[mridang]

Bumps the npm-security-updates group with 8 updates in the / directory:

Package	From	To
@actions/core	1.11.1	3.0.1
@actions/github	6.0.1	9.1.1
@octokit/plugin-paginate-rest	9.2.2	14.0.0
@octokit/plugin-rest-endpoint-methods	10.4.1	17.0.0
undici	5.29.0	6.29.1
@actions/http-client	2.2.3	3.0.2
@octokit/types	13.10.0	16.0.0
@octokit/openapi-types	24.2.0	27.0.0

Updates @actions/core from 1.11.1 to 3.0.1

Updates @actions/github from 6.0.1 to 9.1.1

Updates @octokit/plugin-paginate-rest from 9.2.2 to 14.0.0

Release notes

Sourced from @octokit/plugin-paginate-rest's releases.

v14.0.0

14.0.0 (2025-10-31)

Features

• add immutable releases, enterprise team membership, enterprise team organization endpoints (413e899)

BREAKING CHANGES

• Remove GET /projects/{project_id}/columns
• Remove GET /enterprises/{enterprise}/secret-scanning/alerts

v13.2.1

13.2.1 (2025-10-20)

Bug Fixes

• deps: update @octokit/types (#698) (ba56fbc)

v13.2.0

13.2.0 (2025-09-29)

Features

• new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#690) (0e236cb)

v13.1.1

13.1.1 (2025-06-27)

Bug Fixes

• handle url in response when using pagination with compareCommits (#686) (8e5da25)

v13.1.0

13.1.0 (2025-06-16)

Features

• add paginatantion support for compareCommits and compareCommitsWithBasehead (#678) (6d8ea8a)

v13.0.1

13.0.1 (2025-05-25)

Bug Fixes

• deps: update @octokit/types - no new paginated endpoints (#680) (8ec2713)

v13.0.0

13.0.0 (2025-05-20)

Continuous Integration

• stop testing against NodeJS v18 (#677) (0b0bb9c)

BREAKING CHANGES

• Drop support for NodeJS v18

• build: set minimal node version in build script to v20

• ci: stop testing against NodeJS v18

v12.0.0

12.0.0 (2025-04-10)

Features

• add new org campaigns endpoints and remove deprecated endpoints (#671) (65d3d50)

BREAKING CHANGES

• remove deprecated copilot usage endpoints

Commits

• 413e899 feat: add immutable releases, enterprise team membership, enterprise team organization endpoints
• 3d311d6 chore(deps): update dependency @types/node to v24 (#701)
• ba56fbc fix(deps): update `@octokit/types` (#698)
• 80745be ci(action): update actions/checkout action to v5 (#687)
• 0e236cb feat: new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#690)
• bf19e3e chore(deps): update dependency prettier to v3.6.2 (#685)
• 4f9fc56 ci(action): update actions/setup-node action to v5 (#688)
• 8e5da25 fix: handle url in response when using pagination with compareCommits (#686)
• 6d8ea8a feat: add paginatantion support for `compareCommits` and `compareCommitsWithBasehead` (#678)
• 8ec2713 fix(deps): update `@octokit/types` - no new paginated endpoints (#680)
• Additional commits viewable in compare view

Updates @octokit/plugin-rest-endpoint-methods from 10.4.1 to 17.0.0

Release notes

Sourced from @octokit/plugin-rest-endpoint-methods's releases.

v17.0.0

17.0.0 (2025-10-31)

Features

• add immutable releases, enterprise team membership, enterprise team organization, custom runner images, many type additions and improvements (#831) (c82898a)

BREAKING CHANGES

• Remove listAlertsForEnterprise
• Several custom property endpoints changed ID

v16.1.1

16.1.1 (2025-10-20)

Bug Fixes

• deps: update @octokit/types, regenerate documentation (#827) (75e649b)

v16.1.0

16.1.0 (2025-09-16)

Features

• new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#814) (0a8fdd9)

v16.0.0

16.0.0 (2025-05-25)

Features

• remove deprecated projects endpoints, remove deprecated copilot usage metric endpoints, add new billing.getGithubBillingUsageReportUser() and credentials.revoke() endpoint methods, private registry methods no longer in private beta, type update (#803) (4196f01)

BREAKING CHANGES

• remove deprecated projects v1 endpoints
• remove deprecated copilot usage metrics endpoints

v15.0.0

15.0.0 (2025-05-20)

Continuous Integration

• stop testing against NodeJS v18 (#801) (c016ce3)

BREAKING CHANGES

• Drop support for NodeJS v18

• build: set minimal node version in build script to v20

• ci: stop testing against NodeJS v18

v14.0.0

14.0.0 (2025-04-10)

Features

• add new organization campaign endpoints, remove deprecated endpoints (#797) (4c8a166)

BREAKING CHANGES

• remove deprecated copilot metrics endpoints
• remove deprecated legacy projects endpoints

Commits

• c82898a feat: add immutable releases, enterprise team membership, enterprise team organization, custom runner images, many type additions and improvements (#831)
• 245a8e2 ci(action): update peter-evans/create-or-update-comment action to v5 (#821)
• e3005af ci(action): update github/codeql-action action to v4 (#824)
• e49c379 ci(action): update actions/setup-node action to v6 (#825)
• 75e649b fix(deps): update `@octokit/types`, regenerate documentation (#827)
• 8978de7 chore(deps): update dependency prettier to v3.6.2 (#805)
• e014e32 chore(deps): update dependency sinon to v21 (#804)
• 0a2ad8c ci(action): update actions/checkout action to v5 (#808)
• 0a8fdd9 feat: new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#814)
• a60572f chore(deps): update dependency sort-keys to v6 (#811)
• Additional commits viewable in compare view

