Removes obsolete Undici 5.29.0 and Busboy lockfile entries.

Show a summary per file

File	Description
package.json	Adds scoped Undici overrides.
package-lock.json	Removes superseded transitive packages.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced