[airadier]

Split out of #118 as requested in review. npm audit fix (run by the pre-commit hook) bumps transitive dependencies with new advisories: undici 7.29.0 → 7.30.1, handlebars 4.7.9 → 4.7.10, fast-uri 3.1.6 → 3.1.9 and brace-expansion 1.1.18 → 1.1.21 (found 0 vulnerabilities). dist/ is rebuilt from unchanged src/; no source changes.

undici is the only one bundled into dist/; the others are dev/build-time dependencies. It stays on the 7.x line already forced by the overrides entry.

#118 is stacked on top of this branch and needs this merged first, otherwise the pre-commit npm audit fix hook re-applies the bump on every commit there.

[mateobur]

The scanResultUrl output logic looks solid and is well documented, but it's bundled with a large unrelated undici update under a "npm audit" title. Could we split these, and confirm the dist/index.js changes are regenerated from the TypeScript sources and lockfile rather than edited directly?

[mateobur]

Changes look like a legitimate undici security bump with the expected upstream fixes. Before merging, can you confirm package.json and the lockfile were also updated and that dist was regenerated from a clean build rather than edited directly, so the fix is reproducible and audit actually clears?

[airadier]

The first comment was from while this branch briefly also contained the feature (#118 got merged into it by mistake). That's been reverted, and this PR is back to only the dependency bump. The feature is in #120, stacked on this one.

On the second:

• package.json is intentionally unchanged: all four bumped packages are transitive, and undici is already constrained by the existing "overrides": { "undici": "^7.0.0" }, which 7.30.1 satisfies. Only package-lock.json changes.
• dist/ is a clean rebuild: npm ci && npm run prepare in a fresh worktree at this commit reproduces the committed dist/ byte-for-byte, and comparing source maps against master shows the only bundled sources that changed are in undici.
• npm audit at this commit reports found 0 vulnerabilities.

The current scan job failures aren't related to the change: the scanner fails with "Unable to retrieve MainDB" (backend DB download), while the same commit passed earlier today. Re-running the failed jobs.