Exact pin on undici@5.28.4 exposes consumers to 11 open advisories — please bump to >=6.27.0

[jodeleeuw]

Hi! We consume psychds-validator (currently 1.5.1) as a runtime dependency of @jspsych/metadata-cli, and Dependabot flags 11 open advisories against the exactly-pinned "undici": "5.28.4" in your package.json. Because the pin is exact, downstream projects can't remediate via their own dependency resolution (npm overrides against an exact pin corrupt tree resolution in our testing, and wouldn't protect transitive consumers anyway) — a new psychds-validator release is the only clean fix.

Advisories affecting 5.28.4 (none have a patched 5.x except the first two):

Severity	GHSA	Summary	Patched in
Medium	GHSA-c76h-2ccp-4975	Insufficiently random values	5.28.5
Low	GHSA-cxrh-j4jr-qwg3	DoS via bad certificate data	5.29.0
Medium	GHSA-g9mf-h72j-4rw9	Unbounded decompression chain in HTTP response	6.23.0
High	GHSA-v9p9-hfj2-hcw8	WebSocket client unhandled exception	6.24.0
High	GHSA-vrm6-8vpv-qv8q	WebSocket permessage-deflate unbounded memory	6.24.0
Medium	GHSA-2mjp-6q6p-2qxm	HTTP request/response smuggling	6.24.0
Medium	GHSA-4992-7rv2-5pvq	CRLF injection via upgrade option	6.24.0
High	GHSA-vxpw-j846-p89q	WebSocket client DoS	6.27.0
Medium	GHSA-p88m-4jfj-68fv	HTTP header injection via Set-Cookie	6.27.0
Low	GHSA-35p6-xmwp-9g52	Response queue poisoning via keep-alive	6.27.0
Low	GHSA-g8m3-5g58-fq7m	Set-Cookie SameSite downgrade	6.27.0

Ask: bump the dependency to "undici": "^6.27.0" (or newer). The 5→6 API is compatible for fetch/request-style usage; the highest-severity items are WebSocket-specific, so if the validator only uses undici for HTTP schema fetching, practical exposure is low — but consumers' security scanners flag it regardless, and the exact pin blocks any downstream workaround.

A caret range (rather than another exact pin) would also let consumers pick up future undici patch releases without a new validator release. Happy to open a PR with the bump if that helps — thanks for maintaining the validator!

🤖 Generated with Claude Code on behalf of @jodeleeuw