Thanks for following up and sharing the upstream reference.

The dependency path and the node-gyp issue seem to explain why the vulnerable version is still appearing:

npm CLI → node-gyp → undici@6.26.0

Based on the information provided, it sounds like this is no longer a question of whether the dependency exists, but rather when the updated node-gyp release is incorporated into npm CLI's dependency tree.

For anyone finding this discussion later:

• npm CLI 11.17.0 is pulling undici@6.26.0 transitively through node-gyp@13.0.0.
• The dependency update appears to be tracked upstream in the referenced node-gyp issue.
• Once node-gyp adopts a fixed undici version and npm CLI updates its dependency se…