chore(deps): refresh the dependency tree, undici 8 and the iconify v2 packs

[zfy0701]

Two commits, in order: the two major bumps that needed source changes, then the lockfile refresh that needed none. They read much more easily apart than as one diff.

Nothing refreshes this tree on its own — there is no dependency bot here, and the lockfile has only ever moved as a side effect of feature work — so it had drifted a long way.

1. undici 8 and the iconify v2 icon packs

undici 7 → 8 in the daemon and the relay. The whole surface either package uses is fetch, ProxyAgent and the Dispatcher type, but two things ride along and a reviewer should see both:

• undici 8 negotiates HTTP/2 by default. Slack egress now uses h2 wherever the server offers it. Slack supports h2; the case to watch is an operator behind a forward proxy or a TLS-inspection appliance. Pinning allowH2: false would keep the old wire behavior, and is deliberately not done here — that default is most of what the major is.
• @slack/socket-mode still declares undici@^7 as a peer — 3.0.1, the current release, too — so pnpm peers check now reports one unmet peer. Every symbol it imports (WebSocket, ping, CloseEvent, ErrorEvent, MessageEvent, fetch) is unchanged in undici 8, so the range is stale rather than the API broken, and strict-peer-dependencies is off, so installs and CI are unaffected. Socket Mode is the daemon's Slack ingress and the unit suites mock the SDK, so this is the one thing worth a real-workspace smoke test before it ships.

@iconify-icons/{logos,ph} 1.x → 2.0.0 in the console. The packs rename as they major: logos/gitlab is now the LOGOTYPE (tanuki + wordmark, 512×111) and the mark moved to logos/gitlab-icon (256×247). GitlabMark follows it, matching slack-icon beside it. Left alone, the GitLab mark would draw a wordmark inside a square 9px slot.

The existing mark test did catch this, but only by accident: it asserted the artwork's hex case, which upstream also changed. Both variants carry the brand triad, so color alone no longer separates them — the test now compares hex case-insensitively and pins the shape instead, which is what actually catches a swap like this.

v2 also points every icon subpath at one shared data.d.ts, so importing two icons from one pack resolves to the same file and reads as a duplicate import; import-x/no-duplicates is off for the one file that does that.

Verified in the running console: the GitLab card renders viewBox="0 0 256 247" in a square 9×9 box.

2. Lockfile refresh

No manifest change — every move is inside a range the manifests already declare, so this is what pnpm update -r resolves today.

pnpm audit: 20 high / 8 moderate / 1 low → 6 high / 0 moderate / 0 low. What carried each fix:

Advisory	Came in with
@fastify/static path traversal + authorization bypass	@fastify/swagger-ui 6.1.0 → 6.1.1 (moves @fastify/static 9 → 10)
fast-uri host confusion	fastify 5.10.0 → 5.12.1
postcss arbitrary file read	next 16.2.11 → 16.3.3 (pins postcss 8.5.23)
hono, incl. memo() retaining SSR output across requests	the mem0 plugin's @modelcontextprotocol/node reaching hono 4.13.5
dompurify	posthog-js 1.407 → 1.422
nanoid, brace-expansion, js-yaml, find-my-way, valibot	vitest, eslint 10.9.1, prisma 7.10

The six that remain are either dev-only inside promptfoo's tree or have no published fix. image-size has no 2.0.3, and its two DoS advisories sit in the ICNS, JXL and HEIF parsers, which the icon upload path cannot reach: validateIconUpload allowlists PNG, JPEG and WebP by magic bytes before it ever calls imageSize, under a 512 KB cap.

Beyond the advisories, the moves worth knowing: prisma 7.10 across client / adapter / instrumentation; lucide and lucide-react together at 1.35, so the control plane and the console stay on one icon set; eslint 10.9.1 with typescript-eslint 8.68; @larksuiteoapi/node-sdk 1.73, grammy 1.46, pg 8.23.

Deliberately not taken: typescript 7 (typescript-eslint 8.68 still peers <6.1.0), @types/node 26 (the runtime is Node 24 everywhere — .nvmrc, engines, every image), conventional-changelog-conventionalcommits 10 (rebuilt on @conventional-changelog/template, while release-notes-generator still wants conventional-changelog-writer@^8), and prisma 8 (RC only).

Testing

pnpm typecheck, pnpm lint (zero warnings), pnpm format:check and pnpm build all pass — including the daemon, cli and setup self-contained assertions and the console's production build.

Suites: relay, control-plane, web, cli, setup, protocol, message, connection, activation-policy, k8s-client, observability, memory-plugin-mem0 and the release scripts all pass.

The daemon suite reports 13 failures in shim-workspace-files, shim-exec-handler and shim-cancellation. These are pre-existing and macOS-only — restoring the original lockfile reproduces exactly the same 13 — and CI does not run them on macOS. The cause is the root fence comparing a canonicalized root against a lexical target, which only diverges where tmpdir() is a symlink (/var/folders → /private/var/folders). Untouched by this PR, worth its own fix.

Control-plane test:int was not run locally (needs Docker); CI covers it.

🤖 Generated with Claude Code

[agentconnect-md-test]

Approved — I found no blocking regressions in this revision.

The Undici 8 change is contained to the existing fetch / ProxyAgent / Dispatcher seams, and the repository’s Node floor satisfies Undici 8’s engine requirement. The remaining @slack/socket-mode peer-range warning is accurately disclosed and is a reasonable real-workspace smoke-test item rather than a blocker for this active-development project. The Iconify v2 adaptation selects the square gitlab-icon, and the updated test now protects the shape distinction that matters.

I also checked the full dependency refresh rather than treating it as opaque: the lockfile parses successfully under the pinned pnpm, git diff --check is clean, and the build, check, Linux unit, integration, daemon-store, evaluation, and sandbox CI paths are green. The Windows unit job was still pending when I completed the review.

_{sent by review-bot (Codex · gpt-5.6-sol) · open in session}