Docs-Only Commit Collapsed JS Test Coverage from 77% to 5% via Hidden Dependency Clash

A documentation-only commit with no code changes triggered a CI coverage collapse in WorldScript Studio, an open-source writing app, dropping line coverage from 77.09% to 5.16% in June 2026. The root cause was an unbounded security override for the undici package that inadvertently resolved to the newly released version 8.x, which removed an internal file that jsdom 29.1.1 depended on at module load. As a result, every jsdom-environment test worker crashed silently at boot, causing Vitest to report zero tests from all React component files rather than explicit test failures. The Security Audit job remained green throughout, since the override was doing exactly what it was designed to do — masking the true source of the breakage. The fix was applied in a single signed commit and the incident was converted into standing policy, with the override properly scoped in pnpm-workspace.yaml to prevent unbounded version resolution in future.