@vercel/blob: raise undici floor to ^6.27.0 — dependency range overlaps CVE-2026-12151 (GHSA-vxpw-j846-p89q)

[jan10]

@vercel/blob (latest, 2.6.1) declares "undici": "^6.23.0". That range overlaps the version range affected by GHSA-vxpw-j846-p89q / CVE-2026-12151 (undici WebSocket client DoS via fragment-count bypass), so every app depending on @vercel/blob is flagged by npm/pnpm audit, Dependabot and any consumer whose lockfile resolved undici before 6.27.0 shipped (2026-06-15) is pinned to a vulnerable version until they intervene manually.

Please raise the floor to "undici": "^6.27.0" (the advisory's patched release).

Reproduction

$ npm view @vercel/blob@2.6.1 dependencies.undici
^6.23.0

# In a project that installed @vercel/blob before 2026-06-15:
$ npm ls undici
└─┬ @vercel/blob@2.5.0
  └── undici@6.25.0            # affected by GHSA-vxpw-j846-p89q