[PMerlet]

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

8 fixed, 0 ignored, 10 deferred, 0 security pins added, 0 security pins removed, 0 could-not-auto-fix. | label: 🔒 security applied

Fixed

Done	Alert	Gem	Ecosystem	From → To	Severity	What was bumped
- [ ]	#143	undici	npm	6.29.0 → 6.29.1	high	bumped **/@actions/http-client/undici and **/node-gyp/undici resolutions ^6.28.1 → ^6.29.1 in root package.json
- [ ]	#144	fast-uri	npm	3.1.8 → 3.1.9	medium	bumped root resolutions.fast-uri ^3.1.8 → ^3.1.9 in package.json
- [ ]	#145	undici	npm	7.30.0 → 7.30.2	medium	bumped **/@semantic-release/github/undici resolution ^7.29.1 → ^7.30.1 in root package.json
- [ ]	#146	undici	npm	6.29.0 → 6.29.1	medium	bumped **/@actions/http-client/undici and **/node-gyp/undici resolutions ^6.28.1 → ^6.29.1 in root package.json
- [ ]	#147	undici	npm	7.30.0 → 7.30.2	high	bumped **/@semantic-release/github/undici resolution ^7.29.1 → ^7.30.1 in root package.json
- [ ]	#148	fast-uri	npm	3.1.8 → 3.1.9	low	bumped root resolutions.fast-uri ^3.1.8 → ^3.1.9 in package.json
- [ ]	#149	fast-uri	npm	3.1.8 → 3.1.9	medium	bumped root resolutions.fast-uri ^3.1.8 → ^3.1.9 in package.json
- [ ]	#150	fast-uri	npm	3.1.8 → 3.1.9	low	bumped root resolutions.fast-uri ^3.1.8 → ^3.1.9 in package.json

Ignored

None.

Deferred

Skipped by the 7-day age gate (will be picked up by the next run):
#151,
#152,
#153,
#154,
#155,
#156,
#157,
#158,
#159,
#160.

Risks

All bumps are npm devDependencies consumed only by this repo's release tooling (semantic-release and its plugins); none ship to Ruby gem consumers.

• undici 6.29.0 → 6.29.1 (patch): upstream release notes list only security fixes for the TLS-renegotiation DoS, SRI algorithm casing, EventSource memory, excessive content-encodings DoS, and TLS cert validation bypass. No API changes touched by callers in this tree (@actions/http-client, node-gyp).
• undici 7.30.0 → 7.30.2 (patch): same set of 7.x security fixes plus the WebSocket PONG and decompress-interceptor DoS fixes. No API changes touched by @semantic-release/github.
• fast-uri 3.1.8 → 3.1.9 (patch): normalization and scheme/host parsing fixes only; the sole caller is ajv deep in the commitlint chain, which uses the standard parse/serialize surface untouched by this release.

Everything else in yarn.lock is a byproduct of yarn re-pinning fast-uri and undici; no other package changed version. No behavior change beyond the patched vulnerabilities is expected.

Manual testing

Covered by CI.

Validation

✅ CI green (Actions + commit statuses; app-based checks not monitored)

Note

Patch 8 Dependabot alerts in npm dependencies

• Bumps fast-uri to ^3.1.9 and adds npm ^11.21.2 in package.json
• Updates nested undici version ranges for @semantic-release/github, @actions/http-client, and node-gyp
• Regenerates yarn.lock to match the new ranges

^{Macroscope summarized f709ba3.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[ShohanRahman]

Follow-up to the audit

Fixed: the undici copy bundled inside npm (#143, #146, plus deferred #153, #155, #157)

npm@11.14.1 ships its own undici@6.25.0 (under its bundled node-gyp) at node_modules/npm/node_modules/undici. It is not in yarn.lock, so the **/node-gyp/undici resolution never reaches it and Dependabot never sees it. It is also the copy Node loads when npm's node-gyp runs.

f709ba3 adds the resolution "npm": "^11.21.2". Per npm/cli's lockfile, npm 11.21.2 is the first release that ships undici@6.29.1. It stays within @semantic-release/npm's own range (npm ^11.6.2), and its Node requirement (^20.17.0 || >=22.9.0) is met by the release job's Node 22.14.0.

Every undici copy installed after a frozen install:

Path	Version
node_modules/undici	6.29.1
node_modules/npm/node_modules/undici	6.29.1
node_modules/@semantic-release/github/node_modules/undici	7.30.2

The deferred undici alerts #151–#159 have the same patched versions (6.29.1 / 7.30.1), so this PR clears them too.

Not fixable, accepted as a tolerable risk: glob (#160, GHSA-3g3m-2fjr-6pw4)

Why it can't be fixed here:

• Every glob from 9.0.0 to 14.0.1 is affected, so all of 13.x is, 13.0.7 included. The first fixed version is 14.0.2.
• Only npm's own dependencies use glob (npm, @npmcli/map-workspaces, @npmcli/package-json, cacache), and they all ask for ^13.
• Even the latest npm releases (11.21.2 and 12.2.2) ship glob@13.0.6, so there is no npm version to move to.
• Forcing "glob": "^14.0.2" would push a major version under npm's ^13 range. It also wouldn't change the copy npm ships at node_modules/npm/node_modules/glob, which is the one npm actually loads. We'd close the alert without fixing anything.

Why the risk is tolerable:

• The bug is an AbortSignal cancellation bypass: a glob walk keeps going after its timeout.
• To be exploitable, code has to pass an AbortSignal to glob while walking a file tree an attacker controls.
• Here glob only runs inside npm during the semantic-release job in CI, walking the repo's own checkout. Nothing untrusted goes in, and nothing reaches gem users: this is dev tooling only.

Follow-up: once npm ships glob ≥ 14.0.2, bump the npm resolution and #160 closes.