chore: isolate toolkit audit dependency fixes

[tunc-d]

Summary

Separates npm-audit maintenance from the retry and artifact 6.3.0 release changes in #2498, as requested in the review, so dependency changes can be reverted independently.

Only seven files change:

• Artifact overrides: brace-expansion@^2 → ^2.1.7, brace-expansion@^5 → ^5.0.12, and markdown-it → ^14.3.1 (lock resolves 14.3.2).
• Glob override: brace-expansion → ^5.0.12.
• Targeted npm update undici refreshes artifact/core/glob/tool-cache/HTTP-client locks to already-published 6.29.0, satisfying their existing ranges.

No undici overrides, HTTP-client dependency-floor changes, package-version changes, release metadata, source code, or test changes. HTTP-client remains 4.0.1 with undici ^6.23.0; only its locked undici resolution changes. HTTP-client's version/floor/release work remains exclusively in #2515.

Locks were regenerated with npm. Structural comparison against main confirms that only brace-expansion, markdown-it, and undici entries changed; unrelated packages and HTTP-client package resolutions remain untouched.

Audit-first prerequisite

The initial Audit failure was at unchanged HTTP-client 4.0.1, before dependent package audits could run. Conversely, #2515 failed at unchanged core. Ordering those original diffs alone would still require bypassing a baseline failure.

The minimal HTTP-client lockfile-only follow-up removes that cycle: this PR now passes the complete Audit workflow locally and can be the audit-first prerequisite. No HTTP-client publication is needed for these published lock resolutions. After this PR lands, #2515 can be rebased onto the audit-patched main while retaining its independent dependency-floor/version/release changes. No merge or publication is performed here.

Audit evidence

Full package audits, including development dependencies:

Changed package	Previous undici lock	Vulnerable dependencies before	After
artifact	6.28.0	brace-expansion, markdown-it, undici	0
core	6.24.1	undici	0
glob	6.24.0	brace-expansion, undici	0
tool-cache	6.25.0	undici	0
HTTP-client	6.24.0	undici	0

Exact undici advisory evidence returned by the baseline audits:

Advisory	Severity	Affected range
GHSA-p88m-4jfj-68fv	moderate	<6.27.0
GHSA-vxpw-j846-p89q	high	<6.27.0
GHSA-g8m3-5g58-fq7m	low	<6.27.0
GHSA-8xcm-r25x-g524	moderate	<6.28.0
GHSA-m8rv-5g2x-5cg5	moderate	<6.28.0
GHSA-v3r7-h72x-cjcm	moderate	<6.28.0
GHSA-35p6-xmwp-9g52	low	<6.27.0
GHSA-3wwx-pv8p-q78v	moderate	>=6.25.0 <6.28.1
GHSA-r53p-7pc4-xj5r	low	<6.28.1
GHSA-rfgv-xxqx-mfg5	high	>=6.7.0 <6.28.1

Artifact's actual locked 6.28.0 has three advisories; core/glob/HTTP-client have nine, and tool-cache has ten. Each baseline undici dependency is reported as high severity. All five final package audits have zero vulnerabilities at 6.29.0.

Brace-expansion baseline advisories: GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, and GHSA-6j4f-fj2g-mc7p. Markdown-it: GHSA-253c-mchw-3w2r, affecting <14.3.1.

Full workflow validation

Ran the actual CI sequence, without replacing package installs with lock-only audits:

npm install
npm run bootstrap
npm audit --audit-level=moderate --omit dev --json
npm run audit-all

All commands exit 0. The root production audit reports zero vulnerabilities. npm run audit-all executes each existing npm install && npm audit --json --audit-level=moderate > audit.json script: all nine projects (artifact, cache, core, exec, github, glob, HTTP-client, io, tool-cache) finish with zero vulnerabilities, including their development dependencies. Cache/github were already patched; no additional locks or unrelated entries needed updating. After these actual install semantics, the follow-up diff still contains only HTTP-client's one undici lock entry.

• npm test -- --runInBand --forceExit packages/artifact packages/core packages/glob packages/tool-cache packages/http-client: 31 suites, 463 tests pass, using the repository CI's force-exit convention.
• Focused TypeScript builds, scoped ESLint and Prettier checks pass. Artifact TypeDoc/Markdown generation passed during the initial slice, with output outside the repository.
• Local proxy smoke requests pass against actual installed undici 6.29.0 on all four consumer paths plus artifact's nested HTTP-client 3.x path. Patched dependency engine ranges retain Node 20/24 support; local execution used Node 24.

Related work and deferred minimums

• #2498: retry implementation and artifact 6.3.0 release metadata. Neither is included here; no separate artifact-release PR is required.
• #2515: planned HTTP-client 4.0.2 dependency-floor/version/release work. Consumer ^4.0.2 minimums remain deferred until publication. This audit-first slice does not require an unpublished registry version.
• #2512: existing HTTP-client lock-only undici update overlaps this PR's HTTP-client lock refresh. It is left untouched; this PR uses published 6.29.0 and validates the complete audit workflow.

After HTTP-client 4.0.2 is published, artifact/core/tool-cache can raise their direct minimums to ^4.0.2 and regenerate their locks. Glob has no direct HTTP-client dependency: @actions/core ^3.0.0 (locked 3.0.0) → @actions/http-client ^4.0.0 (locked 4.0.0). Artifact also retains @actions/github 9.1.1 → @actions/http-client ^3.0.2 (locked 3.0.2), plus GitHub's direct undici ^6.23.0. A direct HTTP-client 4.x minimum alone does not raise those transitive floors; the targeted lock refresh already resolves their installed undici paths without an extra package release or override.