fix(deps): update transient dependency to undici 6.27.0

[MikeMcC399]

Situation

npm audit reports several vulnerabilities in undici

• GHSA-p88m-4jfj-68fv
• GHSA-vxpw-j846-p89q
• GHSA-35p6-xmwp-9g52
• GHSA-g8m3-5g58-fq7m

$ npm audit
# npm audit report

undici  <=6.26.0
Severity: high
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding - https://github.com/advisories/GHSA-p88m-4jfj-68fv
undici WebSocket client vulnerable to denial of service via fragment count bypass - https://github.com/advisories/GHSA-vxpw-j846-p89q
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse - https://github.com/advisories/GHSA-35p6-xmwp-9g52
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching - https://github.com/advisories/GHSA-g8m3-5g58-fq7m
fix available via `npm audit fix`
node_modules/undici

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Change

npm audit fix is used to update undici as follows:

• @actions/cache@5.0.5 updated to undici@6.27.0

---

Note

Medium Risk
Touches bundled HTTP client, cookie parsing, and WebSocket code paths used at runtime; low application code churn but behavior changes in networking/security-sensitive areas.

Overview
Updates the transitive undici dependency from 6.24.0 to 6.27.0 (via npm audit fix) and refreshes the bundled dist/index.js to match.

The vendored undici changes address the reported advisories: keep-alive socket reuse now runs idle validation and stricter HTTP/1 parsing before dispatching the next request; Set-Cookie SameSite parsing uses exact token matches instead of loose substring checks; and the WebSocket client enforces max fragment count and max payload size from dispatcher webSocketOptions (replacing per-constructor maxDecompressedMessageSize), with clearer close handling on limit violations.

^{Reviewed by Cursor Bugbot for commit fc8a695. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cypress-app-bot]

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.

[github-actions]

🎉 This PR is included in version 7.4.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