fix: Security upgrade transitive dependency undici

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Security upgrade transitive dependency undici

Summary by CodeRabbit

• Chores
  • Updated development dependencies for build and release tooling to keep CI/CD and developer workflow current.
  • Migrated internal tooling and CI/check scripts to modern ES module format and updated script entry points accordingly.
  • Extended linting configuration to recognize .mjs modules so tooling can process ES module files.

[parse-github-assistant]

🚀 Thanks for opening this pull request!

[coderabbitai]

📝 Walkthrough

Walkthrough

Convert CI tooling and scripts from CommonJS to ES Modules (.mjs), update two devDependencies in package.json, and update npm script entrypoints to use the new .mjs modules. No functional logic changes beyond module-system and path-resolution updates.

Changes

Cohort / File(s)	Summary
Package manifest package.json	Bumped devDependencies: @actions/core 2.0.1 → 3.0.0, @semantic-release/github 12.0.3 → 12.0.6. Updated npm scripts ci:check and ci:checkNodeEngine to run .mjs files.
CI modules (ESM conversion) ci/CiVersionCheck.mjs, ci/ciCheck.mjs, ci/nodeEngineCheck.mjs	Rewrote modules from CommonJS to ES Module syntax (replaced require/module.exports with import/export), adjusted fs import usage and __dirname handling via fileURLToPath. No control-flow or algorithm changes.
Lint config eslint.config.js	Added .mjs to the files glob so ESLint will process ES module files alongside existing extensions.

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly Related PRs

• ci: Upgrade semantic release and modules #3177: Also updates @semantic-release/github in package.json.

🚥 Pre-merge checks | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title refers to upgrading a transitive dependency undici, but the actual changes focus on converting CI scripts from CommonJS to ES modules and updating unrelated dependencies (@actions/core, @semantic-release/github). The title is misleading.	Update the title to accurately reflect the main changes: converting CI scripts to ES modules and updating dependencies. Consider a title like 'refactor: Migrate CI scripts to ES modules and update dependencies'.
Description check	⚠️ Warning	The PR description is incomplete. It lacks the 'Approach' section explaining what changes were made and doesn't address the Tasks section. Only the 'Issue' section is partially filled.	Complete the PR description by adding an 'Approach' section detailing the migration to ES modules, dependency updates, and ESLint configuration changes. Address the Tasks section by checking/deleting irrelevant items.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

package.json (1)

85-97: ⚠️ Potential issue | 🟡 Minor

PR title contains a typo: "unidic" should be "undici".

"unidic" is an unrelated Japanese morphological dictionary package. The security vulnerability being addressed is in undici (Node.js HTTP/1.1 client), which has two recent CVEs:

• CVE-2025-22150: information disclosure in multipart/form-data — attackers can predict boundary values to tamper with backend API requests.
• CVE-2026-22036: unbounded decompression chain via Content-Encoding leading to high CPU and memory exhaustion.

Correcting the title improves changelog traceability.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 85 - 97, The PR title mistakenly says "unidic"
instead of the vulnerable package name "undici"; update the PR title and any
changelog/release text to replace "unidic" with "undici", and ensure related
commit messages or release notes generated via the semantic-release workflow
(see package.json entries like "@semantic-release/changelog" and
"@semantic-release/git") reference "undici" and the CVE details (CVE-2025-22150,
CVE-2026-22036); also scan package.json and release scripts for any accidental
misspelling of the package name and correct it if found.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 85: Convert the two CI scripts from CommonJS to ESM by replacing
require(...) calls with ES import syntax (e.g., import core from
'@actions/core'; import * as exec from '@actions/exec'; import { HttpClient }
from '@actions/http-client' or appropriate named imports), update any module
usage to match the imported symbols (replace module.exports/require-based
patterns with top-level exports or direct usage of imported objects, e.g., use
core.getInput(...) instead of destructuring from a require), and ensure the
project is configured to load ESM (add "type":"module" to package.json or rename
the scripts to .mjs) so `@actions/core`@3.0.0 and the bumped
`@actions/exec/`@actions/http-client ESM packages load correctly.

