chore(deps): update dependency @vercel/ncc to v0.44.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vercel/ncc	0.38.4 → 0.44.1

---

Release Notes

vercel/ncc (@​vercel/ncc)

v0.44.1

Compare Source

Bug Fixes

• preserve runtime createRequire in ESM builds (#​1334) (8f0aefd), closes #​1312

v0.44.0

Compare Source

Features

• read permissions pr.yml (#​1323) (5ea625e)

v0.43.0

Compare Source

Changes

• BREAKING CHANGE: add Node 24 and 26 support, remove 20 (#​1318) (#​1305)
• switch npm releases to trusted publishing (OIDC) (#​1325) (#​1327) (#​1328) (#​1329) (#​1330) (#​1331) (#​1332)
• switch package management to pnpm (#​1321)
• fix predictable global cache directory in /tmp enables symlink/hijack risks (#​1314)
• reorder extension resolution to prioritise TypeScript over JSON (#​1315)
• support TypeScript 6 transpile builds (#​1316)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

JS Dependency Audit

0 added · 0 removed · 19 total (0 vs base)

Projects audited

• . (manager: yarn-classic)
• ./dist (manager: unknown) — skipped on PR head: no recognized lockfile

No change in vulnerabilities compared to the base branch.

Full current vulnerability list (19)

• 🟠 high brace-expansion (>=3.0.0 <5.0.7) — brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups advisory
• 🟠 high brace-expansion (>=4.0.0 <5.0.8) — brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash advisory
• 🟠 high brace-expansion (>=4.0.0 <5.0.9) — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation advisory
• 🟠 high flatted (<3.4.0) — flatted vulnerable to unbounded recursion DoS in parse() revive phase advisory
• 🟠 high flatted (<=3.4.1) — Prototype Pollution via parse() in NodeJS flatted advisory
• 🟠 high undici (>=6.0.0 <6.24.0) — Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client advisory
• 🟠 high undici (<6.24.0) — Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression advisory
• 🟠 high undici (<6.24.0) — Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation advisory
• 🟠 high undici (<6.27.0) — undici WebSocket client vulnerable to denial of service via fragment count bypass advisory
• 🟡 moderate brace-expansion (>=4.0.0 <5.0.5) — brace-expansion: Zero-step sequence causes process hang and memory exhaustion advisory
• 🟡 moderate brace-expansion (>=5.0.0 <5.0.6) — brace-expansion: Large numeric range defeats documented max DoS protection advisory
• 🟡 moderate undici (<6.24.0) — Undici has an HTTP Request/Response Smuggling issue advisory
• 🟡 moderate undici (<6.24.0) — Undici has CRLF Injection in undici via upgrade option advisory
• 🟡 moderate undici (<6.27.0) — undici vulnerable to HTTP header injection via Set-Cookie percent-decoding advisory
• 🟡 moderate undici (<6.28.0) — undici vulnerable to downstream response desynchronization via retry interceptor advisory
• 🟡 moderate undici (<6.28.0) — undici vulnerable to CRLF Injection via blob-like body 'type' property advisory
• 🟡 moderate undici (<6.28.0) — undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields advisory
• 🔵 low undici (<6.27.0) — undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching advisory
• 🔵 low undici (<6.27.0) — undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse advisory