Track upstream blockers for upgrading the `undici` package

[DilumAluthge-LLM]

🤖 This issue was written and edited by Codex and Claude Code.

This repository is blocked from adopting the latest undici by upstream @actions/github and @actions/http-client dependency ranges.

Current state as of April 10, 2026, verified from npm with npm view ... --prefer-online:

• undici latest: 8.0.2
• undici latest 6.x: 6.24.1
• @actions/github latest: 9.1.0
• @actions/http-client latest: 4.0.0
• @actions/core latest: 3.0.0
• @actions/tool-cache latest: 4.0.0

This repo does not depend on undici directly. It currently resolves undici@6.24.1 indirectly through the GitHub Actions toolkit dependency graph:

• @actions/github 9.1.0 depends on undici: ^6.23.0
• @actions/http-client 4.0.0 depends on undici: ^6.23.0
• @actions/core 3.0.0 depends on @actions/http-client
• @actions/tool-cache 4.0.0 depends on @actions/http-client

There do not appear to be any newer published releases of @actions/http-client, @actions/core, or @actions/tool-cache that would unblock a newer undici. The newest published @actions/github, 9.1.0, still declares undici: ^6.23.0.

This means the blocker is upstream package ranges, not this repo's Node engine requirement.

Additional local context from this repo's package-lock.json:

• node_modules/@actions/github is locked to 9.0.0 and declares undici: ^6.23.0
• node_modules/@actions/github/node_modules/@actions/http-client is locked to 3.0.2 and declares undici: ^6.23.0
• node_modules/@actions/http-client is locked to 4.0.0 and declares undici: ^6.23.0
• node_modules/undici resolves to 6.24.1

So the local tree has both a direct @actions/github -> undici edge and @actions/http-client -> undici edges, and all of them currently cap resolution to the 6.x line.

Relevant upstream issues in actions/toolkit as of April 10, 2026:

• actions/toolkit#2361 Please update dependency undici actions/toolkit#2361 is OPEN and looks like the most directly relevant current issue. It asks to update the undici dependency in packages/http-client/package.json.
• actions/toolkit#2029 @actions/core: Upgrade @actions/http-client to 2.2.3 actions/toolkit#2029 is OPEN and is older, but it shows the same pattern where @actions/core lags @actions/http-client updates.

Related issues that Codex/Claude Code checked that are now CLOSED:

• actions/toolkit#2352 [@actions/http-client] Security issue with dependency package undici (version < 6.24.0) actions/toolkit#2352
• actions/toolkit#2242 Low severity vulnerability CVE-2026-22036 in undici <6.23.0 for multiple toolkit @actions/* actions/toolkit#2242

So the best upstream issue to monitor from this repo is actions/toolkit#2361.

Follow-up:

• Monitor @actions/http-client for a widened undici range.
• Monitor @actions/github for a widened undici range.
• Update this repo once upstream publishes compatible releases.

🤖 This issue was written and edited by Codex and Claude Code.

[NorseGaud]

Status of this?

[DilumAluthge]

I've still been hoping that GitHub will fix this upstream (in their @actions/* packages).

[DilumAluthge]

🤖 The following content was written by Claude Code.

Status update as of September 17, 2026. Version numbers were verified from npm with npm view ... --prefer-online; upstream issue and PR state was verified via the GitHub API.

Upstream package ranges

New releases of the affected packages have been published since this issue was filed. None of them widened the undici range.

Package	Latest	Published	undici dependency
@actions/github	9.1.1	2026-04-21	^6.23.0 (direct)
@actions/http-client	4.0.1	2026-04-21	^6.23.0 (direct)
@actions/core	3.0.1	2026-04-21	via @actions/http-client ^4.0.0
@actions/tool-cache	4.0.0	2026-01-29	via @actions/http-client ^4.0.0

Resolution remains capped to the undici 6.x line by these ranges, not by this repo's Node engine requirement.

Current undici releases

• latest: 8.10.2
• latest 7.x: 7.29.1
• latest 6.x: 6.28.1

6.28.1, 7.29.1, and 8.10.2 were all published on 2026-09-04. The 6.x line is still receiving releases.

State of this repo

package-lock.json now resolves undici@6.28.1, up from 6.24.1 when this issue was filed.

• node_modules/@actions/github → 9.1.1, declares undici: ^6.23.0
• node_modules/@actions/github/node_modules/@actions/http-client → 3.0.2, declares undici: ^6.23.0
• node_modules/@actions/http-client → 4.0.1, declares undici: ^6.23.0
• node_modules/undici → 6.28.1

The advisories published on 2026-08-03 — GHSA-4cwx-7wf7-3272 (high), GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm, and GHSA-8xcm-r25x-g524 (all moderate) — list 6.28.0 as the first patched version on the 6.x line. GHSA-jr45-8vmc-qm54 lists only 7.x and 8.x ranges as affected.

Upstream issues in actions/toolkit

• actions/toolkit#2361 — OPEN. Opened 2026-03-27; last comment 2026-06-15. A comment on 2026-05-28 asked whether an externally submitted PR would be reviewed and accepted; it has received no reply.
• actions/toolkit#2029 — OPEN. Last comment 2026-06-17.

Upstream pull requests in actions/toolkit

Range-widening PRs:

• #2295 "feat: undici v7" — open, draft, merge-conflicting. No activity since 2026-02-04.
• #2205 "chore: bump undici to ^7.16.0" — open, draft, merge-conflicting. No activity since 2025-12-11.
• #2374 "consolidate dependabot and npm audit dependency updates" — open. No activity since 2026-04-11.

Within-6.x Dependabot PRs, all opened 2026-08-05, all mergeable, none merged:

• #2471 — undici 6.24.0 → 6.28.0 in packages/http-client
• #2472 — undici 6.24.1 → 6.28.0 in packages/core
• #2473 — undici 6.25.0 → 6.28.0 in packages/tool-cache

Contribution policy of actions/toolkit

The actions/toolkit README states:

Thank you for your interest in this GitHub repo, however, right now we are not taking contributions.

We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time.

🤖 Generated by Claude Code