---

Outside diff comments:
In `@package.json`:
- Around line 85-97: The PR title mistakenly says "unidic" instead of the
vulnerable package name "undici"; update the PR title and any changelog/release
text to replace "unidic" with "undici", and ensure related commit messages or
release notes generated via the semantic-release workflow (see package.json
entries like "@semantic-release/changelog" and "@semantic-release/git")
reference "undici" and the CVE details (CVE-2025-22150, CVE-2026-22036); also
scan package.json and release scripts for any accidental misspelling of the
package name and correct it if found.

[coderabbitai]

🧹 Nitpick comments (1)

ci/nodeEngineCheck.mjs (1)

1-7: __dirname shim is correct; consider node: prefix for built-in imports.

path.dirname(fileURLToPath(import.meta.url)) is the standard ESM substitute for __dirname and is correct. The import * as core, import semver, import fs, import path, and import { fileURLToPath } choices are all appropriate for their respective packages.

As an optional improvement, prefer the node: scheme for built-in module specifiers to unambiguously distinguish them from npm packages:

♻️ Use `node:` prefix for built-in specifiers

 import * as core from '@actions/core';
 import semver from 'semver';
-import fs from 'fs/promises';
-import path from 'path';
-import { fileURLToPath } from 'url';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';

(The same suggestion applies to ci/CiVersionCheck.mjs line 4.)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@ci/nodeEngineCheck.mjs` around lines 1 - 7, Switch the built-in module
specifiers to the node: scheme so Node treats them as core modules: change
imports that currently use 'fs/promises', 'path', and 'url' (the import of
fileURLToPath) to use 'node:fs/promises', 'node:path', and 'node:url'
respectively; keep the same imported symbols (fs, path, fileURLToPath) and the
__dirname shim logic (path.dirname(fileURLToPath(import.meta.url))) unchanged,
and mirror this change in the other module that imports core Node built-ins.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@package.json`:
- Line 85: The package.json now pins "@actions/core": "3.0.0" but you must
ensure the CI scripts were migrated to ESM and their imports updated: rename the
scripts referenced (previously .js) to ciCheck.mjs and nodeEngineCheck.mjs,
update their module imports to use "import * as core from '@actions/core'" (and
any other CommonJS require -> import conversions), and verify package.json
script entries point to the new .mjs filenames so the ESM `@actions/core` v3
import works correctly.

---

Nitpick comments:
In `@ci/nodeEngineCheck.mjs`:
- Around line 1-7: Switch the built-in module specifiers to the node: scheme so
Node treats them as core modules: change imports that currently use
'fs/promises', 'path', and 'url' (the import of fileURLToPath) to use
'node:fs/promises', 'node:path', and 'node:url' respectively; keep the same
imported symbols (fs, path, fileURLToPath) and the __dirname shim logic
(path.dirname(fileURLToPath(import.meta.url))) unchanged, and mirror this change
in the other module that imports core Node built-ins.

[coderabbitai]

🧹 Nitpick comments (1)

eslint.config.js (1)

64-64: Consider adding **/*.test.mjs to the Jest config's files glob.

The test-specific config block only targets .test.js/.jsx/.ts/.tsx. If any .mjs test files are introduced later, they won't receive globals.jest and the Jest plugin rules. A forward-looking one-liner keeps this consistent:

♻️ Proposed change

-    files: ['**/*.test.js', '**/*.test.jsx', '**/*.test.ts', '**/*.test.tsx'],
+    files: ['**/*.test.js', '**/*.test.jsx', '**/*.test.mjs', '**/*.test.ts', '**/*.test.tsx'],

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@eslint.config.js` at line 64, The files glob in eslint.config.js (the files:
[...] entry) omits .test.mjs, so any future MJS test files won't get the
Jest-specific config (globals.jest and plugin rules); update the files array to
include '**/*.test.mjs' alongside '**/*.test.js', '**/*.test.jsx',
'**/*.test.ts', '**/*.test.tsx' so .mjs tests are matched and receive the Jest
config and rules.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@eslint.config.js`:
- Line 64: The files glob in eslint.config.js (the files: [...] entry) omits
.test.mjs, so any future MJS test files won't get the Jest-specific config
(globals.jest and plugin rules); update the files array to include
'**/*.test.mjs' alongside '**/*.test.js', '**/*.test.jsx', '**/*.test.ts',
'**/*.test.tsx' so .mjs tests are matched and receive the Jest config and rules.

[parseplatformorg]

🎉 This change has been released in version 9.0.1-alpha.4

[parseplatformorg]

🎉 This change has been released in version 9.1.0