deps: bump undici to 7.28.0 to fix Dependabot alerts (#301)

ksroda-sa · claude · web-flow · commit 8e2026690dab · 2026-07-09T11:27:01.000+02:00
Pin jsdom's transitive undici to 7.28.0 via resolutions in the Angular
token-refresh and login-pkce samples. Resolves 12 Dependabot alerts
(high/medium/low) where undici@7.25.0 was vulnerable.

Co-authored-by: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/samples/angular/login-pkce/package.json b/samples/angular/login-pkce/package.json
@@ -37,6 +37,7 @@
     "@angular/build/vite": "7.3.5",
     "vitest/vite": "8.0.16",
     "esbuild": "0.28.1",
-    "@babel/core": "7.29.6"
+    "@babel/core": "7.29.6",
+    "jsdom/undici": "7.28.0"
   }
 }
diff --git a/samples/angular/login-pkce/yarn.lock b/samples/angular/login-pkce/yarn.lock
@@ -5768,20 +5768,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"undici@npm:7.28.0":
+  version: 7.28.0
+  resolution: "undici@npm:7.28.0"
+  checksum: 10c0/fe781983a26098795e99bb1f64906cbb7d0bcaa029a26baade007b53ea67f2631d189b8f9671a31f4c8d0cb3773b7559608628ba54452fef51fec90e7c78bb0d
+  languageName: node
+  linkType: hard
+
 "undici@npm:^6.25.0":
   version: 6.27.0
   resolution: "undici@npm:6.27.0"
   checksum: 10c0/f88c3dae3957dbf9d93cb481440aced317bd3c4941b5914fea5efba516d51138988cdb5c76006f0bb1337e41d56c3443351055d492e73af2428521c37ba2a76f
   languageName: node
   linkType: hard
 
-"undici@npm:^7.25.0":
-  version: 7.25.0
-  resolution: "undici@npm:7.25.0"
-  checksum: 10c0/02a0b45dc14eb91bc488948750232450fe52f27a6b08086d6ac6736bb47908d600fe3a96d346f12eab24729c782e5c2f693bc8e8eca6696d4e4c09b1ed4cb4ec
-  languageName: node
-  linkType: hard
-
 "unpipe@npm:~1.0.0":
   version: 1.0.0
   resolution: "unpipe@npm:1.0.0"
diff --git a/samples/angular/token-refresh/package.json b/samples/angular/token-refresh/package.json
@@ -37,6 +37,7 @@
     "@angular/build/vite": "7.3.5",
     "vitest/vite": "8.0.16",
     "esbuild": "0.28.1",
-    "@babel/core": "7.29.6"
+    "@babel/core": "7.29.6",
+    "jsdom/undici": "7.28.0"
   }
 }
diff --git a/samples/angular/token-refresh/yarn.lock b/samples/angular/token-refresh/yarn.lock
@@ -5768,20 +5768,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"undici@npm:7.28.0":
+  version: 7.28.0
+  resolution: "undici@npm:7.28.0"
+  checksum: 10c0/fe781983a26098795e99bb1f64906cbb7d0bcaa029a26baade007b53ea67f2631d189b8f9671a31f4c8d0cb3773b7559608628ba54452fef51fec90e7c78bb0d
+  languageName: node
+  linkType: hard
+
 "undici@npm:^6.25.0":
   version: 6.27.0
   resolution: "undici@npm:6.27.0"
   checksum: 10c0/f88c3dae3957dbf9d93cb481440aced317bd3c4941b5914fea5efba516d51138988cdb5c76006f0bb1337e41d56c3443351055d492e73af2428521c37ba2a76f
   languageName: node
   linkType: hard
 
-"undici@npm:^7.25.0":
-  version: 7.25.0
-  resolution: "undici@npm:7.25.0"
-  checksum: 10c0/02a0b45dc14eb91bc488948750232450fe52f27a6b08086d6ac6736bb47908d600fe3a96d346f12eab24729c782e5c2f693bc8e8eca6696d4e4c09b1ed4cb4ec
-  languageName: node
-  linkType: hard
-
 "unpipe@npm:~1.0.0":
   version: 1.0.0
   resolution: "unpipe@npm:1.0.0"

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,7 @@`
`37`	`37`	`"@angular/build/vite": "7.3.5",`
`38`	`38`	`"vitest/vite": "8.0.16",`
`39`	`39`	`"esbuild": "0.28.1",`
`40`		`- "@babel/core": "7.29.6"`
	`40`	`+ "@babel/core": "7.29.6",`
	`41`	`+ "jsdom/undici": "7.28.0"`
`41`	`42`	`}`
`42`	`43`	`}`