fix(deps): bump undici to >=6.27.0 (CVE-2026-12151) (#5861)

integrations/openclaw/package.json

@@ -71,7 +71,8 @@
       "picomatch@<2.3.2": "^2.3.2",
       "@qdrant/js-client-rest": "^1.18.0",
       "uuid@<11.1.1": ">=11.1.1",
-      "esbuild": ">=0.28.1"
+      "esbuild": ">=0.28.1",
+      "undici@<6.27.0": ">=6.27.0 <8.0.0"
     }
   }
 }

integrations/openclaw/pnpm-lock.yaml

@@ -13,6 +13,7 @@ overrides:
   '@qdrant/js-client-rest': ^1.18.0
   uuid@<11.1.1: '>=11.1.1'
   esbuild: '>=0.28.1'
+  undici@<6.27.0: '>=6.27.0 <8.0.0'
 
 importers:
 
@@ -1996,9 +1997,9 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
-  undici@6.26.0:
-    resolution: {integrity: sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==}
-    engines: {node: '>=18.17'}
+  undici@7.28.0:
+    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+    engines: {node: '>=20.18.1'}
 
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
@@ -2509,7 +2510,7 @@ snapshots:
     dependencies:
       '@qdrant/openapi-typescript-fetch': 1.2.6
       typescript: 5.9.3
-      undici: 6.26.0
+      undici: 7.28.0
 
   '@qdrant/openapi-typescript-fetch@1.2.6': {}
 
@@ -4063,7 +4064,7 @@ snapshots:
 
   undici-types@6.21.0: {}
 
-  undici@6.26.0: {}
+  undici@7.28.0: {}
 
   util-deprecate@1.0.2: {}
 

integrations/openclaw/pnpm-workspace.yaml

@@ -21,3 +21,4 @@ overrides:
   "@qdrant/js-client-rest": "^1.18.0"
   "uuid@<11.1.1": ">=11.1.1"
   "esbuild": ">=0.28.1"
+  "undici@<6.27.0": ">=6.27.0 <8.0.0"