chore(deps): bump undici to 7.29.0 to close 5 security advisories

[waleedlatif1]

Summary

• Bump undici 7.28.0 → 7.29.0 in apps/sim, closing all 5 open Dependabot alerts (GHSA-4cwx-7wf7-3272 high, plus 4 moderate)
• Dropped the stale nested undici@7.28.0 lockfile pins for cheerio, e2b, and @electron/get so the whole 7.x tree dedupes onto 7.29.0 — the only remaining 7.x copy in node_modules is 7.29.0

Notes

• Fixes cross-user info disclosure via degenerate/whitespace Cache-Control directives, CRLF injection via blob body type, retry-interceptor response desync, and setCookie attribute injection
• node-gyp still resolves undici@6.28.0 (build-only transitive of @electron/rebuild, not flagged); a flat override would force it off its ^6 range, so it was left alone
• We use undici directly in lib/core/security/input-validation.server.ts (SSRF-guarded request); we don't use setCookie or the retry/cache interceptors, so no behavioral surface changed

Type of Change

• Bug fix (security dependency update)

Testing

• bun install --frozen-lockfile passes; verified node_modules/undici is 7.29.0 with no nested 7.28.0 copies
• bun run type-check clean
• vitest run lib/core/security/ — 775 tests pass
• bun run lint clean

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 4, 2026 6:34pm

[cursor]

PR Summary

Low Risk
Lockfile-only version bump with no source changes; residual undici@6.x under build tooling was intentionally left unchanged.

Overview
Bumps the direct undici dependency in apps/sim from 7.28.0 to 7.29.0 and updates bun.lock so the 7.x tree resolves to that version (replacing stale 7.28.0 pins for transitive consumers such as cheerio, e2b, and @electron/get).

This is a security-driven dependency update intended to close multiple Dependabot advisories (including a high-severity issue and several moderate ones around cache handling, CRLF/injection, retry behavior, and cookie parsing). No application code changes; behavior for the app’s direct use (e.g. SSRF-guarded request in security input validation) is expected to stay the same aside from patched library behavior.

^{Reviewed by Cursor Bugbot for commit 0b66c4d. Configure here.}

[greptile-apps]

Greptile Summary

The PR upgrades the Sim application’s direct undici dependency from 7.28.0 to 7.29.0 to address security advisories.

• Updates the exact dependency version in apps/sim/package.json.
• Updates the corresponding Bun lockfile resolution and integrity hash.
• Deduplicates compatible 7.x transitive consumers while retaining separate 6.x and 8.x resolutions.

Confidence Score: 5/5

The PR appears safe to merge, with the manifest and lockfile consistently upgrading compatible undici consumers to 7.29.0.

The direct pin matches the lockfile resolution, all deduplicated 7.x dependency ranges accept 7.29.0, and incompatible major versions remain isolated in separate lockfile entries.

Important Files Changed

Filename	Overview
apps/sim/package.json	Updates the direct undici pin to 7.29.0; existing direct usage and declared runtimes reveal no compatibility issue.
bun.lock	Updates the resolved undici 7.x package and integrity hash consistently; all consumers of this entry accept 7.29.0.

_{Reviews (1): Last reviewed commit: "chore(deps): bump undici to 7.29.0 to cl..." | Re-trigger Greptile}