build(deps-dev): bump undici past security advisory

[Gustavo-Cauzzi]

Fixes the failing Dependabot security update for undici (run 30823213256).

Why Dependabot couldn't do this itself

The job failed with:

| security_update_not_possible | { "dependency-name": "undici",
|                              |   "latest-resolvable-version": "6.25.0",
|                              |   "lowest-non-vulnerable-version": "6.27.0",
|                              |   "conflicting-dependencies": [] }

undici isn't a direct dependency — there are three transitive copies, all under semantic-release. Two of them were freely bumpable, but the third lives at node_modules/npm/node_modules/undici with inBundle: true, i.e. vendored inside the npm@11.14.1 tarball. Dependabot can't rewrite a bundled dependency in place; the only way to move it is to bump npm itself, which was out of scope for a job pinned to dependencies: ["undici"] with update-subdependencies: false and allowed-updates: direct. So it had no path forward and errored instead of opening a PR.

What this does

A lockfile refresh (npm update undici npm --package-lock-only) moves all three copies past the advisory:

Path	Before	After
undici	7.24.4	7.29.0
@actions/http-client/…/undici	6.24.1	6.28.0
npm/node_modules/undici (bundled)	6.25.0	6.27.0 (via npm 11.14.1 → 11.19.0)

All clear the advisory ranges < 6.27.0 and >= 7.0.0 < 7.28.0.

No package.json change is required — the existing "npm": ">=11.14.1 <12.0.0" override already permits 11.19.0.

Scope and risk

• Lockfile only. 30 package entries changed, all inside the npm bundled tree plus the two standalone undici copies. No production dependencies touched.
• Dev-only. All three copies are dev: true; undici never ships in the published browser bundle, so real-world exposure was nil — this was CI noise rather than a shipped vulnerability.
• Commit is typed build(deps-dev): rather than fix: so semantic-release doesn't cut a release for a dev-only lockfile change.

Verification

• npm install — clean, no lockfile drift
• npm run build (tsc && esbuild) — passes, static/cdn.js 5.3kb
• Asserted programmatically that all three resolved undici versions fall outside every advisory range in the job definition

🤖 Generated with Claude Code