- Fix multiple CVEs: internal worker permission check (CVE‑2025‑23083), HTTP/2 memory leak and ERR_PROTO (CVE‑2025‑23085), and Windows path traversal in normalize() (CVE‑2025‑23084)
- Update undici to v6.21.1 addressing CVE‑2025‑22150 (insufficiently random values in fetch)
- Apply related patches to src, loader, permission, and path modules