[elkimek]

The direct undici update leaves a second vulnerable transport pinned under @vercel/blob, and its CI fails an assertion that still expects the old version. Update both compatible transport lines, preserve exact dependency pins, and verify that an excessive Content-Encoding response rejects safely while a subsequent request still succeeds.

Changes:

• Upgrade direct undici to 8.12.3 and the scoped Blob transport override to 6.29.1. Preserve DNS pinning, manual redirects, cancellation, response lifetime and Blob SDK contracts.
• Upgrade Vitest and its Istanbul coverage package together to 4.1.12, closing the mocker advisories. Refresh Zod to 4.6.7, including the separate exact pin under @vercel/cli-config.
• Apply tokenizer 4.0.2 and Node types 26.6.5.
• Update the pinned CodeQL, upload-artifact, download-artifact and setup-node actions. Synchronize the diagnostic contract's exact SHAs while retaining its isolation and acceptance assertions.

Includes the compatible updates proposed in #1701, #1694, #1685, #1684, #1704, #1689, #1688 and #1687.

Deferred:

• Bump jsdom from 30.0.1 to 30.1.3 #1686 (jsdom 30.1.3): reproduces 13 frozen ingest trace failures after upstream postMessage scheduling changes.
• Bump the vitest group across 1 directory with 2 updates #1683 (Vitest 5.0.5): reproduces zero real service-worker coverage counts in the coverage-producer contract.
  Neither upgrade is included, and no fixture, coverage floor, assertion or resource budget is weakened.

Validation on Node 24.22.1 / TypeScript 7.0.2:

• 564 focused unit/contract tests and 41 additional production-artifact, Kit and original-ingest tests passed. Earlier 85 proxy/Blob checks overlap those counts.
• One headless Chromium production AppShell case passed at mobile and desktop widths.
• Both strict compiler projects, architecture, quality (17 checks), supply-chain, styles and browser-vendor consistency checks passed.
• Production static build passed its committed byte policies.
• Production npm audit: zero vulnerabilities. Full graph: four low entries from one unpatched development-only deepmerge advisory; no critical, high or moderate findings.

Hosted CI passed on a7d9b8ab27a3daf4983a5226569cfc2df36eadd5:

• Required test gate: passed, including exact selected-case membership across all four shipping shards.
• 15,078 unit/contract tests plus 130 retained compatibility tests passed.
• 154 Chromium shipping cases passed (39 + 39 + 44 + 32); production artifact, offline and startup/first-use resource policies passed.
• Sync compatibility: all six browser/transport jobs passed.
• CodeQL and supply-chain validation passed.
• Greptile completed at 5/5 with no actionable findings. No corrective follow-up commit was needed.

These results establish the selected PR merge gate. The exhaustive browser and combined-coverage matrix remains owned by nightly/manual/release GitHub Actions, and full release acceptance is not claimed.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates both Undici transport lines, refreshes compatible dependencies, and updates pinned CI actions.

• Proxy and Blob requests use updated Undici transports.
• Test and build jobs use refreshed dependency versions.
• CI workflows use updated pinned GitHub Actions.

No actionable issues were found. Tests were not run during this review.

Author elkimek explicitly deferred jsdom 30.1.3 because of frozen ingest trace failures and Vitest 5.0.5 because service-worker coverage counts became zero. Neither upgrade is included.

_{Reviews (1) · Last reviewed commit: "chore: update pinned CI actions and thei..." · Reviewed by Greptile}