undici prior 5.28.5 has vulnerability (CWE-330, CVE-2025-22150, SNYK-JS-UNDICI-8641354).

@actions/http-client version 2.2.3 upgraded undici to v5.28.5 (ref #1957), which cleaned the vulnerability.

@actions/core still uses @actions/http-client version 2.1.0, thus is (transitively) vulnerable.

Please upgrade @actions/http-client to 2.2.3 in @actions/core.