chore(deps): fix security vulnerabilities (form-data, undici, brace-expansion, fast-xml-parser, picomatch, uuid)

[zenblender]

Summary

Updates six transitive dependencies to patched versions to resolve security advisories:

Package	Before	After	Advisories
form-data	4.0.4	4.0.6	GHSA-hmw2-7cc7-3qxx (high)
undici	5.29.0	6.27.0	GHSA-g9mf-h72j-4rw9, GHSA-2mjp-6q6p-2qxm, GHSA-vrm6-8vpv-qv8q, and others (high)
brace-expansion	1.1.12 / 2.0.2 / 5.0.4	1.1.16 / 2.1.2 / 5.0.7	GHSA-f886-m6hf-6m8v, GHSA-jxxr-4gwj-5jf2 (moderate)
fast-xml-parser	5.5.12	5.9.3	GHSA-gh4j-gqv2-49f6 (moderate)
picomatch	2.3.1	2.3.2	GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj (high)
uuid	8.3.2	11.1.1	GHSA-w5hq-g745-h8pq (moderate)

Approach

Preference was given to lock-file-only updates over overrides entries wherever the patched version was reachable within parent semver ranges:

• Lock-file-only (in-range): form-data, brace-expansion, picomatch
• Override removed: fast-xml-parser — updating @azure/core-xml to 1.5.1 (in-range for @azure/storage-blob's ^1.4.4) pulls fast-xml-parser ^5.5.9 → 5.9.3, and the updated @aws-sdk/xml-builder dropped its fast-xml-parser dependency entirely. Verified the patched version survives a fresh npm install without the override.
• Overrides added (required):
  • undici: ^6.27.0 — @actions/http-client@2.x pins ^5.25.4 and no patched 5.x exists; verified removal of the override reverts the lock to vulnerable 5.29.0
  • uuid: ^11.1.1 — @azure/core-http (via @actions/artifact@4) pins ^8.3.0 and the fix only exists in ≥11.1.1; the alternative (@actions/artifact@6) is a breaking major upgrade, so the override is lower risk

Verification

• npm audit no longer reports any of the six packages (remaining findings are unrelated packages not in scope)
• Full test suite passes: 77/77 tests, 4/4 suites

Note

dist/ contains the ncc-bundled action output (undici/uuid get bundled), so npm run package should be run as part of the normal release flow to pick up the patched versions in the bundle.

[github-actions]

build-and-test: Run #6

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
77	77	0	0	0	0	0	12.1s

🎉 All tests passed!

Github Test Reporter by CTRF 💚

[nsimonson]

How does this get released? Do we need to run npm run all:action so the checked in dist is updated?

[github-actions]

build-and-test: Run #8

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
77	77	0	0	0	0	0	12.3s

🎉 All tests passed!

Github Test Reporter by CTRF 💚

[zenblender]

How does this get released? Do we need to run npm run all:action so the checked in dist is updated?

(Reply written by Claude, the AI assistant that prepared this PR — posted on Scott's behalf.)

Good catch — yes. action.yml points at the checked-in dist/index.js, so the ncc bundle is what actually runs; the lock file update alone wouldn't have changed anything at runtime. The CI workflow runs npm run all:action on every push but only as validation — it never commits the result, and there's no release workflow that rebuilds dist.

I've pushed a second commit (c19b4a8) that runs npm run package (the bundling step of all:action, skipping format:write to avoid unrelated churn) so the bundle now contains the patched undici 6.27.0, form-data 4.0.6, fast-xml-parser 5.9.3, and brace-expansion. I verified the patched code is actually present in the new bundle (e.g. undici 6's websocket permessage-deflate handling, form-data's CRLF escaping). Two side notes:

1. The uuid package turns out to be tree-shaken out of the bundle entirely (only the unrelated @smithy/uuid appears), so that fix only hardens the npm-installed tree — but the override keeps audit clean.
2. Worth noting the earlier dependabot bumps in this fork (fast-uri, fast-xml-builder) also only touched package-lock.json without rebuilding dist, so those fixes aren't in the shipped bundle yet either — this rebuild picks those up too.