feat: declare undici as a peer dependency for Socket Mode

.changeset/undici-peer-dependency.md

@@ -0,0 +1,5 @@
+---
+"@slack/bolt": patch
+---
+
+Declare `undici` as a peer dependency (`^7.28.0`). `@slack/bolt` constructs a `SocketModeClient` from `@slack/socket-mode@3`, which requires `undici@^7` as a peer. Consumers on strict package managers (Yarn Berry, pnpm) should install `undici` alongside `@slack/bolt`. The `^7.28.0` floor avoids `undici` releases affected by CVE-2026-12151 (GHSA-vxpw-j846-p89q), a high-severity WebSocket denial-of-service. Resolves #3039.

package.json

@@ -79,6 +79,7 @@
     "typescript": "5.3.3"
   },
   "peerDependencies": {
-    "@types/express": "^5.0.0"
+    "@types/express": "^5.0.0",
+    "undici": "^7.28.0"
   }
 }