fix(security): bump undici to 7.29.0 to clear high-severity audit failures

[seonghobae]

Pull Request

Summary

• Lockfile-only bump of transitive undici 7.28.0 → 7.29.0 (pulled in via jsdom ^7.25.0, dev/test only) to clear five high-severity advisories: GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272, GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm.
• Unblocks the required security-audit check (npm audit --workspaces --audit-level=high), which currently fails on every PR, including docs PR docs(agents): code-owner gates disabled org-wide until multiple maintainers exist #747.
• No package.json change and no override needed — 7.29.0 satisfies jsdom's existing ^7.25.0 range.

Verification

• ./scripts/harness/quickcheck.sh — JS lanes verified locally: ESLint workspaces, doc/security-notes/security-gates/supply-chain/github-bootstrap checks, tsc per workspace, vitest suites (100% coverage incl. @bandscope/desktop, the sole jsdom→undici consumer), and vite builds all pass. The Python lanes (ruff/mypy/pytest) could not run on this machine (engine dev tools not synced locally); they are untouched by a Node lockfile change and are covered by CI.
• npm audit --workspaces --audit-level=high → found 0 vulnerabilities (previously 1 high, the undici range above).

Security Notes

Attack surface

• None added. undici is a transitive dev/test dependency (jsdom's fetch implementation used by vitest); it ships in no runtime artifact. This PR strictly reduces exposure by removing five known high-severity vulnerabilities from the dev toolchain.

Trust boundary

• Unchanged. No production code, IPC, or subprocess boundary is touched; the change is confined to package-lock.json.

Mitigations

• Upgrade to undici 7.29.0 (≥7.28.1, the fixed release for all five advisories), staying within jsdom's declared semver range so dependency resolution is unchanged elsewhere.

Test points

• npm audit --workspaces --audit-level=high exits 0.
• Full workspace vitest suites pass under jsdom 29.1.1 + undici 7.29.0 with the 100% coverage gate intact.

Dependency and Supply Chain

• No new direct dependency was added
• If a new dependency was added, this PR explains why it is needed
• runtime / dev / build / test classification is recorded (transitive dev/test, via jsdom)
• alternatives were considered (an overrides pin was unnecessary since 7.29.0 is in-range; lockfile bump is the minimal change)
• maintainer trust and update health were checked (undici is a Node.js-org-maintained package; 7.29.0 is the current patched release line)
• license fit was checked (MIT, unchanged)
• known security issues were checked (7.29.0 clears all five GHSAs; npm audit clean at high level)
• transitive footprint impact was considered (single-package version bump, no tree changes)
• SBOM or supplemental inventory impact was recorded (SBOM workflow regenerates from the lockfile; no supplemental inventory entries affected)

i18n impact

• No user-visible string changed
• Korean and English locale impact was updated

Reviewer checklist

• Gitflow target branch is correct
• protected-branch rules were not weakened
• required checks are expected to stay green

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9aa70632-1987-4569-8ff5-c143f6769884

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #744. The retained Workspace localization PR now carries the same minimal root-lock update from Undici 7.28.0 to 7.29.0, together with the product changes that required the refreshed desktop dependency verification. Keeping a second lock-only PR would duplicate the exact lock hunk, require a second independent approval, and create an avoidable merge conflict.