fix: upgraded packages to fix vulnerabilities

[Raj-StepSecurity]

No description provided.

[claude]

Two concerns with this new suppression file:

Prefer upgrading over suppressing. This fixture's lockfile is stale — package.json requests @modelcontextprotocol/sdk@^1.24.0 but bun.lock still resolves 1.12.0 (its workspace spec even reads ^1.11.0). A bun install in this dir would pull the SDK to 1.24+ (newer express, qs, send, etc.) and likely eliminate most of these 10 advisories at the source rather than masking them. Suppressing a stale lockfile leaves the fixture pinned to known-vulnerable transitive deps.

Blanket reasons aren't auditable. All 10 entries use the identical reason "test dependencies", unlike the repo-root osv-scanner.toml, which gives specific per-vuln rationale (e.g. "project does not use WebSocket connections"). Since osv-scanner's IgnoredVulns match by advisory ID with no package/path scoping, a future reader can't tell whether each suppression is still valid. At minimum, name the affected package per entry. Also worth confirming none of these 10 IDs overlap a still-vulnerable package in the shipped root/base-action trees (the root package also depends on @modelcontextprotocol/sdk), so an ID-based ignore can't leak into production coverage.

[claude]

Code review summary

Reviewed across quality, security, performance, tests, and docs. This is a low-risk, well-targeted upgrade — no blocking issues. Notes below (one inline on the new osv-scanner.toml).

✅ The @actions/github ^6 → ^8 major bump is safe as used. The package is imported only in src/github/context.ts, and only github.context (.payload, .repo, .actor, .eventName) is consumed — a Context API that's stable across majors. getOctokit() is never called; actual API calls go through @octokit/rest@21 (unchanged). The v7/v8 breaking changes live in the bundled Octokit client, which this code doesn't touch. The undici 5→6 bump is a coherent transitive consequence (@actions/github@8 → @actions/http-client@3 → undici ^6), and versions are consistent across the root and base-action lockfiles. form-data 4.0.6 is past the 4.0.4 fix. Good to fix the vuln at the dependency root rather than by suppression.

Worth a follow-up — the root osv-scanner.toml undici ignores may now be stale. With root undici now at 6.27.0, several of the 5 pre-existing undici suppressions in the top-level osv-scanner.toml likely correspond to advisories already fixed in the 6.x line. Since this PR's stated goal is fixing vulnerabilities, pruning any now-obsolete IgnoredVulns there would keep the ignore list from silently masking a future regression. (Not touched by this PR — verification only.)

Minor — the PR body is empty. A one-line description listing which advisories are fixed vs. suppressed, and why the two-major @actions/github jump, would make this self-reviewable.