[Madraka]

What

Closes the 37 open Dependabot security alerts (state on 2026-11-08), all transitive and all in the lockfiles, plus two Rust advisories that cargo audit reports and Dependabot does not. No source changes.

Package	Was	Now	How	Alerts
undici 7.x	7.28.0	7.30.2	pnpm.overrides undici@<7.30.1 in pnpm-workspace.yaml: miniflare 4.20260730.0 (ADR-0012's pin) pins undici exactly to 7.28.0, so a plain update cannot move it. Documented next to the existing sharp override, with the alerts and the removal condition.	#5–#32
undici 8.x	8.11.2	8.12.4	plain pnpm update (astro → unifont ^8.0.0)	#21–#35 (8.x line)
seroval	1.6.8	1.7.9 (+ seroval-plugins 1.7.8)	plain update (@tanstack/router-core ^1.6.7)	#36 GHSA-9wx9-5pv9-3349, #37 GHSA-f86p-h4j2-7qgj
rustls	0.23.45	0.23.46	cargo update -p rustls	#1–#4
rustls-webpki	0.103.15	0.103.16	cargo update (RUSTSEC-2026-0382, found by cargo audit)	—
webpki-root-certs	1.0.9	1.0.11	cargo update (RUSTSEC-2026-0383, found by cargo audit)	—
tokio	1.53.2	1.54.1	cargo update (RUSTSEC-2026-0386, unsoundness warning)	—

Who depends on what: undici 7 only through miniflare (devDependencies), undici 8 only through astro's unifont, rustls only through jsonschema's reqwest. seroval is the one that reaches users: it is compiled into the Studio bundle that @cloudhal/cli ships, hence the patch changeset on @cloudhal/cli.

Checked locally: pnpm install --frozen-lockfile (lockfile up to date), pnpm why undici seroval (no version below the patched ones), pnpm audit and pnpm audit --prod (no known vulnerabilities), cargo audit (clean, no warnings), pnpm lint, pnpm typecheck, pnpm size:check, cargo clippy --workspace --all-targets --locked -- -D warnings, and apps/studio/test/approvals.test.tsx (a router-based screen, for the seroval bump). The remaining pnpm peers check warning (@cloudflare/workers-types below wrangler 4.158's peer range) predates this PR and is a separate decision (see the deps-sweep hand-over).

Dependabot alerts only resolve against main: the count goes to 0 once this is merged, not on the PR. Verify after the merge with:

gh api 'repos/cloudhal-dev/cloudhal/dependabot/alerts?state=open&per_page=100' --jq 'length'

Checklist

• pnpm lint, pnpm typecheck, pnpm size:check, cargo clippy pass locally; pnpm check and cargo test --workspace are left to CI (one machine, several sessions)
• Contract change? No
• User-visible change in a published package? .changeset/security-alerts-2026-11.md (@cloudhal/cli patch)
• Commits are signed off (git commit -s, DCO)
• Docs / AGENTS.md updated if behaviour or commands changed: the override is documented in pnpm-workspace.yaml

🤖 Generated with Claude Code