Issue

Dependabot reports the vulnerability CVE-2025-22150 with Moderate severity in the transient dependency undici@5.28.4.

$ npm ls undici
@cypress/github-action
└─┬ @actions/cache@4.0.0
  └─┬ @actions/http-client@2.2.3
    └── undici@5.28.4

Change

Update to undici@5.28.5 by removing undici@5.28.4 from package-lock.json, deleting node_modules and running npm install.

This resolves the moderate severity vulnerability CVE-2025-22150.

Related

• The vulnerability has also been reported in Dependabot reports CVE-2025-22150 for undici <5.28.5 actions/toolkit#1939. It should be easier than described above to update. npm audit does not yet detect this vulnerability.