fix vulnerable transitive dependencies

Author: dannyhw

.changeset/calm-tools-update.md

@@ -0,0 +1,6 @@
+---
+---
+
+Update vulnerable transitive dependencies in the workspace lockfile and pin
+Module Federation's exact Undici dependency to its patched release. No
+published package API or dependency range changes.

pnpm-lock.yaml

@@ -18,6 +18,7 @@ overrides:
   "koa@3": ^3.1.2
   "ws@8": ^8.21.1
   "adm-zip": ^0.6.0
+  "@module-federation/dts-plugin@2.8.0>undici": 7.29.0
   # Security fix for GHSA-67mh-4wv8-2f99, reached only through
   # @modern-js/node-bundle-require inside @module-federation/cli.
   "esbuild@<0.25.0": ^0.25.0