[xSAVIKx]

Summary

This PR fixes the high-severity undici advisories in the shipped bundle and takes the pending Dependabot updates. It is the content of v1.10.1.

Changes

• undici 6.28.1 -> 6.29.1 (lockfile only). @actions/http-client uses it, and dist/ bundles it. 6.29.1 fixes these advisories:
  • GHSA-2m5v-pch6-74hx: TLS certificate validation bypass.
  • GHSA-qrxm-fqhp-jwvm, GHSA-4qv8-2p9j-2685, GHSA-xjj6-f33q-929c, GHSA-9fm3-97px-rjf6: denial of service.
• @aws-sdk/client-s3 and @aws-sdk/lib-storage 3.1154.0 -> 3.1156.0 (the same versions as deps: bump the npm-minor-patch group with 3 updates #37).
• @biomejs/biome 2.5.15 -> 2.6.2. Biome 2.6 formats YAML and Markdown by default, and that changes the front matter of the docs. biome.json turns off the YAML and Markdown formatters, so biome checks the same files as before. No source or doc file is reformatted.
• actions/setup-node 7.1.0 and actions/upload-artifact 7.0.2 in the benchmark workflow (the same as ci: bump the actions group with 2 updates #36).
• dist/ is rebuilt from a clean npm ci.

Not in this PR

• vite / esbuild (through vitepress) and jest 29 still have advisories. They are only for docs and tests, and they are not shipped. vitepress 1.6.4 is the latest 1.x and has no fixed release.
• deps: bump @types/node from 24.13.4 to 26.5.1 #4 (@types/node 26) and deps: bump jest and @types/jest #6 (jest 30) are major updates.

Tests

• npm audit --omit=dev: 0 vulnerabilities. Before this PR: 1 high.
• Full suite against local RustFS: 1221 passed, 8 skipped. CLI integration: 6 of 6 passed.
• format:check, lint, typecheck and docs:build pass. git status --porcelain dist is empty after the rebuild.

#36 and #37 are not needed after this PR.