Possible fix(deps): 3 vulnerable dependencies in package-lock.json

I think there may be a problem in `actions/ops-build-reporter/package-lock.json` around line 3601.

undici 5.29.0, pinned in actions/ops-build-reporter/package-lock.json (lines 3601-3612), is flagged for CVE-2026-12151 (HIGH). The undici WebSocket client enforces maxPayloadSize only against the cumulative byte count of a message's fragments, with no cap on the number of fragments. A malicious or compromised WebSocket server can exploit this by streaming an endless series of small or empty continuation frames - each individually passing per-frame and cumulative-size validation - causing unbounded memory growth until the client process is OOM-killed, i.e. a remote denial of service. Exploitation requires the application to initiate a WebSocket connection (new WebSocket(...) or WebSocketStream) to an attacker-controlled or compromised endpoint. Risk level: HIGH per the scanner. In this repo the vulnerable version ships inside the ops-build-reporter GitHub Action, so the blast radius is mostly CI-bound (crashed jobs/runners, pipeline disruption) rather than production data compromise; however, the advisory offers no workaround and the fix is a low-risk dependency upgrade, so it should be patched promptly. Caveat: the advisory text says affected releases begin at 6.17.0 while 5.29.0 was flagged - upgrade anyway, since it clears the scanner finding and moves the action off the legacy 5.x line. Fixed versions: 6.27.0 (6.x line), 7.28.0 (7.x), 8.5.0 (8.x).

Something like this might fix it:

````diff
Upgrade undici to a patched release (>= 6.27.0 on the 6.x line; alternatively >= 7.28.0 or >= 8.5.0) and regenerate the lockfile. Do not hand-edit package-lock.json - let npm rewrite the node_modules/undici entry (lines 3601-3612) with correct resolved/integrity metadata.

If undici is a direct dependency of the action:

```diff
--- a/actions/ops-build-reporter/package.json
+++ b/actions/ops-build-reporter/package.json
@@
"dependencies": {
- "undici": "^5.29.0"
+ "undici": "^6.27.0"
}
```

Then run:

```bash
cd actions/ops-build-reporter
npm install undici@^6.27.0
npm ls undici # confirm 6.27.0+ resolves everywhere
```

If undici is only a transitive dependency, force the patched version via npm overrides:

```diff
--- a/actions/ops-build-reporter/package.json
+++ b/actions/ops-build-reporter/package.json
@@
{
"name": "ops-build-reporter",
"version": "1.0.0",
+ "overrides": {
+ "undici": "^6.27.0"
+ },
"dependencies": { ... }
}
```

Then run `npm install` to regenerate package-lock.json. After the bump, re-run the scanner to confirm CVE-2026-12151 is cleared, and as defense-in-depth verify the action never opens WebSocket connections to attacker-influenced/untrusted endpoints.
````

For reference: rule `CVE-2026-12151`. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Start in actions/ops-build-reporter/package.json and actions/ops-build-reporter/package-lock.json, around the undici entry at lines 3601-3612; run npm ls undici to determine whether it is direct or transitive. Regenerate the lockfile with a patched undici version, then verify npm resolves the patched release and rerun the scanner to confirm CVE-2026-12151 is cleared.

Written by the indexing model from the issue text.