Hello there 👋,

Today in the Node.js security meeting we discussed that the undici project score had dropped due to a change in the workflows. This seems to be related to the following commit.

Full report here

1. nightly.yml and test.yml seems to lack global permissions

permissions:
  contents: read

2. In nodejs.yml we have warnings to reviews the following permission.

Github Action Merge Dependabot require pull-requests and contents (not sure if actions is required). These warnings are perhaps to be ignored.

@nodejs/security-wg