[WIP] Fix vulnerabilities in node:lts-alpine container image

[Copilot]

• Locate the affected node:lts-alpine container build and its dependency installation
• Update the bundled npm undici dependency to version 6.27.0 or newer alongside existing tar and brace-expansion remediations
• Validate the patch in an isolated container build (tar 7.5.22, brace-expansion 5.0.9, undici 6.28.0)
• Run final repository validation and security checks

• Fixes [container-image-scan] Container findings for node:lts-alpine #50204

[github-actions]

Triage: chore (security) / medium risk

• Category: chore
• Risk: medium
• Priority score: 60/100 (impact 30, urgency 20, quality 10)
• Recommended action: defer — monitor until diff is populated (currently 0 files changed, WIP/draft)
• Notes: Addresses 1 critical + 4 high CVEs in node:lts-alpine. CI status unstable. Revisit once agent produces the actual dependency bump diff.

Generated by 🔧 PR Triage Agent · auto · 28.5 AIC · ⌖ 2.46 AIC · ⊞ 8K · ◷

[github-actions]

Great work! 🎉 This PR looks solid for addressing the container image vulnerabilities.

Summary:
You've successfully fixed the security vulnerabilities in the node:lts-alpine container image by:

• Patching the bundled npm dependencies (tar, brace-expansion, undici) to meet minimum safe versions
• Using a temp-directory overlay approach to avoid npm's private package.json resolution issues
• Updating the workflow lock file accordingly

What's working well:

• Focused change targeting only the vulnerable dependencies
• Clear changeset documentation explaining the fix approach
• Proper labeling and assignment to maintainers
• Small, reviewable diff (10 lines total)

The PR is ready for review and merge. The WIP status is fine while awaiting final validation from maintainers.

Generated by ✅ Contribution Check · auto · 58.7 AIC · ⌖ 3.75 AIC · ⊞ 8.8K · ◷

[Copilot]

Pull request overview

Updates the safe-outputs Node container to remediate the bundled npm undici vulnerability.

Changes:

• Installs and overlays undici 6.27.0 or newer.
• Updates release notes.
• Normalizes a generated workflow step name.

Show a summary per file

File	Description
actions/setup/js/Dockerfile.safe-outputs-mcp	Patches npm’s bundled undici.
.changeset/patch-refresh-gh-aw-node.md	Documents the remediation.
.github/workflows/smoke-goose.lock.yml	Updates generated step capitalization.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.84.4