command-code@1.4.6 bundles vulnerable undici and @opentelemetry dependencies

[kartikkabadi]

TL;DR: npm audit on 1.4.6 shows 33 findings, 3 high, all in undici and OpenTelemetry. ai-sdk pins undici ^5.29.0 so it can't be fixed locally. Need an update that bumps those deps.

From here on the slop:

Summary:
npm audit on a fresh install of command-code@1.4.6 reports 33 vulnerabilities, 3 of them high severity. They are in transitive dependencies and cannot be fixed without upstream updates.

Expected behavior:
Dependencies should be on patched versions.

Actual behavior:

• undici is on the 5.x line. The latest 5.29.0 is still vulnerable to multiple DoS / header-injection issues (advisories GHSA-g9mf-h72j-4rw9, GHSA-2mjp-6q6p-2qxm, GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-vxpw-j846-p89q). Fix is in 6.27.0+.
• @opentelemetry/sdk-node pins @opentelemetry/propagator-jaeger at 2.7.1, which is vulnerable to DoS via malformed headers (GHSA-45rx-2jwx-cxfr, CVSS 7.5). Fix is in 2.9.0+.

Steps to reproduce:

1. npm init -y
2. npm install command-code@1.4.6
3. npm audit

Version: 1.4.6
OS: macOS
Terminal/shell: ghostty / zsh

Additional context:
ai-sdk/provider-utils depends on undici ^5.29.0 and @opentelemetry/sdk-node uses exact versions, so npm audit fix cannot resolve these without breaking changes or waiting for ai-sdk and OpenTelemetry updates.