build(deps): patch undici and development tooling advisories

pnpm-workspace.yaml

@@ -41,6 +41,10 @@ minimumReleaseAgeExclude:
   - release-it@21.0.0
   - sax@1.6.1
   - undici@7.29.0
+  # Security fix for GHSA-xjj6-f33q-929c, bypass the release-age window.
+  - undici@7.30.1
+  - node-forge@1.4.1
+  - ip-address@10.7.4
   # magic-* is first-party tooling and can update immediately.
   - "magic-*"
   # Let the security fix through the global release-age gate.
@@ -72,8 +76,10 @@ overrides:
   js-yaml@>=4.0.0 <4.3.2: ^4.3.2
   # GHSA NAT64 classifier gap (SSRF). Dev-only via release-it > proxy-agent >
   # socks, bumped per Dependabot alert #62.
-  ip-address@>=10.2.0 <10.5.1: ^10.5.1
-  # Dev-only (expo CLI, eslint, jest), bumped per Dependabot alerts #64-67, #70, #71.
-  undici@>=7.0.0 <7.29.1: ^7.29.1
+  ip-address@>=10.2.0 <10.7.4: 10.7.4
+  # Registry audit: patch certificate parsing advisories.
+  node-forge@<1.4.1: 1.4.1
+  # GHSA-xjj6-f33q-929c: malformed responses can crash release-it.
+  undici@>=7.0.0 <7.30.1: 7.30.1
 patchedDependencies:
   image-size@1.2.1: patches/image-size@1.2.1.patch

tools/dependency-security-check.mjs

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { readFileSync, readdirSync } from "node:fs";
 import { createRequire } from "node:module";
+import { createServer } from "node:net";
 import { dirname, join } from "node:path";
 
 const rootRequire = createRequire(import.meta.url);
@@ -233,6 +234,48 @@ for (const vulnerablePackage of [
   );
 }
 
+for (const [name, version] of [
+  ["node-forge", "1.4.1"],
+  ["ip-address", "10.7.4"],
+]) {
+  assert.equal(versionAt(packageInStore(name, version)), version);
+}
+
+// Exercise the same undici instance release-it resolves. An early socket close
+// after excessive content codings must reject fetch without crashing Node.
+const undiciPackage = packageInStore("undici", "7.30.1");
+const { fetch } = requireFrom(undiciPackage)("undici");
+assert.equal(versionAt(undiciPackage), "7.30.1");
+const server = createServer((socket) => {
+  socket.once("data", () => {
+    socket.end(
+      "HTTP/1.1 200 OK\r\nContent-Encoding: gzip, gzip, gzip, gzip, gzip, gzip\r\nContent-Length: 100\r\nConnection: close\r\n\r\n",
+    );
+  });
+});
+await new Promise((resolve) => {
+  server.listen(0, "127.0.0.1", resolve);
+});
+try {
+  await assert.rejects(
+    fetch(`http://127.0.0.1:${server.address().port}`, {
+      signal: AbortSignal.timeout(3_000),
+    }),
+    (error) => /too many content-encodings/.test(error.cause?.message),
+  );
+  // Give an orphaned stream error time to surface after fetch rejects.
+  await new Promise((resolve) => {
+    setTimeout(resolve, 100);
+  });
+} finally {
+  await new Promise((resolve) => {
+    server.close(resolve);
+  });
+}
+console.log(
+  "undici 7.30.1 rejected excessive content encodings without crashing.",
+);
+
 console.log(
   "Dependency security checks passed for @xmldom/xmldom, js-yaml, nanoid and image-size.",
 );