fix(deps): security batch 2026-10-07 (undici 6.28.1)

[devin-ai-integration]

Opened by fix-vulnerable-deps
Stacked on #88

Context

• Root pnpm-lock.yaml resolves undici 6.28.0, which has three advisories fixed in 6.28.1. It comes in through the @vercel/blob dev dependency and runs in tests and CI only; the published dist doesn't include it.
• The fix was blocked on main: resolutionMode: time-based caps transitive versions at the newest direct dependency's publish date (vitest 4.1.11, 2026-08-18), and undici 6.28.1 came out on 2026-09-04 (APPS-1644).
• chore(deps): clean-up batch 2026-10-06 (valibot, @upstash/redis) #88 bumps @upstash/redis to 1.39.0 (published 2026-09-21), which moves that cutoff past 6.28.1. So this PR sits on chore(deps): clean-up batch 2026-10-06 (valibot, @upstash/redis) #88.

Special things to note

• Merging this PR also merges chore(deps): clean-up batch 2026-10-06 (valibot, @upstash/redis) #88 under it.
• Override rung: the existing root undici override is raised from ^6.28.0 to ^6.28.1. The comment above it now names GHSA-rfgv-xxqx-mfg5. minimumReleaseAge and resolutionMode are unchanged.

Change outline

Fixes: undici 6.28.0 → 6.28.1 — GHSA-rfgv-xxqx-mfg5 / CVE-2026-19534 (HIGH), GHSA-3wwx-pv8p-q78v / CVE-2026-85024 (MODERATE), GHSA-r53p-7pc4-xj5r / CVE-2026-18540 (LOW)

Diff against #88: pnpm-workspace.yaml (one override line plus its comment) and pnpm-lock.yaml, where only undici moves. The playground lockfile is unchanged.

Evidence

• vet: pass. Integrity matches the registry tarball, same maintainers, repository and provenance as 6.28.0, published 33 days ago (gate is 7), no install scripts. The 6.28.0 → 6.28.1 source diff contains only the upstream fixes (keep-alive socket checks, retry Content-Range checks, WebSocket/EventSource handling).
• Rescan (OSV, both lockfiles): no undici advisory remains. The only remaining finding is source-map-js 1.2.1 (GHSA-68fv-2mgg-jv7q), tracked in APPS-1706; its fix doesn't pass the release-age gate yet.
• Local: biome check ., pnpm typecheck, playground install (frozen) and typecheck pass. pnpm test: 683 passed, 2 failed in test/internal/ndjson-map.memory.test.ts. That test spawns node --experimental-transform-types, which the local Node 26 no longer supports; the file is unchanged by this PR. CI runs Node 24. Forge tests weren't run locally (no solc); no Solidity changed.

Tracking: APPS-1644

Link to Devin session: https://app.devin.ai/sessions/095cf5ef42844594a467b0ca0f17cad3
Open in Devin Desktop: https://app.devin.ai/desktop/session/095cf5ef42844594a467b0ca0f17cad3?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[linear-code]

APPS-1644