build(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: csv-parse and undici.

Updates csv-parse from 4.16.3 to 7.0.2

Changelog

Sourced from csv-parse's changelog.

7.0.2 (2026-08-02)

Bug Fixes

• csv-parse: prototype replacement reachable via columns (#497)

Performance Improvements

• csv-parse: avoid unnecessary allocation in ResizeableBuffer.toString (#495)

7.0.1 (2026-07-02)

Bug Fixes

• csv-parse: ship stream cjs export (#490)

7.0.0 (2026-06-14)

⚠ WARNING

This version was published by mistake, there is no breaking changes. Also, for some reason, the associated version's changelog included many commit messages from version 6.0.0.

Features

• csv-parse: delimiter discover (fix #400)
• csv-parse: delimiter_auto sample
• csv-parse: desactivate delimiter splitting when empty array
• csv-parse: dont modify prototype in sync (see #479)
• csv-parse: export CsvError and normalize_options
• csv-parse: remove comment about sync parse old usage

Bug Fixes

• csv-parse: align trim with ECMAScript whitespace (fix #482) (#483)

6.2.1 (2026-03-20)

Bug Fixes

• csv-parse: prototype pollution with objname option (fix #479)

6.2.0 (2026-03-17)

Features

• csv-parse: alig info interfaces with js api
• csv-parse: info bytes_records (fix #446)
• csv-parse: remove non-existing ts function declaration
• csv-parse: remove ts usage of all in error type
• csv-parse: returned type generic for on_record (fix #461 #464 #466) (#468)

... (truncated)

Commits

• 288c9c6 chore(release): publish
• 2ad6c07 refactor(csv-parse): rename group_columns_by_name tests
• eb4d148 fix(csv-parse): prototype replacement reachable via columns (#497)
• 1d4ed3b perf(csv-parse): avoid unnecessary allocation in ResizeableBuffer.toString (#...
• 6e0d5a3 chore(release): publish
• abfe4de build: latest dependencies
• a5ef896 docs(csv-parse): fix changelog message from previous version
• 230af8e fix(csv-parse): ship stream cjs export (#490)
• 3d71f0b chore(release): publish
• 2ba4897 build: use ts nodenext
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for csv-parse since your current version.

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​csv-parse@​4.16.3 ⏵ 7.0.2	+1	+2	+14	+6
	npm/​undici@​7.28.0 ⏵ 7.29.0		+21	+1

View full report