[mridang]

Bumps the npm-security-updates group with 9 updates in the / directory:

Package	From	To
@actions/core	1.11.1	3.0.1
@actions/exec	1.1.1	3.0.0
@actions/http-client	2.2.3	4.0.1
@actions/io	1.1.3	3.0.2
@semantic-release/npm	13.1.1	13.2.0
jest-junit	16.0.0	17.0.0
normalize-url	8.0.2	9.0.1
undici	5.29.0	6.29.1
uuid	8.3.2	14.0.3

Updates @actions/core from 1.11.1 to 3.0.1

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @actions/core since your current version.

Updates @actions/exec from 1.1.1 to 3.0.0

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @actions/exec since your current version.

Updates @actions/http-client from 2.2.3 to 4.0.1

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @actions/http-client since your current version.

Updates @actions/io from 1.1.3 to 3.0.2

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @actions/io since your current version.

Updates @semantic-release/npm from 13.1.1 to 13.2.0

Release notes

Sourced from @semantic-release/npm's releases.

v13.2.0

13.2.0 (2026-09-21)

Features

• trusted-publishing: add support for CircleCI (fb35b81)

v13.1.5

13.1.5 (2026-03-01)

Bug Fixes

• deps: update dependency normalize-url to v9 (#1095) (daec492)

v13.1.4

13.1.4 (2026-02-06)

Bug Fixes

• deps: update dependency @actions/core to v3 (#1085) (17abfe1)

v13.1.3

13.1.3 (2025-12-12)

Bug Fixes

• deps: update dependency @actions/core to v2 (#1055) (fa4a3ab)

v13.1.2

13.1.2 (2025-11-14)

Bug Fixes

• deps: update dependency read-pkg to v10 (#1032) (f3f1a00)

Commits

• 5ef76be Merge pull request #1212 from Thomaash/trusted-publishing--circleci
• 1a4bdda chore(deps): lock file maintenance (#1232)
• 886ec16 chore(deps): update dependency prettier to v3.9.8 (#1231)
• 0388a4d chore(deps): update dependency prettier to v3.9.7 (#1230)
• fb35b81 feat(trusted-publishing): add support for CircleCI
• f5cca0a chore(deps): lock file maintenance (#1229)
• 095f289 chore(deps): update dependency p-retry to v8.0.1 (#1227)
• bb003a4 chore(deps): lock file maintenance (#1228)
• ca0b340 chore(deps): update dependency got to v16 (#1226)
• 22a1e17 chore(deps): lock file maintenance (#1225)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @semantic-release/npm since your current version.

Updates jest-junit from 16.0.0 to 17.0.0

Release notes

Sourced from jest-junit's releases.

v17.0.0

Upgrade uuid package to latest - jest-community/jest-junit#284

Commits

• 20d8f14 v17.0.0
• c91dd20 Merge pull request #284 from palmerj3/upgrade-uuid-14
• 8ff39ee Upgrade uuid to 14.0.0
• e866b5f Add CODEOWNERS
• 33a5a8b Merge pull request #278 from jest-community/update-ci-versions
• f33e1f2 Update to Jest 30.2.0 and regenerate snapshots
• 81c9775 NPM audit fix
• 50e2666 Convert from yarn to npm
• b4a7e14 Add snapshot update command to CLAUDE.md
• b56a503 Simplify CI to test only Jest 30.x
• Additional commits viewable in compare view

Updates normalize-url from 8.0.2 to 9.0.1

Release notes

Sourced from normalize-url's releases.

v9.0.1

• Fix removeExplicitPort option not working for localhost ef8df19

---

sindresorhus/normalize-url@v9.0.0...v9.0.1

v9.0.0

Breaking

• Require Node.js 20 c0477f6

Improvements

• Add customProtocols option 0c6c6b9
• Add emptyQueryValue option 2f2536e
• Preserve percent-encoded reserved query characters 5630770

---

sindresorhus/normalize-url@v8.1.1...v9.0.0

v8.1.1

• Fix removeDirectoryIndex option to handle trailing slashes consistently 320d9b3

---

sindresorhus/normalize-url@v8.1.0...v8.1.1

v8.1.0

• Add removePath and transformPath option dfcfc06
• Fix path-like query strings losing structure when sorting parameters 92eb703

---

sindresorhus/normalize-url@v8.0.2...v8.1.0

Commits

• 9fdbec8 9.0.1
• ef8df19 Fix `removeExplicitPort` option not working for `localhost`
• ed32644 9.0.0
• c0477f6 Require Node.js 20
• 0c6c6b9 Add `customProtocols` option
• 5630770 Preserve percent-encoded reserved query characters
• 2f2536e Add `emptyQueryValue` option
• b7fbc1a 8.1.1
• 8e9b874 Minor tweaks
• 320d9b3 Fix `removeDirectoryIndex` option to handle trailing slashes consistently
• Additional commits viewable in compare view

Updates undici from 5.29.0 to 6.29.1

Release notes

Sourced from undici's releases.

v6.29.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

What's Changed

• [v6.x] fix(fetch): fix aborting Streams (#3754) by @mrityunjay-pandey in nodejs/undici#6000

Full Changelog: nodejs/undici@v6.29.0...v6.29.1

Commits

• 8c57f6c [Release] v6.29.1 (#6023)
• 39f93e1 fix(websocket): bound automatic PONG writes under backpressure
• c43b23f fix(eventsource): bound retained SSE parser state
• 1325a87 fix(fetch): abort excessive content encoding responses
• 8c59f6b fix: preserve Agent connection options
• b40fbfc fix: handle post-connect TLS certificate errors
• 407630a [v6.x] fix(fetch): fix aborting Streams (#3754) (#6000)
• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Updates uuid from 8.3.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

• rerelease to fix provenance. (49ccb35)

v12.0.1

12.0.1 (2026-04-29)

Bug Fixes

• backport fix for GHSA-w5hq-g745-h8pq (3d61d6a)

v11.1.1

11.1.1 (2026-04-29)

Bug Fixes

• backport GHSA-w5hq-g745-h8pq fix (32389c8)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

• backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

Commits

• 993ff7b chore(main): release 14.0.3 (#982)
• f7d19b9 chore: update workflow actions (#983)
• b44f159 fix: fix CITGM #1154 (#981)
• dd8c173 chore: update deps (#975)
• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin `publint` version in CI (#966)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.