chore(deps): clean npm install — fix CVEs, silence warnings (#1782)

* chore(deps): clean npm install — fix CVEs, silence warnings

- bump undici 7.24.6 → 7.28.0 (7 high CVEs: TLS bypass, header injection,
  DoS, cache poisoning, SameSite downgrade, cross-origin routing)
- bump ws 8.20.0 → 8.21.0 (2 high CVEs: uninitialized memory disclosure,
  memory exhaustion DoS)
- add allowScripts for sharp + protobufjs to silence install-script warnings
- vendor node-domexception shim (re-exports native DOMException) and override
  the deprecated polyfill pulled transitively by google-auth-library →
  gaxios → node-fetch@3 → fetch-blob

Result: `npm install` reports 0 vulnerabilities, 0 warnings.

Co-Authored-By: OpenClaude <openclaude@gitlawb.com>

* chore(deps): update bun.lock for undici/ws bumps and node-domexception override

CI runs `bun install --frozen-lockfile`, which requires bun.lock to match
package.json. The previous commit bumped undici/ws and added the
node-domexception shim override but didn't include the regenerated lockfile,
causing frozen-lockfile CI to fail.

Co-Authored-By: OpenClaude <openclaude@gitlawb.com>

* fix(publish): include vendor/node-domexception-shim in npm tarball

The file: override in package.json points at vendor/node-domexception-shim,
but the files array didn't list vendor/, so npm pack excluded it. End-user
npm installs would fail resolving the override.

Add vendor/node-domexception-shim/ to the files array. Verified via
npm pack --dry-run: tarball now contains both shim files (12 → 14 files).

Addresses reviewer finding #1.

Co-Authored-By: OpenClaude <openclaude@gitlawb.com>

---------

Co-authored-by: OpenClaude <openclaude@gitlawb.com>

bun.lock

@@ -59,11 +59,11 @@
         "tree-kill": "1.2.2",
         "turndown": "7.2.2",
         "type-fest": "4.41.0",
-        "undici": "7.24.6",
+        "undici": "7.28.0",
         "usehooks-ts": "3.1.1",
         "vscode-languageserver-protocol": "3.17.5",
         "wrap-ansi": "9.0.2",
-        "ws": "8.20.0",
+        "ws": "8.21.0",
         "xss": "1.0.15",
         "yaml": "2.8.3",
         "zod": "3.25.76",
@@ -81,6 +81,7 @@
     "google-auth-library": "10.6.2",
     "ip-address": "10.2.0",
     "lodash-es": "4.18.1",
+    "node-domexception": "file:vendor/node-domexception-shim",
   },
   "packages": {
     "@alcalzone/ansi-tokenize": ["@alcalzone/ansi-tokenize@0.3.0", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-p+CMKJ93HFmLkjXKlXiVGlMQEuRb6H0MokBSwUsX+S6BRX8eV5naFZpQJFfJHjRZY0Hmnqy1/r6UWl3x+19zYA=="],
@@ -739,8 +740,6 @@
 
     "negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="],
 
-    "node-domexception": ["node-domexception@1.0.0", "", {}, "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ=="],
-
     "node-fetch": ["node-fetch@3.3.2", "", { "dependencies": { "data-uri-to-buffer": "^4.0.0", "fetch-blob": "^3.1.4", "formdata-polyfill": "^4.0.10" } }, "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA=="],
 
     "node-forge": ["node-forge@1.4.0", "", {}, "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ=="],
@@ -907,7 +906,7 @@
 
     "unbash": ["unbash@3.0.0", "", {}, "sha512-FeFPZ/WFT0mbRCuydiZzpPFlrYN8ZUpphQKoq4EeElVIYjYyGzPMxQR/simUwCOJIyVhpFk4RbtyO7RuMpMnHA=="],
 
-    "undici": ["undici@7.24.6", "", {}, "sha512-Xi4agocCbRzt0yYMZGMA6ApD7gvtUFaxm4ZmeacWI4cZxaF6C+8I8QfofC20NAePiB/IcvZmzkJ7XPa471AEtA=="],
+    "undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="],
 
     "undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
 
@@ -937,7 +936,7 @@
 
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
 
-    "ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="],
+    "ws": ["ws@8.21.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g=="],
 
     "xml-naming": ["xml-naming@0.1.0", "", {}, "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw=="],
 
@@ -1215,6 +1214,8 @@
 
     "cliui/wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
 
+    "fetch-blob/node-domexception": ["node-domexception@file:vendor/node-domexception-shim", {}],
+
     "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
     "knip/yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],

package.json

@@ -21,6 +21,7 @@
     "src/entrypoints/sdk.d.ts",
     "src/entrypoints/sdk/coreTypes.generated.ts",
     "scripts/windows/openclaude-aliases.ps1",
+    "vendor/node-domexception-shim/",
     "docs/windows-aliases-and-launchers.md",
     "README.md"
   ],
@@ -128,11 +129,11 @@
     "tree-kill": "1.2.2",
     "turndown": "7.2.2",
     "type-fest": "4.41.0",
-    "undici": "7.24.6",
+    "undici": "7.28.0",
     "usehooks-ts": "3.1.1",
     "vscode-languageserver-protocol": "3.17.5",
     "wrap-ansi": "9.0.2",
-    "ws": "8.20.0",
+    "ws": "8.21.0",
     "xss": "1.0.15",
     "yaml": "2.8.3",
     "zod": "3.25.76"
@@ -168,6 +169,11 @@
   "overrides": {
     "ip-address": "10.2.0",
     "google-auth-library": "10.6.2",
-    "lodash-es": "4.18.1"
+    "lodash-es": "4.18.1",
+    "node-domexception": "file:vendor/node-domexception-shim"
+  },
+  "allowScripts": {
+    "protobufjs@7.6.4": true,
+    "sharp@0.34.5": true
   }
 }

vendor/node-domexception-shim/index.js

@@ -0,0 +1,3 @@
+/*! node-domexception shim. Re-exports the platform-native DOMException. */
+
+module.exports = globalThis.DOMException

vendor/node-domexception-shim/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "node-domexception",
+  "version": "1.0.0",
+  "description": "Stub shim: re-exports the platform-native DOMException. Replaces the deprecated node-domexception polyfill.",
+  "main": "index.js",
+  "type": "commonjs",
+  "license": "MIT"
+}