fix(deps): override undici >=7.28.0 to close GHSA-vmh5-mc38-953g

[os-zhuang]

What

Close HIGH-severity advisory GHSA-vmh5-mc38-953g (undici TLS certificate validation bypass via dropped requestTls in the SOCKS5 ProxyAgent) that is failing the Validate Package Dependencies CI gate (pnpm audit --audit-level=high).

The vulnerable undici@7.27.2 is pulled in transitively through the VS Code extension's publish tooling only:

packages/vscode-objectstack > @vscode/vsce > cheerio > undici

This is repo-wide and pre-existing (it red-flags the dependency-validation gate for everyone, not just one PR).

How

Add a single transitive pin to pnpm-workspace.yaml overrides — the repo's canonical location (pnpm v10 silently ignores pnpm.overrides in package.json, as documented in that file alongside the existing esbuild / form-data / tar / minimatch pins):

'undici@>=7.23.0 <7.28.0': '^7.28.0'

• Advisory range is >=7.23.0 <7.28.0, patched >=7.28.0.
• cheerio@1.2.0 declares undici: ^7.19.0, so the override targets only the vulnerable range and forces ^7.28.0, which resolves to 7.28.0 — the patched line within the 7.x major cheerio supports. A bare >=7.28.0 would resolve to undici 8.5.0, an out-of-range major bump for cheerio; this stays minimal and in-range.

package.json is intentionally untouched. Change is just the override + lockfile.

Verification

• pnpm audit --audit-level=high → 0 high (exit 0), gate passes. (Before: 1 high = undici.)
• All pre-existing security pins preserved in the lockfile (esbuild, minimatch, tar, form-data).
• turbo run build --filter=objectstack-vscode → succeeds.
• Lockfile diff: only undici 7.27.2 → 7.28.0 + the override line.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jun 19, 2026 9:01am