[TheStreamCode]

What

Pin the two locked undici copies to patched versions via npm overrides (all dev-scope, transitive-only):

• node_modules/undici: 8.11.2 -> 8.12.2 (Dependabot first-patched for the 8.x advisories)
• node_modules/npm/node_modules/undici: 6.28.0 -> 6.29.0, by overriding the dev-transitive npm 12.2.0 -> 12.2.1 patch release. This copy ships bundled inside the npm tarball (inBundle in the lockfile), so an undici version selector cannot move it; 12.2.1 is the newest published npm and bundles undici 6.29.0.

Lock diff is confined to the npm entry, its bundled composition, and top-level undici (12 entries, patch/minor only, no unrelated churn).

Alerts closed (expected on Dependabot rescan after merge)

8.x line -> 8.12.2 (5):

• #44 (high, CVE-2026-109829, cache poisoning via cross-origin redirects)
• #43 (high, CVE-2026-109383, TLS validation bypass via dropped tls options)
• #41 (high, CVE-2026-87018, DoS via TLS 1.2 renegotiation)
• #39 (medium, CVE-2026-109932, WebSocket PONG-buffering DoS)
• #29 (high, CVE-2026-109869, DoS via excessive content-encodings)

6.x line -> 6.29.0 (1):

• chore(actions)(deps): bump actions/setup-node from 6.5.0 to 7.1.0 #15 (low, CVE-2026-18540, response splitting; fixed in >= 6.28.1)

Known remaining (blocked on an upstream npm release)

• #42, #40, #38, #35 need undici >= 6.29.1 on the 6.x line, but no published npm release bundles it yet (latest npm 12.2.1 bundles 6.29.0). The nested npm.undici: 6.29.1 override is kept so it applies automatically if npm ever stops bundling; revisit the npm pin when a release bundling undici >= 6.29.1 ships.

Dev-scope rationale

Both undici copies are "dev": true in package-lock.json and reachable only through the openclaw devDependency (via openai, @openclaw/proxyline, and npm/node-gyp). The published package has no runtime dependency on undici. The npm 12.2.0 -> 12.2.1 bump is a patch release of a dev-transitive tool whose only in-repo consumer is openclaw (exact pin).

Verification

• npm ci succeeds and reproduces 8.12.2 / 6.29.0
• npm run typecheck and npm run build green; dist/ unchanged after rebuild
• npm test: 82/82 passed (7 files)

Side note

The npm 12.2.1 bundle composition also moves bundled brace-expansion (5.0.12), ip-address (10.7.2), and postcss-selector-parser (7.1.6) past their alerted versions, so #18, #20, #12, #11, #36 may auto-close as well. No other copies of the alerted versions remain in the lock. Unrelated alerts (e.g. minimatch #46) are untouched.