[RGood]

Summary

Fixes eight open undici alerts (M12) with a lockfile refresh. No resolutions override and no package.json change.

Alerts	Severity	Advisory
#131, #153, #154, #155	high	Unhandled error DoS, TLS renegotiation DoS, TLS options dropped (cert-validation bypass), cache poisoning / cross-user disclosure
#130, #148, #151, #152	medium	EventSource memory DoS, SRI bypass, decompression exception DoS, WebSocket DoS

All are for undici >= 8.0.0, < 8.12.2 (fixed in 8.12.2).

Change

yarn up -R undici in yarn.lock only (6 additions, 6 deletions):

• undici 8.11.2 → 8.12.4 (pulled in by node-gyp 13.0.2 via ^8.4.1; that range already allowed the fix, the lockfile was just stale).
• undici 7.30.1 → 7.30.2 (pulled in by cheerio via ^7.19.0). This copy is not affected by the alerts; it moved because Yarn's recursive update cannot target a single range. It is a patch bump within its range.

undici 8.12.4 requires Node >= 22.19; this repo uses Node 24.18.0 (.nvmrc).

Verification (local, with the repo's pinned Yarn 4.18.0)

• yarn install --immutable passes.
• Full yarn build succeeds with the same warnings as main (5 HTML minifier diagnostics, 2 broken anchors) and the same number of output files (11,610).

Testing

CI build should pass. After merge, confirm the Pages deploy succeeds and that the eight alerts close.

Not included

Remaining open alerts (brace-expansion, qs, serialize-javascript, uuid, minimatch, glob, deepmerge) are handled separately.

Part of M12 (fix dependency alerts).