chore: override undici to ^6.27.0 to remediate CVEs

[devin-ai-integration]

Summary

undici 5.29.0 is still vulnerable (CVE-2026-1525, CVE-2026-1527, CVE-2026-22036 need ≥ 6.24.0; CVE-2026-9679 needs ≥ 6.27.0) and the previous lockfile bump could not reach it: it comes in transitively from @ai-sdk/provider-utils, and every published 3.x/4.x/5.x of that package still pins undici: ^5.29.0, so no in-range resolution exists.

Forcing it with a pnpm override, which resolves to undici@6.28.0:

 // package.json
+"pnpm": {
+    "overrides": {
+        "undici": "^6.27.0"
+    }
+}

undici 6 requires Node ≥ 18, which matches this package's engines.node: ">=18", so the major bump is safe for our supported range. This can be dropped once upstream @ai-sdk/provider-utils moves to undici 6/7 on its own.

Verification: pnpm lint, pnpm typecheck and pnpm test (146 tests, node + edge) pass. pnpm build still fails with the pre-existing tsdown unrun import error, unchanged from main.

Link to Devin session: https://app.devin.ai/sessions/2216f6167a274f5e86e5ff85a4f7b6f0
Requested by: @requesty-ditti

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: f1ea17f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR