[1/4] http-client: bump Undici and prepare 4.0.2

[tunc-d]

Summary

Layer [1/4] of the approved four-layer plan: prepare a dependency-only @actions/http-client 4.0.2 patch release.

• Raise the Undici minimum from ^6.23.0 to ^6.28.1, the first patched v6 floor for the known advisories, and regenerate the package lockfile with npm, resolving published 6.29.0.
• Update the manifest and both lockfile package-version entries from 4.0.1 to 4.0.2, with concise HTTP-client release notes.
• Change exactly packages/http-client/{package.json,package-lock.json,RELEASES.md}. Preserve existing overrides. No consumer manifests/locks, new overrides, source/API changes, artifact retry changes, or artifact release metadata.

Ordering and publication

This is a standalone cross-fork draft against actions/toolkit:main, not a native stack. The user approved preparing the new drafts against upstream main despite inherited lower-layer diffs remaining visible in later layers until earlier PRs merge.

Review/merge order is [1/4] HTTP-client dependency release → [2/4] consumer minimums and audit fixes → [3/4] artifact retry → [4/4] artifact 6.3.0 metadata. The original #2498 is preserved as layer 3; its review threads are untouched. Layer 2 and layer 4 links will be added when available.

4.0.2 is planned and still unpublished: the npm registry lists latest 4.0.1 and no 4.0.2 at preparation time. Maintainers must merge this lower layer and publish HTTP-client 4.0.2 before consumer upgrades to ^4.0.2 can be installed and their per-package lockfiles validated. No npm publication is performed or authorized here.

Validation and compatibility

• Fresh npm install --prefix packages/http-client --package-lock-only --ignore-scripts --no-fund and npm audit --prefix packages/http-client --package-lock-only --audit-level=moderate: 0 vulnerabilities.
• Checked manifest/lock versions, Undici floor and 6.29.0 resolution, git diff --check, and strict three-file isolation.
• The complete resulting Git tree is identical to the previously validated dependency-only source commit 3af00a0522a4c28679a97918f53f3329c506aaeb. Reused its recorded Node 20.20.2 / 24.21.0 HTTP-client builds and 5 suites / 75 tests on each runtime, including proxy routing/bypass, authentication/encoded credentials, and the Undici ProxyAgent dispatcher. No test reruns solely for copying the unchanged, verified slice.
• Live source checks confirm all six Node 20/24 platform build/test matrix jobs succeeded. This demonstrates compatibility for the unchanged proxy/source paths, not a claim that this new PR's CI has completed.

Baseline CI limitation

Repository-wide audit may still fail on unchanged packages until layer 2 supplies the other audit fixes. The validated source's audit run failed in unchanged @actions/core, while HTTP-client reported zero vulnerabilities. Those fixes intentionally remain outside layer 1; this is not an all-CI-green claim.

The superseded drafts #2515/#2516/#2517 remain closed; they are not active dependencies. No old branches, review replies/resolutions, merge/auto-merge, npm publication, or primary-checkout changes.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused dependency and release metadata changes are internally consistent and preserve supported runtime compatibility.

Review effort: Balanced
Findings: None

What changed in this PR

Prepares the dependency-only @actions/http-client 4.0.2 patch release.

Changes:

• Raises the Undici minimum to 6.28.1 and locks 6.29.0.
• Synchronizes package and lockfile versions at 4.0.2.
• Adds release notes.

File	Description
packages/​http-client/​RELEASES.md	Documents the dependency update.
packages/​http-client/​package.json	Updates package version and Undici range.
packages/​http-client/​package-lock.json	Synchronizes metadata and Undici resolution.

Files not reviewed (1)

• packages/http-client/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.