fix: security vulnerability

[manisha1997]

Fixes

undici 5.25.4 has vulnerability https://security.snyk.io/package/npm/undici/5.28.4
This will do a forced upgradation to 5.28.5 version.

Checklist

• I acknowledge that all my contributions will be made under the project's license
• I have made a material change to the repo (functionality, testing, spelling, grammar)
• I have read the Contribution Guidelines and my PR follows them
• I have titled the PR appropriately
• I have updated my branch with the main branch
• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary documentation about the functionality in the appropriate .md file
• I have added inline documentation to the code I modified

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.

[tiwarishubham635]

Do we need to put 5.28.5 over here?

[manisha1997]

yes
This forces npm install to install the version 5.25.5 for undici dependency of http-client of actions/core

[tiwarishubham635]

Also, can we instead use version 5.29.0 which has no direct vulnerabilities?

[tiwarishubham635]

yes This forces npm install to install the version 5.25.5 for undici dependency of http-client of actions/core

Should it be 5.25.5 or 5.28.5? Coz I can see that this vulnerability exists for versions < 5.28.5

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud