fix: update undici to resolve CVE-2026-85024

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

• Dependency: undici (transitive via @actions/http-client) updated 8.10.0 -> 8.10.2
• Advisory: GHSA-3wwx-pv8p-q78v (CVE-2026-85024, WebSocket permessage-deflate DoS)
• Dependabot alert: https://github.com/warpdotdev/oz-agent-action/security/dependabot/49
• Verification: npm ci, npm ls undici -> 8.10.2, npm audit --omit=dev -> 0 vulnerabilities, npm run build and npm run lint pass.

Highlight the risky code / where the dependency was used

undici is bundled into dist/index.js via @actions/http-client (HTTP calls in the action). Patch bump only; dist/ rebuilt.

Special instructions for this PR — e.g. if it's a Stainless thing

package-lock.json edited minimally (undici entry only) to avoid npm-version lockfile churn. dist/ diff is the rebuilt bundle; verify the action still runs (e2e workflow).

AFTER YOU MERGE

None.

[independabot-soc2]

This PR was generated with Warp.

Comment @warp-agent on this PR to send it follow-up work.

  View origin

[liliwilson]

LGTM — patch-level undici bump, dist rebuilt, e2e green.