From 4d4e2fb51dc2fdc2dd37414efd5cc80e03a1fa4f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 4 Aug 2026 07:09:39 +0000
Subject: [PATCH 1/3] Initial plan


From 6fac8d7bed5789b542fdce96585c715dfd579b3b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 4 Aug 2026 07:14:28 +0000
Subject: [PATCH 2/3] Plan container dependency remediation

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/smoke-goose.lock.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/smoke-goose.lock.yml b/.github/workflows/smoke-goose.lock.yml
index 7b39db195bc..292885a3811 100644
--- a/.github/workflows/smoke-goose.lock.yml
+++ b/.github/workflows/smoke-goose.lock.yml
@@ -1244,7 +1244,7 @@ jobs:
           mkdir -p /tmp/gh-aw/
           find "/tmp/gh-aw/" -type f -print
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
-      - name: Download safe outputs items manifest
+      - name: Download Safe Outputs Items Manifest
         id: download-safe-outputs-manifest
         if: always()
         continue-on-error: true

From 2089ee6161a842148a921432c30168e6cc273774 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 4 Aug 2026 07:25:34 +0000
Subject: [PATCH 3/3] Patch bundled undici in gh-aw-node

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .changeset/patch-refresh-gh-aw-node.md       | 2 +-
 actions/setup/js/Dockerfile.safe-outputs-mcp | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.changeset/patch-refresh-gh-aw-node.md b/.changeset/patch-refresh-gh-aw-node.md
index 60eda4c5a20..513724acc2d 100644
--- a/.changeset/patch-refresh-gh-aw-node.md
+++ b/.changeset/patch-refresh-gh-aw-node.md
@@ -2,4 +2,4 @@
 "gh-aw": patch
 ---
 
-Fix broken brace-expansion patch in `gh-aw-node` Dockerfile (GHSA-mh99-v99m-4gvg): the previous `npm install --prefix "$(npm root -g)/npm"` approach failed silently because it reads npm's own private `package.json` (which references `@npmcli/docs`, a private package not on the public registry). Replace it with a temp-directory overlay: install brace-expansion ≥5.0.8 and tar ≥7.5.22 into a fresh prefix with no package.json, then copy the patched modules into npm's bundled `node_modules`. Also add a push trigger to `publish-safe-outputs-node.yml` on `main` for the Dockerfile path so the image rebuilds automatically on merge.
+Fix broken brace-expansion patch in `gh-aw-node` Dockerfile (GHSA-mh99-v99m-4gvg): the previous `npm install --prefix "$(npm root -g)/npm"` approach failed silently because it reads npm's own private `package.json` (which references `@npmcli/docs`, a private package not on the public registry). Replace it with a temp-directory overlay: install brace-expansion ≥5.0.8, tar ≥7.5.22, and undici ≥6.27.0 into a fresh prefix with no package.json, then copy the patched modules into npm's bundled `node_modules`. Also add a push trigger to `publish-safe-outputs-node.yml` on `main` for the Dockerfile path so the image rebuilds automatically on merge.
diff --git a/actions/setup/js/Dockerfile.safe-outputs-mcp b/actions/setup/js/Dockerfile.safe-outputs-mcp
index 5818e8b937e..ee098b8cbdb 100644
--- a/actions/setup/js/Dockerfile.safe-outputs-mcp
+++ b/actions/setup/js/Dockerfile.safe-outputs-mcp
@@ -12,16 +12,18 @@ ARG NPM_VERSION=11.19.0
 # Intentional: upgrade all packages to pick up security fixes; downstream digest pins the result.
 # After upgrading npm, patch its bundled dependencies to meet minimum safe versions.
 # Install into a temp prefix (avoids npm's own private package.json) then overlay into npm's
-# bundled node_modules: brace-expansion >= 5.0.8 (GHSA-mh99-v99m-4gvg), tar >= 7.5.22.
+# bundled node_modules: brace-expansion >= 5.0.8 (GHSA-mh99-v99m-4gvg), tar >= 7.5.22,
+# and undici >= 6.27.0 (GHSA-vxpw-j846-p89q).
 RUN apk upgrade --no-cache \
     && apk add --no-cache git \
     && apk info -v | sort \
     && npm install --global "npm@${NPM_VERSION}" \
     && tmpdir=$(mktemp -d) \
-    && npm --prefix "$tmpdir" install --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \
+    && npm --prefix "$tmpdir" install --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" "undici@^6.27.0" \
     && npm_modules="$(npm root -g)/npm/node_modules" \
     && cp -rf "$tmpdir/node_modules/brace-expansion/." "$npm_modules/brace-expansion/" \
     && cp -rf "$tmpdir/node_modules/tar/." "$npm_modules/tar/" \
+    && cp -rf "$tmpdir/node_modules/undici/." "$npm_modules/undici/" \
     && rm -rf "$tmpdir" \
     && npm cache clean --force