chore(deps) : bump undici and decode-uri-component

[SB-virendrasolanke]

Motivation and Context

https://smartbear.atlassian.net/browse/STOP-6355
https://smartbear.atlassian.net/browse/STOP-6407

Description

Bumps undici and decode-uri-component to patched versions via yarn resolutions to remediate 4 medium-severity CVEs flagged by dependency scanning.

Vulnerabilities Fixed

CVE	Package	Affected Version	Fixed Version	Description
CVE-2026-45822	decode-uri-component	0.2.2	0.5.0	Super-linear CPU consumption / event-loop blocking via crafted percent-encoded input, leading to denial of service
CVE-2026-16729	undici	6.27.0	6.28.0	Cookie attribute injection via unsanitized domain values or unparsed entries, allowing SameSite CSRF protection bypass
CVE-2026-15157	undici	6.27.0	6.28.0	HTTP header injection / request smuggling via unvalidated CRLF sequences in duck-typed blob .type values
CVE-2026-16728	undici	6.27.0	6.28.0	Downstream response desynchronization in proxy/gateway apps when the retry interceptor's assembled body length mismatches the forwarded Content-Length header

Root Cause

Both packages are transitive dependencies, not direct project dependencies:

• decode-uri-component is pulled in via stylus > css-parse > css > source-map-resolve
• undici is pulled in via webpack-bugsnag-plugins > @bugsnag/cli

Since neither can be bumped directly, the fix pins them using the project's existing resolutions pattern in package.json.

Changes

• package.json: added resolutions entries forcing decode-uri-component to ^0.5.0 and undici to ^6.28.0.
• yarn.lock: regenerated via yarn install to lock in the patched versions.

How Has This Been Tested?

• Ran yarn install — completed successfully with lockfile updated, no dependency resolution errors.
• Verified locked versions:
  • decode-uri-component@0.5.0
  • undici@6.28.0

Screenshot(s)/recordings(s)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• This PR's code follows as closely as possible the coding style/guidelines of this project.
• I have added error reporting and followed the error reporting guidelines.
• I have added event tracking and followed the event tracking guidelines.
• I have updated any relevant documentation accordingly to reflect this PR's changes.
• I have added automated tests (unit/integration/e2e/other) to cover my changes.
• All new and existing tests pass locally (excluding flaky CI tests).

[SB-ChetanKorde]

LGTM