fix(security): move @grpc/grpc-js to 1.14.5 past GHSA-m9gg-hp2v-232j

CHANGELOG.md

@@ -26,6 +26,7 @@
 
 ### Other changes
 
+- **[modal]** Moves `@grpc/grpc-js` to 1.14.5, past the High advisory GHSA-m9gg-hp2v-232j (`getAuthContext` could return unauthorized certificates as authorized in certain configurations).
 - **[runtime] [docs]** A task that started without a failed optional input, such as a review task without a failed strategy, keeps its result when `resume --retry-failed` reruns that input, whether the task is synchronized while the rerun is still running or after it succeeded. Before, the task failed with "optional dependency is not terminal for verifier admission" or "finalized optional dependency is missing from verifier admission", which could halt review and fail the run; in the first case a later task that checks the task's output, such as triage after dedupe, also failed for good. The retried node then counts as succeeded, so the report's completion can read COMPLETE and a `--require-complete` run can succeed, although the tasks that started before it verified never read its output. For a property lens, those are the property fan-in and everything after it.
 - **[runtime] [cli] [docs]** Production copies of `brace-expansion` and `undici` move past the High advisories published on 2026-09-29 (GHSA-6j4f-fj2g-mc7p and GHSA-qhr7-859c-m2p7 for `brace-expansion`, GHSA-rfgv-xxqx-mfg5 for `undici`) and the Moderate and Low advisories fixed alongside them (GHSA-q2hr-2g5m-vwhr, GHSA-3wwx-pv8p-q78v, GHSA-r53p-7pc4-xj5r). The CLI's two `brace-expansion` copies, both pulled in by `@oclif/core` through `minimatch`, move from 2.1.4 and 5.0.9 to 2.1.7 and 5.0.12. No npm release bundles these fixes yet, so the `npm@11.19.0` patch now also carries `brace-expansion` 5.0.12 and `undici` 6.28.1 inside the operator npm, and the operator npm's pinned closure digest changes with it.
 - **[artifacts]** Concurrent ultrafuzz commands, such as `ultrafuzz status --watch` while `ultrafuzz cancel` runs, no longer lose or tear records in a run's `events.jsonl`, `usage.jsonl` or `attempts.jsonl`, or in the `.ultrafuzz/` audit journals. Each append holds a short-lived `<journal>.lock` next to the journal; a lock left by a killed process on the same host is taken over at once, and one that cannot be checked after 10 seconds.