deps: bump undici to 8.11.2 and ip-address to 10.7.2 (Dependabot #228, #224, #225)

[diegosouzapw]

⚠️ base-red inherited: #15032

Resolves Dependabot alerts #228 (undici), #224 and #225 (ip-address). Supersedes #15028, which bumps only undici.

undici ^8.10.0 → ^8.11.2 (runtime)

In < 8.10.2, an unhandled error in WebSocket permessage-deflate decompression can crash the process (DoS). undici is a runtime dependency here: proxyFetch, proxyDispatcher, the SOCKS connector, proxyFallback, the video bridge and the proxy test routes.

ip-address override ^10.3.1 → ^10.7.2 (runtime, transitive via socks)

Both <= 10.5.0 advisories let a trust or SSRF check treat a local address as public:

• Address6.isLinkLocal() matched fe80::/64 instead of fe80::/10;
• no classifier recognised the NAT64 local-use range 64:ff9b:1::/48.

10.7.2 is the version the @omniroute/opencode-plugin-v2 lock already uses. The Dockerfile overlay that patches npm's own bundled copy used ip-address@10.5.0, which is still vulnerable, and now uses 10.7.2. The CVE note above that overlay is updated to match.

Scope and validation

• package-lock.json was regenerated with --package-lock-only, and no other version moved. The diff is those two packages.
• Both versions were published more than 72 h ago (undici 8.11.2 on 2026-09-24, ip-address 10.7.2 on 2026-09-15), so the dependency-age gate passes.
• 192.168.0.113 runs, on a clean npm ci of this branch, the proxyFetch, proxy-dispatcher, SOCKS and proxy-fallback suites, the SSRF-guard suites, check-deps, typecheck:core and check:open-sse-typecheck. Results are in the comment below.

[diegosouzapw]

Validation on 192.168.0.113, run on a clean npm ci of this branch (10a33b5), with undici 8.11.2 and ip-address 10.7.2 installed:

• The proxyFetch suites (12 files), proxy-dispatcher-{cache-cap,family,local-egress}, proxy-fallback-ssrf, proxy-types-socks5-runtime-3508, the SSRF-guard suites (base-executor, outbound-url-guard ×3, provider-validation, obsidian) and check-deps: 0 failures. proxyfetch-bun is skipped outside Bun.
• typecheck:core: 0 errors. check:open-sse-typecheck: OK.