[mvalancy]

dev still installs Undici 6.28.1 through SQLite's optional node-gyp dependency, failing the production audit and blocking #192. Backport the already reviewed compatible 6.29.1 patch from #191 (8a9c7512b5dedf4020d117887674d378de85667b) without bringing main-promotion workflow changes into this fix.

Only the Undici lockfile record changes. The regression checks every locked copy and the actual SQLite → node-gyp consumer resolution against its declared range. The index conflict was resolved by retaining dev's entries and adding only this lesson; main-only lesson links were not imported.

Validation at 765cf1985c389f8850a13df338d56c8113350ce7 with Node 22.18.0 / npm 10.8.2:

• Clean npm ci --legacy-peer-deps --no-audit --no-fund: passed.
• Harness: 163/163 passed, zero skipped.
• Real native SQLite admin bootstrap/restart fixture: passed.
• Fresh-cache npm audit --omit=dev --audit-level=high: zero high/critical, five moderate package findings remain (Resolve the remaining production moderate dependency families in scoped PRs #186); Undici is absent.
• Independent read-only agent review of this exact diff: no findings. This is not a GitHub non-author approval.
• Types/lint/build and remote CI are pending; this remains draft until their actual results are recorded.

This does not update Node's bundled fetch or claim an exploit reproduction, hosted parity, deployment, or resolution of the remaining dependency families. Historical October 24 evidence is clearly dated; current backport evidence is separate. Part of #193; unblocks #192 and does not close #186.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Integration preflight: exact head 95b9c84616dc3da47fea71c97065dc586694505e; live dev remains ef495eff15ed7aac51e72dc7a1db1bb96d2b3695 (remote ref rechecked, not inferred from PR metadata).

Independent agent review cleared the exact head and documentation-only provenance from runtime head 765cf1985c389f8850a13df338d56c8113350ce7. The complete raw/name-status diff contains only the reviewed dated backport lesson and symptom index; all other tracked blobs are identical. This is not a GitHub non-author approval.

Final CI 40567729657 and Node matrix/installer 40567729457 passed at that head. Actual smoke-job logs show 6 smoke, 42 new-user, 27 mobile, 3 living-graph and 3 performance cases passed, with no retries/failures/skips in those sequences. Build, types/lint, all unit suites, real-Neo4j MCP contract, security scan and showcase passed. Production-main/nightly smoke is intentionally inapplicable to this dev PR. The earlier canceled runtime-head run is not used as final CI evidence.

Local clean Node 22.18.0/npm 10.8.2 install, 163 harness cases, real SQLite bootstrap/restart, all builds/types/lint passed. Fresh production audit has no high/critical entries; five moderate entries remain separately tracked by #186. The isolated native fixture was disposable; no shared database or deployed service was changed.

Proceeding with the owner-authorized administrative merge into dev only, matching the exact head, with all protection settings unchanged. Post-merge branch CI and remote parent/tree verification remain required before integration closeout. This operation supplies neither a non-author approval nor main/release/deployment authority.

[mvalancy]

Post-merge verification is complete for dev 32149ee61ea5436831d95d76e4c4b6dc2db619a3: parents are exactly prior dev ef495eff15ed7aac51e72dc7a1db1bb96d2b3695 and reviewed PR head 95b9c84616dc3da47fea71c97065dc586694505e; complete tree e0a041cf89eb657b3d3be17db9cff875624f033a equals the reviewed head's tree.

Both actual branch workflows passed: CI 40573195798 and Node 22.18/24 + installer 40573195765. All applicable unit/build/types/lint/security/real-Neo4j/browser/showcase gates are successful; the main/nightly production job remains inapplicable to dev. Administrative integration used the standing dev-only authorization, with protection settings unchanged. This is not a non-author approval, main promotion, release or deployment.