fix(sec-auto): aikido Fix 13 security issues in undici, @fastify/busboy

[aikido-autofix]

AI AutoFix

These PRs will require human vetting and potentially some fixes to fully integrate with the codebase.

Upgrade undici and @fastify/busboy to fix HTTP request smuggling, decompression DoS, and WebSocket crashes.

✅ Code not affected by breaking changes.

✅ No breaking changes from the undici upgrade affect this codebase directly.

The codebase does not directly use undici - it's only a transitive dependency through @actions/github and @actions/http-client. The source code does not use any of the removed features (throwOnError, interceptors, or deduplicate interceptor).

The action runs on Node.js 24 (specified in action.yml), which satisfies undici 7.x's requirement of Node.js >= 18.

The upgrade path depends on whether @actions/github and @actions/http-client have released versions compatible with undici 7.x. Since this codebase doesn't directly control or use undici's API, the risk is low as long as the intermediate dependencies are updated appropriately.

All breaking changes by upgrading undici from version 5.29.0 to 6.27.0 (CHANGELOG)

Version	Description
6.0.0	Node.js 16 support dropped (referenced by "16 eol" PR #2480)
6.14.0	Dropped Node.js support for versions < v18.17.0

✅ 13 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-1525	🚨 CRITICAL	[undici] Duplicate HTTP Content-Length headers with case-variant names are allowed, creating malformed requests that can cause denial of service or enable HTTP request smuggling attacks in inconsistent header interpretation scenarios.
CVE-2026-22036	HIGH	[undici] An unbounded decompression chain vulnerability allows a malicious server to insert thousands of compression steps, causing excessive CPU usage and memory allocation. This results in denial of service through resource exhaustion.
CVE-2026-1526	HIGH	[undici] A malicious WebSocket server can send compressed frames that expand to extremely large sizes in memory without limits, causing denial-of-service through memory exhaustion and process crash. The vulnerability stems from unbounded decompression in the permessage-deflate extension without size validation.
CVE-2026-2229	HIGH	[undici] A malicious WebSocket server can crash the client process by sending an invalid server_max_window_bits parameter in the permessage-deflate extension, causing an uncaught RangeError when creating a zlib decompressor with an out-of-range value.
AIKIDO-2024-10065	MEDIUM	[undici] Affected versions of the undici library are vulnerable to memory leaks. By making multiple fetch requests with the same AbortSignal, undici adds event listeners without removing them, leading to excessive memory consumption.
CVE-2026-9679	MEDIUM	[undici] The cookie parser incorrectly percent-decodes cookie values, allowing encoded sequences like %0D%0A to become literal bytes that enable HTTP response header injection. This permits attackers to inject arbitrary headers (Set-Cookie, Location, Cache-Control) into downstream responses, causing session fixation, open redirects, or cache poisoning in applications that forward parsed cookies to response headers.
AIKIDO-2026-10022	MEDIUM	[undici] A malicious server can send HTTP responses with excessive layered Content-Encoding headers, forcing the client into recursive decompression that exhausts CPU and memory resources, causing denial-of-service. This was mitigated by limiting the encoding chain to a maximum of 5 layers.
CVE-2026-1527	MEDIUM	[undici] HTTP request smuggling vulnerability allowing CRLF injection through the upgrade option, enabling arbitrary header injection and premature request termination to smuggle data to non-HTTP services.
CVE-2026-11525	LOW	[undici] Set-Cookie header parsing accepts non-spec SameSite values containing substrings like "Strict" or "None" instead of exact matches, allowing malicious servers to downgrade cookie security policies. This enables attackers to weaken SameSite enforcement through substring matching exploitation.
CVE-2026-6733	LOW	[undici] HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets, allowing an attacker-controlled upstream server to inject unsolicited responses that get associated with subsequent requests, causing responses to be delivered to wrong requests.
AIKIDO-2026-10369	LOW	[undici] Prototype pollution vulnerability allows attackers to modify object prototypes through specially crafted input with keys like __proto__ or constructor, potentially influencing application behavior or enabling further attacks.
AIKIDO-2026-10385	LOW	[undici] A prototype pollution vulnerability allows attackers to inject special keys like __proto__, constructor, or prototype into internal objects, potentially modifying the prototype chain and influencing application behavior or enabling further attacks.
AIKIDO-2025-10564	MEDIUM	[@fastify/busboy] Improper parsing of quoted filename parameters allows attackers to bypass file extension validation by appending forbidden extensions outside closing quotes, potentially enabling malicious script execution or XSS attacks.

🤖 Remediation details

Fix critical and high-severity vulnerabilities in undici and @fastify/busboy via parent dependency bumps

Short summary

This PR remediates multiple vulnerabilities in two transitive packages — undici and @fastify/busboy — by bumping their upstream parent dependencies in the root package.json. The yarn.lock lockfile is updated accordingly; no resolutions overrides remain in the final state.

undici

undici was installed transitively at 5.29.0 through the chain @actions/core / @actions/github → @actions/http-client → undici. The ^5.x ranges declared by the old parents could never resolve to the patched 6.x line, so parent bumps were required. @actions/core was raised from ^1.10.0 to ^2.0.0 and @actions/github from ^6.0.0 to ^8.0.0; those releases pull @actions/http-client@^3.0.2, which in turn declares undici@^6.23.0, allowing Yarn to resolve undici to 6.27.0 — the minimum version that satisfies all patched-version specs across the full advisory set.

@fastify/busboy

@fastify/busboy was installed transitively at 2.1.1 as a dependency of undici@5.29.0. Once undici was updated to 6.27.0, the @fastify/busboy dependency was dropped entirely — undici@6.x no longer depends on it — so the vulnerable 2.1.1 copy is removed from the lockfile as a natural consequence of the undici upgrade with no additional manifest change needed.

Version changes

Package	From	To	Why updated
@actions/core	^1.10.0 → 1.11.1	^2.0.0 → 2.0.3	Parent bump required to unlock @actions/http-client@^3.x and transitively undici@^6.x
@actions/github	^6.0.0 → 6.0.0	^8.0.0 → 8.0.1	Parent bump required to unlock @actions/http-client@^3.x and transitively undici@^6.x
@actions/http-client	2.2.3	3.0.2	Transitive after parent bump (@actions/core, @actions/github); 3.x declares undici@^6.23.0
undici	5.29.0	6.27.0	Direct CVE fix (transitive); resolved via updated @actions/http-client@3.0.2
@fastify/busboy	2.1.1	(removed)	Transitive CVE fix; undici@6.x no longer depends on this package