fix: Override undici and ws to fix CVE-2026-6734, CVE-2026-9697, CVE-2026-12151, CVE-2026-48779

- undici: ^7.24.0 → ^7.28.0 (CVE-2026-6734, CVE-2026-9697, CVE-2026-12151)
- ws: ^7.5.11 global override (CVE-2026-48779)

Regenerated package-lock overrides for all targets.

Author: Sachin Hulyalkar

package-lock-overrides/sagemaker.series/package-lock.json

@@ -0,0 +1,51 @@
+Override undici to ^7.28.0 to fix CVE-2026-6734, CVE-2026-9697, CVE-2026-12151.
+
+@generated
+@generator: scripts/patches/apply-override.sh --patch common/finding-override-undici.diff --override 'direct:undici=^7.28.0' --override 'global:undici=^7.28.0' --override 'remote/package.json@direct:undici=^7.28.0' --override 'remote/package.json@global:undici=^7.28.0'
+@override-package: undici@^7.28.0
+
+Index: b/package.json
+===================================================================
+--- a/package.json
++++ b/package.json
+@@ -111,7 +111,7 @@
+     "node-pty": "^1.1.0-beta43",
+     "open": "^10.1.2",
+     "tas-client": "0.3.1",
+-    "undici": "^7.24.0",
++    "undici": "^7.28.0",
+     "v8-inspect-profiler": "^0.1.1",
+     "vscode-oniguruma": "1.7.0",
+     "vscode-regexpp": "^3.1.0",
+@@ -244,7 +244,8 @@
+     "follow-redirects": "^1.16.0",
+     "uuid": "^14.0.0",
+     "ip-address": "^10.1.1",
+-    "shell-quote": "^1.8.4"
++    "shell-quote": "^1.8.4",
++    "undici": "^7.28.0"
+   },
+   "repository": {
+     "type": "git",
+Index: b/remote/package.json
+===================================================================
+--- a/remote/package.json
++++ b/remote/package.json
+@@ -35,7 +35,7 @@
+     "native-watchdog": "^1.4.1",
+     "node-pty": "^1.1.0-beta43",
+     "tas-client": "0.3.1",
+-    "undici": "^7.24.0",
++    "undici": "^7.28.0",
+     "vscode-oniguruma": "1.7.0",
+     "vscode-regexpp": "^3.1.0",
+     "vscode-textmate": "^9.3.0",
+@@ -48,6 +48,7 @@
+     "picomatch": "^2.3.2",
+     "follow-redirects": "^1.16.0",
+     "uuid": "^14.0.0",
+-    "ip-address": "^10.1.1"
++    "ip-address": "^10.1.1",
++    "undici": "^7.28.0"
+   }
+ }

package-lock-overrides/sagemaker.series/remote/package-lock.json

@@ -0,0 +1,20 @@
+Override ws to ^7.5.11 to fix CVE-2026-48779.
+
+@generated
+@generator: scripts/patches/apply-override.sh --patch common/finding-override-ws.diff --override 'global:ws=^7.5.11'
+@override-package: ws@^7.5.11
+
+Index: b/package.json
+===================================================================
+--- a/package.json
++++ b/package.json
+@@ -245,7 +245,8 @@
+     "uuid": "^14.0.0",
+     "ip-address": "^10.1.1",
+     "shell-quote": "^1.8.4",
+-    "undici": "^7.28.0"
++    "undici": "^7.28.0",
++    "ws": "^7.5.11"
+   },
+   "repository": {
+     "type": "git",

package-lock-overrides/web-embedded.series/package-lock.json

@@ -61,3 +61,5 @@ common/fix-snippets-path-traversal.diff
 common/fix-remote-hosts-loopback-check.diff
 common/fix-mcp-workspace-trust.diff
 common/add-openvsx-verification-check.diff
+common/finding-override-undici.diff
+common/finding-override-ws.diff

package-lock-overrides/web-embedded.series/remote/package-lock.json

@@ -57,3 +57,5 @@ web-embedded/fix-watch-target.diff
 web-embedded/remove-unused-recommended-extensions-action.diff
 web-embedded/remove-new-window-actions-and-profile-workspace-section.diff
 web-embedded/only-allow-trusted-origins-in-webviews.diff
+common/finding-override-undici.diff
+common/finding-override-ws.diff