[krdlab]

Resolves 22 of the 23 open Dependabot alerts: undici (20) and @fastify/busboy (2). The minimatch alert remains.

Changes

• Bump @actions/core 1.11.1 → 3.0.1. This drops the path through @actions/http-client 2.x that brought in undici 5.29.0 and @fastify/busboy 2.1.1. No undici 5.x release fixes these alerts.
• Bump @actions/glob 0.4.0 → 0.6.1, since 0.4.0 depends on @actions/core 1.x. 0.6.1 is the version @actions/cache already uses, and it keeps minimatch 3.1.5.
• Bump @actions/exec 1.1.1 → 3.0.0 to match the version @actions/cache and @actions/tool-cache already use.
• Update undici 6.25.0 → 6.29.1 in the lockfile (within ^6.23.0 of @actions/http-client 4.0.1).
• Rebuild dist/. Duplicate copies of core, undici and glob are gone, and dist/index.js drops from 5096 kB to 3124 kB (as reported by ncc).

The upgraded packages are ESM-only. The ncc build already handles that, since @actions/cache 6 and @actions/tool-cache 4 are ESM-only too. No source changes were needed.

In @actions/http-client, undici is only used for ProxyAgent in getAgentDispatcher(). Neither this action nor its dependencies call it.

Not addressed: minimatch (GHSA-g3hv-75wg-m249)

The only patched version is 11.0.1. The minimatch 11 changelog lists the removal of Minimatch#matchOne(), which @actions/glob still calls as of 0.7.0, so overriding minimatch to 11.x would be incompatible. minimatch 3.1.5 used here does not contain the vulnerable code (firstPhasePreProcess, reached only with optimizationLevel >= 2).

Verification

• All CI jobs pass, including the OS / Haxe build matrix and CodeQL.
• Ran the old and new bundles locally with the same inputs (Haxe 4.3.7 with cache-dependency-path). The GITHUB_PATH, GITHUB_ENV and GITHUB_STATE contents and the cache key were identical.
• On CI, every build job restored a haxelib cache saved by master before this change, so the cache keys stay the same across the CI matrix for the tested inputs.