fix(deps): bump undici to 7.29.0 and ip-address to 10.4.0 to address security advisories

[osama-rizk]

Problem

Four open Dependabot alerts on transitive dependencies in the root yarn.lock:

• feat: async lambda #256 (high) — undici cross-user information disclosure
• feat: optimize custom selection set type #255 (medium) — undici downstream response desynchronization
• feat: Use force install for ts version canary tests #254 (medium) — ip-address CIDR suffix suppresses special-use classification
• fix return types of create, update, delete operations on SSR clients #253 (medium) — ip-address misclassification of IPv4-mapped / NAT64 IPv6 addresses

Issue number, if available: Dependabot alerts #253, #254, #255, #256

The open aws-cdk-lib alerts (#219–#224) are intentionally not included here — that upgrade is not compatible and is being handled separately (see #760 / #758).

Changes

• undici 7.28.0 → 7.29.0 (first patched version for feat: optimize custom selection set type #255/feat: async lambda #256)
• ip-address 10.2.0 → 10.4.0 (first patched version for fix return types of create, update, delete operations on SSR clients #253 is 10.2.1 and for feat: Use force install for ts version canary tests #254 is 10.2.2; 10.4.0 is the current release and covers both — matching Dependabot PR chore(deps): bump ip-address from 10.2.0 to 10.4.0 #777)

Both are purely transitive and already within their existing ranges (undici@^7.24.5, ip-address@^10.0.1), so this is a lockfile-only re-resolution. Both target versions have no runtime dependencies, so nothing else in the tree shifts. Checksums were regenerated by yarn install --mode=update-lockfile (Yarn 4).

Validation

• Confirmed each target is the first patched version for its advisory and satisfies the existing range.
• Verified both packages have no dependencies, so the change is limited to the two lockfile entries (version / resolution / checksum) with no cascading edits.
• yarn install --mode=update-lockfile completed cleanly (pre-existing peer-dependency warnings unchanged); diff is yarn.lock-only.

This is a dependency-only security fix in the lockfile; no source or test changes apply.

Checklist

• PR description included
• yarn test passes (CI)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1a709ca

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR