[2/4] chore: raise HTTP-client minimums and fix dependency audits

[tunc-d]

Status: blocked draft, not mergeable

@actions/http-client@4.0.2 is not published. npm registry checks on 2026-10-01 (latest recheck 11:35 UTC) report latest: 4.0.1; an exact 4.0.2 lookup returns E404. This PR prepares the approved dependency intent, not a green/installable final release. Final manifest/lock install consistency is incomplete. Publication is not performed or authorized by this PR.

After adding the requested minimums, normal npm lock regeneration for artifact, core, and tool-cache fails with ETARGET: No matching version found for @actions/http-client@^4.0.2; final artifact npm ci fails for the same reason. Their existing genuine registry resolutions and lock root ranges are preserved. There are no fabricated 4.0.2 entries, tarball URLs, integrities, file dependencies, or Undici overrides.

Before this draft can become mergeable: publish HTTP-client 4.0.2 through the separately authorized release process, regenerate the three consumer locks with npm against the real publication, verify preserved transitive major versions, rerun package installs/audits/tests, and obtain passing CI. Local compilation of inherited HTTP-client 4.0.2 source is not npm publication or proof of final consumer installability.

Layer 2 only

Compared with exact lower-layer commit 1ee105142b4ddcd5a23503852aaaa0f6962bff22, this layer changes eight files: package.json and package-lock.json in artifact, core, glob, and tool-cache.

• Raise direct HTTP-client dependency minimums: artifact ^4.0.1 -> ^4.0.2; core and tool-cache ^4.0.0 -> ^4.0.2. These are not those packages' own release versions.
• Artifact: scoped brace-expansion overrides brace-expansion@^2: ^2.1.7 and brace-expansion@^5: ^5.0.12; markdown-it override ^14.3.1, locked to published 14.3.2.
• Glob: brace-expansion override ^5.0.12.
• Refresh only the assigned artifact/core/glob/tool-cache Undici locks to published 6.29.0, preserving patch compatibility and unrelated resolutions.

The six-file audit-only delta was regenerated with npm and verified byte-for-byte against closed reference #2517 at 4eb240c03b7ce94f9c302c927071cd9ae3de24eb. Its HTTP-client lock slice is not reapplied: that belongs to inherited layer 1. #2517 is a closed reference, not an active layer.

Preserved paths: glob has no direct HTTP-client dependency; its locked core 3.0.0 still declares HTTP-client ^4.0.0, locked to 4.0.0. Artifact's locked GitHub 9.1.1 still declares HTTP-client ^3.0.2, locked to 3.0.2, and direct Undici ^6.23.0. The shared Undici lock is 6.29.0. There is no silent HTTP-client 3.x-to-4.x upgrade.

No retry implementation/tests, artifact 6.3.0 metadata/release notes, or consumer own-version bumps are introduced.

Inherited aggregate scope against upstream main

Lower layer: #2518, exact ancestor 1ee105142b4ddcd5a23503852aaaa0f6962bff22. Its three HTTP-client files are unchanged: package.json (4.0.2 planned version and Undici floor ^6.28.1), package-lock.json (published Undici 6.29.0), and RELEASES.md.

Against upstream main dc752c75f8868e7e83761116161c952938b8ddae, the aggregate therefore contains eleven files: three inherited layer-1 files plus eight layer-2 files. As explicitly approved, this fork-backed PR targets actions/toolkit:main; inherited lower changes remain visible until the parent merges. No cross-fork base or native stack registration is invented.

The coordinator will continue with existing retry layer #2498, then the separate artifact release-metadata layer. This PR does not alter or resolve #2498 review threads.

Validation: audit-only snapshot versus final blocked draft

Installable audit-only snapshot: 9f3eeb5a80f03d4c83cb8343f55f2d92bef89349, before the unpublished consumer minimums were added.

• npm ci succeeds for root and affected packages using currently published consumer ranges.
• Nine package npm audit --audit-level=moderate checks (artifact, cache, core, exec, github, glob, http-client, io, tool-cache), plus root npm audit --omit=dev --audit-level=moderate: zero vulnerabilities.
• Scoped standard Lerna/TypeScript builds, with artifact's tsc-run to avoid its unscoped bootstrap side effects: successful on local Node 24.21.0.
• npm test -- --runInBand --forceExit packages/artifact packages/core packages/glob packages/tool-cache packages/http-client: 31 suites, 463 tests passed. This uses the repository CI flags and repository source mappings, including inherited local HTTP-client source; it is not final registry-resolution coverage. Existing ts-jest warn-only Octokit type-path diagnostics remain; scoped TypeScript builds pass.
• Standard npm run lint, npm run format-check, and git diff --check: passed. No source formatting changes made.

Final draft: the three minimums are added in a separate preparation commit. Consumer lock regeneration and final artifact npm ci fail ETARGET; full final bootstrap/install/CI success is not claimed. Audit-only results above must not be mistaken for passing final-draft package-manager or CI validation.

Initial CI at handoff (2026-10-01): build/upload checks have started reporting failures while other checks are still pending/in progress. The completed toolkit-audit run fails during Bootstrap with ETARGET: No matching version found for @actions/http-client@^4.0.2 and npm install exited 1 in '@actions/core'. This is the observed publication blocker, not a passing final audit run. Final Node 20/24 CI remains failed/pending until publication and proper consumer lock regeneration.