diff --git a/web/package.json b/web/package.json
index 4b969147..a39046a8 100644
--- a/web/package.json
+++ b/web/package.json
@@ -12,6 +12,7 @@
       "vite@<6.4.3": "^6.4.3",
       "esbuild@<0.28.1": "^0.28.1",
       "js-yaml@<4.2.0": "^4.2.0",
+      "undici@<7.28.0": "^7.28.0",
       "@babel/core@<7.29.6": "^7.29.6",
       "postcss@<8.5.10": "^8.5.10",
       "picomatch@<2.3.2": "^2.3.2",
diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml
index 389b1abb..8ebbf05f 100644
--- a/web/pnpm-lock.yaml
+++ b/web/pnpm-lock.yaml
@@ -8,6 +8,7 @@ overrides:
   vite@<6.4.3: ^6.4.3
   esbuild@<0.28.1: ^0.28.1
   js-yaml@<4.2.0: ^4.2.0
+  undici@<7.28.0: ^7.28.0
   '@babel/core@<7.29.6': ^7.29.6
   postcss@<8.5.10: ^8.5.10
   picomatch@<2.3.2: ^2.3.2
@@ -2685,8 +2686,8 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
-  undici@7.25.0:
-    resolution: {integrity: sha512-xXnp4kTyor2Zq+J1FfPI6Eq3ew5h6Vl0F/8d9XU5zZQf1tX9s2Su1/3PiMmUANFULpmksxkClamIZcaUqryHsQ==}
+  undici@7.28.0:
+    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
     engines: {node: '>=20.18.1'}
 
   unified@11.0.5:
@@ -3810,7 +3811,7 @@ snapshots:
 
   '@testing-library/dom@10.4.1':
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       '@babel/runtime': 7.28.6
       '@types/aria-query': 5.0.4
       aria-query: 5.3.0
@@ -4662,7 +4663,7 @@ snapshots:
       saxes: 6.0.0
       symbol-tree: 3.2.4
       tough-cookie: 6.0.1
-      undici: 7.25.0
+      undici: 7.28.0
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
@@ -5680,7 +5681,7 @@ snapshots:
 
   typescript@5.9.3: {}
 
-  undici@7.25.0: {}
+  undici@7.28.0: {}
 
   unified@11.0.5:
     dependencies: