fix(deps): resolve 7 audit advisories in undici and brace-expansion

[marc0olo]

pnpm audit currently fails on every PR — 7 vulnerabilities (3 high, 2 moderate, 2 low). It last passed on 2026-04-13, and also failed on the unrelated dependabot/npm_and_yarn/esbuild-0.28.1 PR in June.

This PR is dependency-only and independent of any other work.

What was failing

Package	Advisories	Path	Needs
undici	4 (1 high, 1 moderate, 2 low)	. > @actions/core > @actions/http-client > undici	>=6.27.0
brace-expansion	3 (2 high, 1 moderate)	. > rimraf > glob > minimatch > brace-expansion	>=5.0.6, >=5.0.7, >=5.0.8

Worth flagging: the repo already had a brace-expansion override, but pinned at ^5.0.5 — which predates all three of its advisories, so it had stopped doing anything. Raising it is part of the fix rather than a new addition.

Changes

• Add undici: ^6.27.0 override → resolves 6.28.0.
• Raise brace-expansion override from ^5.0.5 to 5.0.8.
• Rebuild the four action bundles (create-pr, assemble-docs, submit-docs, extract-version), since each bundles @actions/core. The dist diff is the undici 6.24.1 → 6.28.0 swap and nothing else — the same 794-line change in all four files.

Why brace-expansion is pinned exactly

^5.0.8 resolves to 5.0.9, published 2026-07-30 — inside the 7-day window that minimumReleaseAge: 10080 in pnpm-workspace.yaml exists to enforce. Overrides appear to bypass that gate, so a caret range here would quietly pull in a version the policy is meant to exclude. The exact pin keeps the resolution deterministic and policy-compliant. Both chosen versions clear the window: brace-expansion 5.0.8 (2026-07-23) and undici 6.28.0 (2026-07-24).

If you'd rather express this differently — a caret range plus a minimumReleaseAgeExclude entry, or bumping @actions/core itself — happy to change it.

Verification

• pnpm audit → No known vulnerabilities found, exit 0 (was exit 1 with 7 findings).
• pnpm build succeeds for all four actions; dist regenerated and committed, so check_dist:required should pass.
• prettier --check clean.

Suggested follow-up (not in this PR)

self-pnpm-audit.yaml only triggers on pull_request, never on pushes to main or on a schedule. That's why this went unnoticed for months and then surfaced as a red X on unrelated PRs. Adding a push trigger on main or a nightly schedule would make the gate meaningful. Happy to file that separately.

🤖 Generated with Claude Code