v1.6.2

Node.js

Security patch for the shipped dependency. The undici floor moves from ^6.28.0 to ^6.29.0, past three high-severity advisories that affect 6.28.0 and earlier:

• GHSA-3wwx-pv8p-q78v: denial of service via unhandled error in WebSocket permessage-deflate decompression
• GHSA-r53p-7pc4-xj5r: downstream response splitting via retry interceptor
• GHSA-rfgv-xxqx-mfg5: denial of service via unrequested WebSocket subprotocol

Fresh installs of 1.6.1 already resolved to a patched undici through the caret range. This release makes the published manifest itself clean under npm audit, so a project pinned to an older lockfile gets the bump through its own dependency updates. Node 18 is still supported.

Dev-only transitive packages (js-yaml, brace-expansion, serialize-javascript) were also refreshed; those do not reach installs of the package.

Python and Go

Unchanged in this release apart from the version, which the three ports keep in step.