fix(treeshake-server): bump undici to 7.28.0 for CVE-2026-12151

[ScriptedAlchemy]

Description

Bumps the last remaining outdated undici in the workspace — @module-federation/treeshake-server was pinned to 6.23.0 — to 7.28.0, the version the issue proposes and the version already used by the workspace root and @module-federation/dts-plugin since #4835. The lockfile change is surgical: only the undici specifier/resolution entries changed. A patch changeset for @module-federation/treeshake-server is included.

undici is not imported anywhere in treeshake-server source (it is only declared as a dependency), so no code changes are required; build and tests confirm no behavioral impact.

Note: the open Dependabot PR #4838 predates #4835 and would now downgrade the root and dts-plugin undici from 7.28.0 to 6.27.0, so it should be closed in favor of this PR.

Related Issue

Closes #4831

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have updated the documentation.

Validation

• pnpm install --frozen-lockfile --lockfile-only passes with the updated lockfile
• pnpm exec turbo run build --filter=@module-federation/treeshake-server — success
• pnpm exec turbo run test --filter=@module-federation/treeshake-server — 13 files, 28 tests passed
• pnpm exec prettier --check on changed files — clean

[netlify]

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	16f0c7b
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a45ef699b1ed200089af084
😎 Deploy Preview	https://deploy-preview-4863--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[changeset-bot]

🦋 Changeset detected

Latest commit: 16f0c7b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 47 packages

Name	Type
@module-federation/treeshake-server	Patch
@module-federation/treeshake-frontend	Patch
@module-federation/runtime	Patch
@module-federation/enhanced	Patch
@module-federation/rspack	Patch
@module-federation/webpack-bundler-runtime	Patch
@module-federation/sdk	Patch
@module-federation/runtime-tools	Patch
@module-federation/managers	Patch
@module-federation/manifest	Patch
@module-federation/dts-plugin	Patch
@module-federation/third-party-dts-extractor	Patch
@module-federation/devtools	Patch
@module-federation/bridge-react	Patch
@module-federation/bridge-vue3	Patch
@module-federation/bridge-shared	Patch
@module-federation/bridge-react-webpack-plugin	Patch
@module-federation/modern-js	Patch
@module-federation/modern-js-v3	Patch
@module-federation/retry-plugin	Patch
@module-federation/rsbuild-plugin	Patch
@module-federation/error-codes	Patch
@module-federation/inject-external-runtime-core-plugin	Patch
@module-federation/runtime-core	Patch
create-module-federation	Patch
@module-federation/cli	Patch
@module-federation/rspress-plugin	Patch
@module-federation/metro	Patch
@module-federation/metro-plugin-rnef	Patch
@module-federation/metro-plugin-rock	Patch
@module-federation/metro-plugin-rnc-cli	Patch
@module-federation/esbuild	Patch
@module-federation/nextjs-mf	Patch
@module-federation/node	Patch
@module-federation/observability-plugin	Patch
@module-federation/playground	Patch
website-new	Patch
@module-federation/storybook-addon	Patch
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
@module-federation/utilities	Patch
remote5	Patch
remote6	Patch
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
node-dynamic-remote-new-version	Patch
node-dynamic-remote	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@16f0c7b

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@16f0c7b

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@16f0c7b

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@16f0c7b

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@16f0c7b

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@16f0c7b

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@16f0c7b

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@16f0c7b

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@16f0c7b

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@16f0c7b

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@16f0c7b

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@16f0c7b

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@16f0c7b

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@16f0c7b

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@16f0c7b

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@16f0c7b

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@16f0c7b

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@16f0c7b

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@16f0c7b

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@16f0c7b

@module-federation/playground

pnpm add https://pkg.pr.new/@module-federation/playground@16f0c7b

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@16f0c7b

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@16f0c7b

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@16f0c7b

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@16f0c7b

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@16f0c7b

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@16f0c7b

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@16f0c7b

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@16f0c7b

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@16f0c7b

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@16f0c7b

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@16f0c7b

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@16f0c7b

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@16f0c7b

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@16f0c7b

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@16f0c7b

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@16f0c7b

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@16f0c7b

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@16f0c7b

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@16f0c7b

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@16f0c7b

commit: 16f0c7b