dep: npm audit report three vulnerabilities

[Phoenix500526]

npm audit
# npm audit report

@babel/core  <=7.29.0
@babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
fix available via `npm audit fix`
node_modules/@babel/core

brace-expansion  4.0.0 - 5.0.8
Severity: high
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/brace-expansion

undici  7.0.0 - 7.28.0
Severity: high
undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives - https://github.com/advisories/GHSA-4cwx-7wf7-3272
undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives - https://github.com/advisories/GHSA-jr45-8vmc-qm54
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
fix available via `npm audit fix`
node_modules/@electron/get/node_modules/undici

3 vulnerabilities (1 low, 2 high)

To address all issues, run:
  npm audit fix

[0xMudit]

I'd like to work on this issue.

Proposed approach

Run
pm audit fix to resolve the three reported vulnerabilities:

1. @babel/core — Arbitrary File Read (GHSA-4x5r-pxfx-6jf8)
2. �race-expansion — DoS via unbounded expansion (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895)
3. undici — Multiple vulnerabilities in @electron/get transitive dependency (GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272, GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm)

Will verify the fix doesn't break any workspace builds after updating the lockfile.

[Phoenix500526]

I'd like to work on this issue.

Proposed approach

Run pm audit fix to resolve the three reported vulnerabilities:

1. @babel/core — Arbitrary File Read (GHSA-4x5r-pxfx-6jf8)
2. �race-expansion — DoS via unbounded expansion (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895)
3. undici — Multiple vulnerabilities in @electron/get transitive dependency (GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272, GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm)

Will verify the fix doesn't break any workspace builds after updating the lockfile.

@0xMudit Thanks for looking into this. Just to clarify, I had already opened PR #3725 to address this issue before your PR was created.

For future issues, could you please check whether there is already an open PR linked to the issue before starting a new one? It helps avoid duplicate effort and unnecessary review overhead for everyone involved.