fix: upgrade undici and langsmith to address security vulnerabilities

[cbullinger]

Summary

This PR upgrades undici and langsmith to address 7 open Dependabot security alerts on main.

Changes

• undici (transitive via jsdom in frameworks/javascript/tanstack/app): added npm override >=7.28.0, updated lockfile from 7.24.6 to 8.5.0
• langsmith (transitive via langchain-core in mflix/server/python-fastapi): raised minimum constraint from >=0.8.5 to >=0.8.18, regenerated requirements.txt (0.8.9 → 0.9.1)

Security Issues Addressed

High Severity

• GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware arbitrary server-side file read (CVSS 7.7)
• CVE-2026-6734 (GHSA-hm92-r4w5-c3mj): undici cross-origin request routing via SOCKS5 proxy pool reuse (CVSS 7.5)
• CVE-2026-9697 (GHSA-vmh5-mc38-953g): undici TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent (CVSS 7.4)

Medium Severity

• CVE-2026-9678 (GHSA-pr7r-676h-xcf6): undici cross-user information disclosure via shared cache whitespace bypass (CVSS 5.9)
• CVE-2026-9679 (GHSA-p88m-4jfj-68fv): undici HTTP header injection via Set-Cookie percent-decoding (CVSS 5.9)

Low Severity

• CVE-2026-11525 (GHSA-g8m3-5g58-fq7m): undici Set-Cookie SameSite attribute downgrade via permissive substring matching (CVSS 3.7)
• CVE-2026-6733 (GHSA-35p6-xmwp-9g52): undici HTTP response queue poisoning via keep-alive socket reuse (CVSS 3.7)

Dependabot Alerts Resolved

Closes #94, #95, #96, #97, #98, #100, #101

Test Plan

• npm audit reports 0 vulnerabilities in tanstack app
• Lockfile reflects patched undici version (>=7.28.0)
• requirements.txt regenerated with langsmith >=0.8.18
• CI passes
• No breaking changes in application functionality

Made with Cursor

[dacharyc]

Thank you! ✅