chore(deps): bump undici from 7.29.0 to 8.11.2 in /.repos/effect-smol

[dependabot]

Bumps undici from 7.29.0 to 8.11.2.

Release notes

Sourced from undici's releases.

v8.11.2

What's Changed

• fix: close rejected HTTP/2 WebSocket handshake streams by @​mcollina in nodejs/undici#5873
• fix: avoid reconnecting aborted requests by @​Junaid-PK in nodejs/undici#5846

New Contributors

• @​Junaid-PK made their first contribution in nodejs/undici#5846

Full Changelog: nodejs/undici@v8.11.1...v8.11.2

v8.11.1

What's Changed

• deslopify websocket test by @​KhafraDev in nodejs/undici#5851
• Revert "fix: preserve HTTP/2 for legacy fetch consumers" by @​mcollina in nodejs/undici#5860
• fix websocketstream bugs by @​KhafraDev in nodejs/undici#5863
• fix hang on 3xx response with large body by @​KhafraDev in nodejs/undici#5850
• docs: warn about buffering response bodies by @​mcollina in nodejs/undici#5872
• test: cover native fetch gzip decoding through the legacy bridge by @​mcollina in nodejs/undici#5874

Full Changelog: nodejs/undici@v8.11.0...v8.11.1

v8.11.0

What's Changed

• fix: complete upgrade diagnostics lifecycle by @​BridgeAR in nodejs/undici#5761
• build(deps): bump step-security/harden-runner from 2.19.4 to 2.21.0 by @​dependabot[bot] in nodejs/undici#5753
• fix(decompress): join a repeated content-encoding header by @​luantaraschi in nodejs/undici#5664
• fix(cookies): keep a cookie named proto in getCookies by @​luantaraschi in nodejs/undici#5663
• build(deps-dev): bump jest from 30.5.0 to 30.5.1 by @​dependabot[bot] in nodejs/undici#5784
• build(deps): bump got from 15.1.0 to 16.0.0 in /benchmarks by @​dependabot[bot] in nodejs/undici#5785
• fix: selectively re-enable SIMD for ppc64 by @​richardlau in nodejs/undici#5776
• use private fields for brand checks by @​KhafraDev in nodejs/undici#5792
• fix(h2): do not unref a session with open streams by @​kjsik11 in nodejs/undici#5782
• fix(h2): avoid pool fan-out during ALPN negotiation by @​mcollina in nodejs/undici#5799
• fix issue #5715 by @​KhafraDev in nodejs/undici#5805
• ci: extend macOS Node.js workflow timeout by @​mcollina in nodejs/undici#5775
• fix(env-http-proxy-agent): NO_PROXY wildcard semantics by @​mcollina in nodejs/undici#5777
• fix(h2): do not replay a request whose response already started after GOAWAY by @​kjsik11 in nodejs/undici#5788
• test: skip HTTP/2 churn test on Node.js 25 on all platforms by @​kjsik11 in nodejs/undici#5790
• fix(proxy-agent): preserve repeated iterable headers by @​GiHoon1123 in nodejs/undici#5779
• docs(errors): document ProxyConnectionError (UND_ERR_PRX_CONN) by @​kilisamemarisaaa in nodejs/undici#5781
• dataurl parsing improvements + update WPT by @​KhafraDev in nodejs/undici#5812
• fix(decompress): treat inherited Object.prototype names as unsupported encodings by @​NgoQuocViet2001 in nodejs/undici#5807
• test(h2): stabilize http2-connection by @​ViniciusDev26 in nodejs/undici#5801
• fix: preserve HTTP/2 for non-upgrade legacy requests by @​mcollina in nodejs/undici#5811
• fix: skip drain dispatch for clientTtl-evicted clients in PoolBase by @​vwong in nodejs/undici#5677
• chore: update tests blocking release by @​vwong in nodejs/undici#5828
• build(deps): bump uWebSockets.js from v20.68.0 to v20.70.0 in /benchmarks by @​dependabot[bot] in nodejs/undici#5824
• fix(deduplicate): settle requests when composed with retry by @​mcollina in nodejs/undici#5817
• fix(cache): do not report aborted on successful cache hits by @​Yahiro025 in nodejs/undici#5819

... (truncated)

Commits

• 7e016ad Bumped v8.11.2 (#5886)
• fcdd5a6 fix: skip reconnecting for aborted requests (#5846)
• dd28c5c fix: close rejected HTTP/2 WebSocket handshake streams (#5873)
• 5e0a2f8 Bumped v8.11.1 (#5871)
• 2b72898 test: cover native fetch gzip decoding through the legacy bridge (#5874)
• 636bf51 docs: warn about buffering response bodies (#5872)
• 8145595 fix hang on 3xx response with large body (#5850)
• f3cbe48 fix websocketstream bugs (#5863)
• 1d4ea0a Revert "fix: preserve HTTP/2 for legacy fetch consumers" (#5860)
• 77d7b3f deslopify websocket test (#5851)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[cursor]

PR Summary

Medium Risk
Touches the HTTP client used by @effect/platform-node; patch-only but affects fetch/HTTP/2/WebSocket paths in production networking.

Overview
Updates pnpm-lock.yaml so @effect/platform-node resolves undici from 8.10.2 to 8.11.2 (still within the existing ^8.10.2 range), adding the corresponding undici@8.11.2 package entries.

The lockfile also drops the scratchpad importer block (workspace links to AI, SQL, platform, and core packages), so the scratchpad workspace no longer appears as a separate locked dependency root—likely from lockfile regeneration rather than application code changes.

No package.json or source files change in this diff; runtime HTTP behavior for Node platform code follows whatever fixes ship in undici 8.11.x (e.g. aborted-request reconnect, HTTP/2 WebSocket handshake cleanup).

^{Reviewed by Cursor Bugbot for commit b17599f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	−44 B (−0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+5 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−49 B (−0.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.2 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	8	−1 (−11.1%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+17 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+18 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: f5cb3b4 · PR result: b17599f · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.7 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.