Possible fix(deps): 3 vulnerable dependencies in package-lock.json

Came across something in `package-lock.json` around line 2363 that looked worth flagging.

CVE-2026-12151 is a HIGH severity vulnerability in undici (v6.17.0–6.26.x) where the WebSocket client does not enforce a limit on the number of message fragments. A malicious server can exploit this by streaming an unbounded sequence of small continuation frames that individually pass payload size checks but collectively cause unbounded memory allocation, leading to memory exhaustion and denial of service. No runtime workaround exists; immediate upgrade to v6.27.0+ is mandatory.

Something like this might fix it:

```diff
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
"dependencies": {
- "undici": "^6.24.1"
+ "undici": "^6.27.0"
},
---
# After applying the diff, regenerate the lockfile:
# npm install # OR yarn install # OR pnpm install
```

For reference: rule `CVE-2026-12151`. Rated high.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Inspect package.json and package-lock.json around the reported dependency entry near line 2363, then run the project's package-manager install command to regenerate the lockfile. Done means the undici dependency is upgraded to v6.27.0 or later and the lockfile reflects the updated dependency without introducing unrelated changes.

Written by the indexing model from the issue text.