From d60ec41b95729997f7465af8299ef74587712d87 Mon Sep 17 00:00:00 2001
From: nthmost-orkes <naomi.most@orkes.io>
Date: Mon, 19 Oct 2026 23:01:31 -0700
Subject: [PATCH] Upgrade undici to clear HIGH CVEs

undici ^7.16.0 -> ^7.29.1 (resolves to 7.30.1), clearing 6 high-severity
CVEs: CVE-2026-12151, CVE-2026-13697, CVE-2026-1526, CVE-2026-1528,
CVE-2026-19534, CVE-2026-2229. Build + verify:dist pass.
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fa493334..cc4dcb7f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -37,7 +37,7 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "undici": "^7.16.0"
+        "undici": "^7.29.1"
       },
       "peerDependencies": {
         "@langchain/core": ">=0.2.0",
@@ -8188,9 +8188,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.16.0.tgz",
-      "integrity": "sha512-QEg3HPMll0o3t2ourKwOeUAZ159Kn9mx5pnzHRQO8+Wixmh88YdZRiIwat0iNzNNXn0yoEtXJqFpyW7eM8BV7g==",
+      "version": "7.30.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
+      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
       "license": "MIT",
       "optional": true,
       "engines": {
diff --git a/package.json b/package.json
index b628f181..33b8e3d3 100644
--- a/package.json
+++ b/package.json
@@ -135,7 +135,7 @@
     }
   },
   "optionalDependencies": {
-    "undici": "^7.16.0"
+    "undici": "^7.29.1"
   },
   "jest-junit": {
     "outputDirectory": "reports",