fix(blob): raise undici floor to ^6.27.0 to exclude CVE-2026-12151

[Diwak4r]

Summary

Raises the undici dependency floor for @vercel/blob from ^6.23.0 to ^6.27.0.

The previous range (^6.23.0) still resolves versions affected by CVE-2026-12151 (GHSA-vxpw-j846-p89q), a request-smuggling vulnerability in undici. Pinning the floor to ^6.27.0 guarantees any install of @vercel/blob pulls a patched undici, without forcing a breaking major upgrade.

Changes

• packages/blob/package.json: "undici": "^6.23.0" → "^6.27.0"
• pnpm-lock.yaml: synced via pnpm install --lockfile-only — now resolves undici@6.28.0 (undici-only diff)

Tests

All three test environments pass on undici@6.28.0:

• test:node — 6 suites, 172 tests, 20 snapshots ✅
• test:edge — 1 suite, 1 test, 2 snapshots ✅
• test:browser — 3 suites, 19 tests, 3 snapshots ✅

Fixes #1090

[vercel]

@Normanyadav is attempting to deploy a commit to the Curated Tests - Permanent E2E Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1400b0f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​undici@​6.28.0

View full report

[Diwak4r]

Closing this to clear out a backlog I let build up rather than leave it sitting in your queue. It was never picked up and at this age it isn't going to be. If it's still wanted, say so and I'll reopen it against current main.