chore(security): pin undici >=7.28.0, clear 7 advisories (v3.0.8)

README.md

@@ -8,6 +8,10 @@
 
 ## What's new
 
+### v3.0.8
+
+- 🔒 **Security patch** — cleared seven newly-disclosed `undici` advisories (two high: TLS validation bypass in the SOCKS5 ProxyAgent and shared-cache cross-user disclosure, plus five moderate/low) reaching the build toolchain transitively through `@vscode/vsce → cheerio`. Pinned to `undici >=7.28.0 <8` via npm `overrides`, staying on the v7 line `cheerio` expects. `npm audit` reports 0 vulnerabilities for both the full and production trees; the shipped runtime is unchanged.
+
 ### v3.0.7
 
 - 🔒 **Security patch** — cleared three newly-disclosed advisories in the build toolchain: `markdown-it` quadratic-complexity DoS (advisory #51), `form-data` CRLF injection (high), and `js-yaml` merge-key DoS, all pinned via npm `overrides`. `@typescript-eslint` updated to 8.61.1. `npm audit` reports 0 vulnerabilities for both the full and production trees; the shipped runtime is unchanged.

package.json

@@ -2,7 +2,7 @@
   "name": "flaunt-github",
   "displayName": "Flaunt GitHub",
   "description": "Passively tracks coding activity and commits a rolling journal to a private GitHub repo. Dashboard, shareable profile badge, optional AI daily summaries.",
-  "version": "3.0.7",
+  "version": "3.0.8",
   "publisher": "UtkarshSingh",
   "icon": "images/logo.png",
   "license": "MIT",
@@ -159,6 +159,7 @@
     "brace-expansion": ">=5.0.6",
     "markdown-it": ">=14.2.0",
     "form-data": ">=4.0.6",
-    "js-yaml": ">=4.2.0"
+    "js-yaml": ">=4.2.0",
+    "undici": ">=7.28.0 <8"
   }
 }