[codeforester]

Summary

Refresh the locked transitive undici dependency pulled by jsdom from 7.29.0 to patched 7.29.1. This restores the required demo-console audit gate without suppressing advisories or changing production dependencies.

Issue

Fixes #334

Validation

• Fresh Node 22.22.0/npm 10.9.4 npm ci --ignore-scripts (139 packages; 0 vulnerabilities)
• npm ls undici --all shows jsdom@28.1.0 -> undici@7.29.1
• npm run validate (6 unit tests passed)
• npm run build passed
• npm run audit passed with 0 vulnerabilities
• Registry tarball SHA-512 matches the committed lockfile integrity
• git diff --check

Notes

This is the first, independent train item because the existing required Ubuntu audit gate was failing on the unpatched transitive dependency. The dependency is development-only; this change does not claim a demonstrated shipped-browser exploit. The full repository validator was also attempted locally; its first run used the machine Node 14 toolchain and its Node 22 rerun was blocked by the host Gradle native-platform library, while the affected frontend gates passed under the CI-matching Node toolchain.

Current audit follow-up

The current npm advisory database also flags transitive source-map-js@1.2.1 (GHSA-68fv-2mgg-jv7q). The same lockfile change adds a narrow npm override to ^1.2.2; npm ci, npm run validate, npm run build, and npm run audit pass with zero vulnerabilities.

[codeforester]

Reviewed head dd93e85 against #334. No findings. This is a lockfile-only bump of the transitive dev dependency undici 7.29.0 → 7.29.1 (via jsdom), with integrity updated, which clears GHSA-3wwx-pv8p-q78v without suppressing the audit. CI is green (7/7). Ready to merge, and merge it first: #335, #336 and #337 all fail validate/validate-ubuntu on exactly this advisory, so they'll go green once this lands and they're refreshed.