Updates undici from 5.29.0 to 6.29.1

Release notes

Sourced from undici's releases.

v6.29.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

What's Changed

• [v6.x] fix(fetch): fix aborting Streams (#3754) by @mrityunjay-pandey in nodejs/undici#6000

Full Changelog: nodejs/undici@v6.29.0...v6.29.1

Commits

• 8c57f6c [Release] v6.29.1 (#6023)
• 39f93e1 fix(websocket): bound automatic PONG writes under backpressure
• c43b23f fix(eventsource): bound retained SSE parser state
• 1325a87 fix(fetch): abort excessive content encoding responses
• 8c59f6b fix: preserve Agent connection options
• b40fbfc fix: handle post-connect TLS certificate errors
• 407630a [v6.x] fix(fetch): fix aborting Streams (#3754) (#6000)
• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• Additional commits viewable in compare view

Updates @actions/http-client from 2.2.3 to 3.0.2

Updates @octokit/types from 13.10.0 to 16.0.0

Release notes

Sourced from @octokit/types's releases.

v16.0.0

16.0.0 (2025-10-30)

Features

• add immutable releases, enterprise team membership, enterprise team organization, custom runner images, many type additions and improvements (#693) (dc1ceeb)

BREAKING CHANGES

• Removed endpoints

v15.0.2

15.0.2 (2025-10-29)

Bug Fixes

• update generated file & update dependency node to v24 (#691) (f5f5743)

v15.0.1

15.0.1 (2025-10-20)

Bug Fixes

• reduce complexity (#687) (a0529c1)

v15.0.0

15.0.0 (2025-09-16)

Features

• new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#683) (56ff680)

BREAKING CHANGES

• remove project card endpoints for classic projects

v14.1.0

14.1.0 (2025-05-25)

Features

• new GET /users/{username}/settings/billing/usage, POST /credentials/revoke endpoints, endpoint type updates, type performance fixes (#675) (a7ec830), closes #667 #666

v14.0.0

14.0.0 (2025-04-10)

Features

• new /orgs/{org}/campaigns and /orgs/{org}/campaigns/{campaign_number} enpoints, remove Copilot usage endpoints (#672) (42321eb)

BREAKING CHANGES

• remove Copilot usage endpoints

Commits

• dc1ceeb feat: add immutable releases, enterprise team membership, enterprise team organization, custom runner images, many type additions and improvements (#693)
• f5f5743 fix: update generated file & update dependency node to v24 (#691)
• a0529c1 fix: reduce complexity (#687)
• 435bdcc ci(action): update peter-evans/create-or-update-comment action to v5 (#684)
• 52ffdca ci(action): update actions/setup-node action to v6 (#689)
• aaf87a2 ci(action): update github/codeql-action action to v4 (#688)
• db7d9bc chore(deps): update dependency semantic-release to v25 (#690)
• 56ff680 feat: new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#683)
• 7ef763e ci(action): update actions/checkout action to v5 (#679)
• 1ce7ba2 chore(deps): update dependency node to v22 (#677)
• Additional commits viewable in compare view

Updates @octokit/openapi-types from 24.2.0 to 27.0.0

Release notes

Sourced from @octokit/openapi-types's releases.

v27.0.0

27.0.0 (2025-10-30)

Features

• add GHES 3.18, immutable releases, enterprise team membership, enterprise team organization, custom runner images, many type additions and improvements (#479) (1e600e2)

BREAKING CHANGES

• Several endpoints ID change
• Removed endpoints

v26.0.0

26.0.0 (2025-09-16)

Features

• remove GHES 3.13, new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#471) (f322421)

BREAKING CHANGES

• remove GHES 3.13

v25.1.0

25.1.0 (2025-05-25)

Features

• add GHES 3.17, new /credentials/revoke, /users/{username}/settings/billing/usage, /enterprises/{enterprise}/members/{username}/copilot endpoints, description updates (#493) (#465) (9c706c4)

v25.0.0

25.0.0 (2025-04-09)

Features

• new /orgs/{org}/campaigns, /orgs/{org}/campaigns/{campaign_number} endpoints, remove Copilot usage endpoints, description updates (#461) (f27d1a2)

BREAKING CHANGES

• Remove Copilot usage endpoints

Commits

• 1e600e2 feat: add GHES 3.18, immutable releases, enterprise team membership, enterprise team organization, custom runner images, many type additions and improvements (#479)
• e53efcf build(deps): lock file maintenance (#478)
• f492e23 build(deps): lock file maintenance (#472)
• 7cb23f0 chore(deps): update dependency github-enterprise-server-versions to v3 (#475)
• bdc899c chore(deps): update dependency prettier to v3.6.2 (#467)
• 91f7208 ci(action): update actions/setup-node action to v5 (#469)
• f322421 feat: remove GHES 3.13, new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#471)
• 200a0a7 ci(action): update actions/checkout action to v5 (#468)
• 5fea285 build(deps): lock file maintenance (#466)
• 8c380d3 ci(action): update gr2m/release-notifier-action action to v2 (#470)
• Additional commits viewable in compare view