step-security · amanstep · Jan 15, 2026 · Jan 15, 2026 · Jan 15, 2026 · Jan 15, 2026
diff --git a/dist/index.js b/dist/index.js
diff --git a/dist/index.js.map b/dist/index.js.map
diff --git a/dist/licenses.txt b/dist/licenses.txt
@@ -726,7 +726,7 @@ ms
 MIT
 The MIT License (MIT)
 
-Copyright (c) 2016 Zeit, Inc.
+Copyright (c) 2020 Vercel, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

diff --git a/dist/sourcemap-register.js b/dist/sourcemap-register.js
diff --git a/osv-scanner.toml b/osv-scanner.toml
@@ -0,0 +1,7 @@
+[[IgnoredVulns]]
+id = "GHSA-2p57-rm9w-gvfp"
+reason = "ip is dev dependency only (node-gyp), not bundled in dist"
+
+[[IgnoredVulns]]
+id = "GHSA-g9mf-h72j-4rw9"
+reason = "undici fetch() not used; code uses HttpClient.getJson() with trusted endpoint only"
diff --git a/package.json b/package.json
@@ -23,7 +23,7 @@
   "packageManager": "yarn@3.6.3",
   "dependencies": {
     "@actions/core": "^1.11.1",
-    "@actions/http-client": "^2.2.3",
+    "@actions/http-client": "^3.0.1",
     "axios": "^1.13.2",
     "chalk": "^5.4.1"
   },