Unjs Defu vulnerabilities

• unjs defu defu: Prototype pollution via `__proto__` key in defaults argument CVE-2026-35209 Fix available 7.5 HighApril 4, 2026