Fix Dependabot alerts: undici vulnerabilities

[noahd1]

Summary

Fix undici vulnerabilities (GHSA-v9p9-hfj2-hcw8, GHSA-vrm6-8vpv-qv8q, GHSA-4992-7rv2-5pvq, GHSA-2mjp-6q6p-2qxm) by upgrading @actions/* packages to versions that use undici@^6.23.0.

Dependency upgrades

Package	Old	New	Packages affected
@actions/core	^1.11.1	^2.0.3	install, fmt, coverage, shared
@actions/exec	^1.1.1	^2.0.0	fmt, coverage, shared
@actions/github	^6.0.0	^9.0.0	fmt, coverage
@actions/glob	^0.5.0	^0.6.1	coverage
@actions/tool-cache	^2.0.2	^3.0.1	shared

Code change

• coverage/src/action.ts: Derive WebhookPayload type from actionsGithub.context.payload instead of importing from @actions/github/lib/interfaces (path no longer exported in v9)

Vulnerability details

GHSA	Summary	CVSS	CWE
GHSA-v9p9-hfj2-hcw8	Unhandled Exception in WebSocket Client	7.5	CWE-248
GHSA-vrm6-8vpv-qv8q	Unbounded Memory in WebSocket decompression	7.5	CWE-409
GHSA-4992-7rv2-5pvq	CRLF Injection via upgrade option	4.6	CWE-93
GHSA-2mjp-6q6p-2qxm	HTTP Request/Response Smuggling	6.5	CWE-444

Reachability: None of these vulnerabilities are directly reachable — undici is a transitive dependency and the vulnerable APIs (WebSocket, HTTP upgrade) are not used by the GitHub Actions runtime.

Alerts resolved

#80, #81, #82, #83, #84, #85, #86, #87, #88, #89, #90, #91, #92, #93, #94, #95

Risk assessment

• The @actions/core public API (getInput, setOutput, setFailed, info, warning, error, addPath, setSecret, getBooleanInput, getIDToken) is unchanged across v1 → v2
• The @actions/exec API (exec function) is unchanged across v1 → v2
• The @actions/github usage is limited to context.payload which is stable
• The @actions/tool-cache API (downloadTool, extractZip, extractTar, cacheDir) is unchanged across v2 → v3
• The @actions/glob API is unchanged across v0.5 → v0.6

Test plan

• Typecheck passes (install, fmt, coverage, shared)
• All tests pass (install: 10, coverage: 81, shared: 10 — 101 total)
• Verified undici@6.24.1 in all lockfiles (root, install, fmt, coverage)
• CI passes (builds, tests, dist/ comparison)

🤖 Generated with Claude Code

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.