Security: transitive undici@5.29.0 vulnerabilities via @github/local-action@7.0.1 #295

Summary

@github/local-action@7.0.1 pulls in a vulnerable undici@5.29.0 through several @actions/* dependencies. Snyk reports 10 transitive issues (Risk Score MAX 170), of which 9 have no supported fix in the current dependency tree (0 fixable via a direct bump).

All high-severity findings trace back to a single package: undici@5.29.0.

Affected package

• Direct dependency: @github/local-action@7.0.1
• Vulnerable transitive package: undici@5.29.0
• Fixed in: undici@6.24.0, undici@7.24.0

Vulnerabilities