Bump undici to v6.23.0 in @actions/http-client

Merge pull request #2249 from actions/fix/upgrade-octokit-dependencies
upgrade octokit dependencies
2026-01-27 09:29:19 -05:00 · 2026-01-22 14:46:12 -05:00 · 2026-01-22 15:53:06 +00:00 · 2026-01-22 14:48:46 +00:00 · 2026-01-22 00:03:54 +00:00 · 2026-01-21 21:04:00 +00:00
5 changed files with 12 additions and 26 deletions
@@ -10761,9 +10761,9 @@
      }
    },
    "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
      "dev": true,
      "license": "MIT"
    },
@@ -1986,7 +1986,6 @@
      "version": "5.9.2",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
-      "dev": true,
      "license": "Apache-2.0",
      "bin": {
        "tsc": "bin/tsc",
@@ -192,7 +192,6 @@
      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
      "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@octokit/auth-token": "^4.0.0",
        "@octokit/graphql": "^7.1.0",
@@ -1574,9 +1573,9 @@
      }
    },
    "node_modules/tar": {
-      "version": "7.5.2",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.2.tgz",
-      "integrity": "sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==",
+      "version": "7.5.6",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.6.tgz",
+      "integrity": "sha512-xqUeu2JAIJpXyvskvU3uvQW8PAmHrtXp2KDuMJwQqW8Sqq0CaZBAQ+dKS3RBXVhU4wC5NjAdKrmh84241gO9cA==",
      "license": "BlueOak-1.0.0",
      "dependencies": {
        "@isaacs/fs-minipass": "^4.0.0",
@@ -10,7 +10,7 @@
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
      },
      "devDependencies": {
        "@types/node": "24.1.0",
@@ -19,15 +19,6 @@
        "proxy": "^2.1.1"
      }
    },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@types/node": {
      "version": "24.1.0",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.1.0.tgz",
@@ -241,15 +232,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
      "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
      "engines": {
-        "node": ">=14.0"
+        "node": ">=18.17"
      }
    },
    "node_modules/undici-types": {
@@ -46,7 +46,7 @@
  },
  "dependencies": {
    "tunnel": "^0.0.6",
-    "undici": "^5.28.5"
+    "undici": "^6.23.0"
  },
  "overrides": {
    "uri-js": "npm:uri-js-replace@^1.0.1"
Author	SHA1	Message	Date
Daniel Kennedy	dabf76268d	Bump `undici` to `v6.23.0` in `@actions/http-client`	2026-01-27 09:29:19 -05:00
Lokesh GopuandGitHub	b77f226465	Merge pull request #2249 from actions/fix/upgrade-octokit-dependencies upgrade octokit dependencies	2026-01-22 14:46:12 -05:00
Salman ChishtiandGitHub	4236fc3e78	Merge pull request #2246 from actions/dependabot/npm_and_yarn/packages/attest/tar-7.5.6 chore(deps): bump tar from 7.5.2 to 7.5.6 in /packages/attest	2026-01-22 15:53:06 +00:00
Salman ChishtiandGitHub	f366966232	Merge pull request #2248 from actions/dependabot/npm_and_yarn/lodash-4.17.23 chore(deps): bump lodash from 4.17.21 to 4.17.23	2026-01-22 14:48:46 +00:00
dependabot[bot]andGitHub	bd561a6765	chore(deps): bump lodash from 4.17.21 to 4.17.23 Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>	2026-01-22 00:03:54 +00:00
dependabot[bot]andGitHub	26490f0d3b	chore(deps): bump tar from 7.5.2 to 7.5.6 in /packages/attest Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.2 to 7.5.6. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.2...v7.5.6) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>	2026-01-21 21:04:00 +00:00