diff --git a/package-lock.json b/package-lock.json
index 86d021451b5..25f6c4ea914 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -17828,9 +17828,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.30.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
-      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
+      "version": "7.30.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.2.tgz",
+      "integrity": "sha512-mLyPQnHwUxaM/rideoK/+KL8DaAJLRl4aBCfmX444aCSLnIaomqPLtNRe2jdCYcsk5wZzXrDIQC8ZeYNRAYyIA==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"
diff --git a/scripts/check-dependency-security.test.js b/scripts/check-dependency-security.test.js
index 63bbb0bd900..d59528685fa 100644
--- a/scripts/check-dependency-security.test.js
+++ b/scripts/check-dependency-security.test.js
@@ -158,6 +158,20 @@ for (const [name, oldVersion] of [
     assert.throws(() => checkDependencyGraph(fixture), new RegExp(`${name} must be at least`));
   });
 }
+for (const lockedPath of [
+  "node_modules/undici",
+  "node_modules/review-fixture/node_modules/undici",
+]) {
+  test(`undici 7.30.1 is refused at ${lockedPath}`, () => {
+    const fixture = structuredClone(lockfile);
+    fixture.packages[lockedPath] = {version: "7.30.1"};
+    assert.throws(
+      () => checkDependencyGraph(fixture),
+      /undici must be at least 7\.30\.2/,
+    );
+  });
+}
+
 test("every recorded minimum version is enforced", () => {
   for (const [name, minimumVersion] of Object.entries(policy.minimum_versions)) {
     const fixture = structuredClone(lockfile);
diff --git a/scripts/dependency-security-policy.json b/scripts/dependency-security-policy.json
index 27485ca6d0f..2468c6d7422 100644
--- a/scripts/dependency-security-policy.json
+++ b/scripts/dependency-security-policy.json
@@ -1,13 +1,13 @@
 {
   "schema_version": 1,
-  "reviewed_on": "2026-11-03",
+  "reviewed_on": "2026-11-07",
   "minimum_versions": {
     "js-yaml": "4.3.1",
     "nanoid": "3.3.17",
     "http-cache-semantics": "4.3.0",
     "minimatch": "11.0.1",
     "open": "11.0.0",
-    "undici": "7.30.1",
+    "undici": "7.30.2",
     "body-parser": "1.20.9",
     "fast-uri": "3.1.9",
     "qs": "6.16.1",