[GSTJ]

Summary

Patched undici, node-forge and ip-address in development tooling, including the open undici crash advisory.

Details

• Keeps the fixes scoped to vulnerable versions and exempts the exact patched releases from the release-age gate.
• Adds a local malformed-response regression check for undici. Fetch must reject without terminating Node.
• The registry audit still reports basic-ftp, Zod, minimatch and glob findings requiring major upgrades. deepmerge lists a patched 4.3.2 that npm does not publish yet. Those remain open, with no added audit exclusions.
• Local test output is shown below. This is a screenshot of the captured transcript, not an app runtime capture. Full log and file hashes.

Testing steps

Run these from the source directory with Node 24 and pnpm 11.17.0:

pnpm install --frozen-lockfile
pnpm run lint
pnpm run format
pnpm run typecheck
pnpm run test --runInBand
pnpm run build
pnpm run changelog:check
npm pack --dry-run
pnpm audit --json

The project checks should pass, and the malformed-response check should report a handled rejection. The audit still reports the remaining packages listed above.

Small security cleanup, ready for a look.