Dependabot is reporting CVE-2025-22150 for undici <5.28.5.
It would be helpful if actions/toolkit updated to a patched undici version, such as 5.28.5 to force installation of a non-vulnerable version of undici.
The following shows usage in this repo:
Dependabot is reporting CVE-2025-22150 for undici <
5.28.5.It would be helpful if
actions/toolkitupdated to a patched undici version, such as5.28.5to force installation of a non-vulnerable version of undici.The following shows usage in this repo:
toolkit/packages/attest/package.json
Line 42 in 1f7c2c7
toolkit/packages/http-client/package.json
Line 49 in 1f7c2c7