fix(sec-auto): aikido Fix security issue in undici via minor version upgrade from 7.28.0 to 7.29.0

[aikido-autofix]

AI AutoFix

These PRs will require human vetting and potentially some fixes to fully integrate with the codebase.

Upgrade undici to fix cache poisoning, response desynchronization, cookie injection, and HTTP request smuggling vulnerabilities.

✅ Code not affected by breaking changes.

✅ No breaking changes from the undici upgrade affect this codebase.

The codebase uses @actions/github (Octokit) for making HTTP requests to the GitHub API, but does not directly use undici's setCookie() function or retry interceptor. While undici is a transitive dependency (used internally by @actions/http-client and @actions/github), the breaking changes are isolated to:

1. Retry interceptor with Content-Range validation: Not used - no retry interceptor configuration or partial response handling found in the source code

2. setCookie() stricter validation: Not used - no cookie setting operations found in the source code

The codebase only makes standard GitHub API calls through Octokit's high-level interface, which abstracts away the underlying HTTP client implementation.

All breaking changes by upgrading undici from version 7.28.0 to 7.29.0 (CHANGELOG)

Version	Description
7.29.0	The retry interceptor now rejects partial responses whose Content-Length is inconsistent with Content-Range, which may cause previously accepted responses to be rejected.
7.29.0	setCookie() now validates cookie domains, paths, and unparsed attributes more strictly, which may reject previously accepted values.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-13697	HIGH	[undici] The cache interceptor mishandles malformed Cache-Control private directives, allowing private response bodies and headers to be stored in shared cache and served to different callers, causing information disclosure. Additionally, certain Cache-Control headers trigger an uncaught TypeError that can crash the process.
CVE-2026-14643	MEDIUM	[undici] Cache interceptor fails to parse qualified Cache-Control directives with whitespace around equals signs, allowing authenticated responses to be incorrectly cached and served to unauthorized users in shared-cache mode.
CVE-2026-16728	MEDIUM	[undici] A retry interceptor vulnerability allows mismatched Content-Length headers and response bodies after retries, enabling downstream response desynchronization and corruption in proxies/gateways that forward upstream headers without recalculation.
CVE-2026-16729	MEDIUM	[undici] The setCookie function fails to sanitize cookie domain values and unparsed entries, allowing attackers to inject additional cookie attributes like SameSite, HttpOnly, and Secure. This can bypass CSRF protections or force/strip security attributes in applications using user-controlled input for cookie configuration.
CVE-2026-15157	MEDIUM	[undici] A vulnerability allows attackers to inject CRLF sequences into HTTP headers by passing a hand-rolled blob-like request body with an untrusted type property, enabling HTTP request smuggling. This affects applications using undici's request, stream, pipeline, or dispatch methods with duck-typed blob objects derived from user input.

🤖 Remediation details

Fix undici transitive vulnerability via override bump to 7.29.0

Short summary

This PR remediates multiple high- and medium-severity CVEs in the transitive dependency undici. The fix updates the existing overrides entry in the root package.json and refreshes package-lock.json so the single resolved instance of undici moves from 7.28.0 to 7.29.0.

undici

undici is pulled in transitively by @actions/github and @actions/http-client (both the root copy and the nested copy under @actions/core), all of which declare a ^6.23.0 range for undici — meaning no published version of those parents will ever resolve undici to the 7.x patched range on its own. The project already carried an override ("undici@<7.28.0": "7.28.0") to handle a prior round of CVEs using the same mechanism; this PR advances that floor from <7.28.0 → 7.28.0 to <7.29.0 → 7.29.0, which is the minimum version that patches all five newly reported CVEs. Because the parent packages have no fixing release that would pull in undici ≥ 7.29.0, the override remains the only viable non-destructive fix.

Version changes

Package	From	To	Why updated
undici	7.28.0	7.29.0	Direct CVE fix via override ("undici@<7.29.0": "7.29.0" in root package.json)