Refresh the locked Undici development dependency to resolve current advisories #334

Goal

Restore a clean dependency audit for the demo-console development/test toolchain.

Background

Engineering review of d36c00bd6661e3169b32b048f94ac56f52c13d31 on 2026-10-03. Original developer checkouts were preserved.

On 2026-10-03, a clean npm ci from the committed lockfile installed jsdom@28.1.0 -> undici@7.29.0. npm audit --json returned exit 1, one high-severity vulnerable package and ten advisory entries. The producer advisories identify fixed 7.x version 7.29.1, including GHSA-w293-vg96-wgc3 and GHSA-rfgv-xxqx-mfg5.

This is a transitive development dependency; the review has NOT demonstrated an exploitable path in the shipped browser application. CI already runs npm run audit in required validation lanes. The latest historical green run is not proof that the current lockfile passes today's advisory database. No audit fix or lockfile change was applied during review.

Scope

Apply the smallest compatible dependency/lockfile update that excludes the affected Undici release and retain the audit gate.

Acceptance Criteria

• A fresh npm ci resolves a supported patched Undici version and npm audit --audit-level=moderate passes, or any unrelated new finding is explicitly triaged.
• React behavioral/accessibility tests and production build pass on the pinned Node/npm toolchain.
• Record that the dependency is development-only and do not imply demonstrated production exploitability.
• Keep the committed lockfile reproducible; do not suppress the advisory or broadly relax dependency constraints.

Validation

Use Node 22.22.0/npm 10.9.4, npm ci, npm ls undici, npm run validate, npm run build and npm run audit from services/demo-console. Run the repository validator.

Evidence

• services/demo-console/package-lock.json
• services/demo-console/package.json
• .github/workflows/tests.yml

Non-Goals

No unrelated architecture rewrite, release publication, or automatic live repository-policy change as part of review intake. Implementation follows the issue-backed worktree and reviewed PR workflow.

Project Fields

• Status: Ready
• Priority: P2
• Area: Security
• Initiative: Adoption Polish
• Size: S
• Issue type: Bug
• Assignee: codeforester
• Scheduling: milestone and target date intentionally uncommitted; this review does not make a delivery-date promise.

Agent Assignment

Assignee: @codeforester. The reproduced behavior and acceptance criteria define the implementation boundary.