# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Fix Dependabot alerts #248 and #249 and open a PR.

## Goal (incl. success criteria)

- Resolve both undici advisories by bumping undici to a non-vulnerable version (>= 7.28.0).
- Alert #248 (high, GHSA-vmh5-mc38-953g): TLS cert validation bypass via dropped requestTls in SOCKS5 ProxyAgent (>= 7.23.0, < 7.28.0).
- Alert #249 (medium, GHSA-pr7r-676h-xcf6): cross-user info disclosure via shared cache whitespace bypass (>= 7.0.0, < 7.28.0).

## Constraints/Assumptions

- Stay on undici 7.x (latest 7.x is 7.28.0, which is the patched release). undici 8.x is a major bump, out of scope.

## Key decisions

- Bump catalog `undici` 7.24.4 -> 7.28.0 (pnpm-workspace.yaml).
- Update root override `undici@>=7.0.0 <7.24.0: 7.24.4` -> `undici@>=7.0.0 <7.28.0: 7.28.0` so any transitive copies in the full vulnerable range are forced to the patched version.

## State

- Changes applied; lockfile regenerated with `pnpm install --lockfile-only`. All undici resolutions now 7.28.0.

## Done

- Edited pnpm-workspace.yaml catalog, package.json override, pnpm-lock.yaml.

## Now

- Commit and open PR.

## Next

- Confirm Dependabot marks both alerts resolved after merge.

## Open questions (UNCONFIRMED if needed)

- None.

## Working set (files/ids/commands)

- pnpm-workspace.yaml, package.json, pnpm-lock.yaml
- `pnpm install --lockfile-only`
- Alerts: dependabot/248, dependabot/249
