Skip to content

Resolve Lint Codebase workflow failure by patching vulnerable transitive undici dependency#1193

Draft
Copilot wants to merge 2 commits intomainfrom
copilot/fix-github-actions-workflow
Draft

Resolve Lint Codebase workflow failure by patching vulnerable transitive undici dependency#1193
Copilot wants to merge 2 commits intomainfrom
copilot/fix-github-actions-workflow

Conversation

Copy link
Copy Markdown

Copilot AI commented Apr 9, 2026

The Lint Codebase workflow was failing in the super-linter TRIVY step due to known CVEs in undici@6.23.0 resolved via package-lock.json. This PR updates dependency resolution to a patched 6.24.x line so the security scan no longer blocks the workflow.

  • Root cause

    • Trivy vulnerability scan reported multiple CVEs against transitive undici@6.23.0 in the lockfile.
  • Dependency resolution update

    • Updated lockfile entries from undici@6.23.0 to undici@6.24.1 where @actions/http-client resolves undici in the 6.x range.
    • No direct dependency API changes; this is a lockfile-level transitive security patch.
  • Generated artifact sync

    • Regenerated dist/index.js and dist/index.js.map to keep generated output aligned with the updated lockfile state.
- "node_modules/undici": { "version": "6.23.0", ... }
+ "node_modules/undici": { "version": "6.24.1", ... }

Copilot AI changed the title [WIP] Fix failing GitHub Actions workflow Lint Codebase Resolve Lint Codebase workflow failure by patching vulnerable transitive undici dependency Apr 9, 2026
Copilot AI requested a review from salmanmkc April 9, 2026 10:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants