chore: fix dependency audits

[tunc-d]

Scope

Audit-only patch, independently based on upstream main (dc752c75f8868e7e83761116161c952938b8ddae), with exactly seven files changed:

• Artifact/glob source overrides for patched brace-expansion (2.1.7 / 5.0.12) and artifact markdown-it (14.3.2).
• Published Undici 6.29.0 resolved within existing ranges in artifact, core, glob, HTTP-client, and tool-cache locks.

All package release versions and dependency ranges are preserved, including HTTP-client 4.0.1 / Undici ^6.23.0 and consumer HTTP-client minima. No release notes, version bumps, HTTP-client 4.0.2 intent, retry changes, dependency majors, or other layers.

Generated-file provenance

Only the two source package.json files were manually edited. npm 11.19.0 generated all five locks with targeted npm update ... --package-lock-only --ignore-scripts --no-fund --no-audit commands. No copied or hand-edited lock entries, URLs, integrity values, or metadata. All seven resulting files byte-match closed historical reference #2517 (4eb240c03b7ce94f9c302c927071cd9ae3de24eb); it is not a prerequisite.

Local validation

• npm ci in all five affected packages; CI-equivalent root npm install and npm run bootstrap; lockfiles remained unchanged.
• Root npm audit --audit-level=moderate --omit dev: 0 vulnerabilities.
• npm run audit-all: all nine audited packages have 0 vulnerabilities.
• Scoped build including local dependencies: eight packages passed.
• Node 24.21.0: 31 suites / 463 tests passed across the five affected packages.
• Node 20.20.2: HTTP-client 5 suites / 75 tests passed.
• Node 20/24 local CONNECT proxy smokes: Undici 6.29.0 dispatcher, package/native fetch, and loopback bypass passed.
• Repository lint and format checks passed.

The existing root dev-tool audit baseline (32 findings) is outside the CI production audit scope and unchanged. Remote CI is not yet verified; keep this PR draft pending checks on its exact head commit.

[Copilot]

Copilot review overview

🟢 Approval recommended

The narrowly scoped dependency updates are internally consistent, preserve supported Node runtimes, and introduce no identified defects.

Review effort: Balanced
Findings: None

What changed in this PR

Updates audited dependencies while preserving package versions and dependency ranges.

Changes:

• Adds overrides for patched brace-expansion and markdown-it.
• Resolves affected lockfiles to undici 6.29.0.

File	Description
packages/​artifact/​package.json	Adds security-related dependency overrides.
packages/​artifact/​package-lock.json	Locks patched transitive dependencies.
packages/​core/​package-lock.json	Updates locked Undici version.
packages/​glob/​package.json	Overrides vulnerable brace-expansion versions.
packages/​glob/​package-lock.json	Locks patched brace-expansion and Undici.
packages/​http-client/​package-lock.json	Updates locked Undici version.
packages/​tool-cache/​package-lock.json	Updates locked Undici version.

Files not reviewed (5)

• packages/artifact/package-lock.json: Generated file
• packages/core/package-lock.json: Generated file
• packages/glob/package-lock.json: Generated file
• packages/http-client/package-lock.json: Generated file
• packages/tool-cache/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.