diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8a5481..488f349 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.72.1] - 2026-06-26
+
+`web-content-extraction` skill の `undici` 脆弱性を解消（Wiz `main` ブランチスキャン #134）。
+
+### Security
+- **`undici` を脆弱性修正版へ更新（#134）**: 直接依存を `^8.4.1` → `^8.5.0`（解決 8.4.1 → 8.5.0）、`jsdom` 経由の推移依存を 7.27.2 → 7.28.0（`jsdom@29.1.1` の `undici@^7.25.0` 範囲内）に更新。TLS 証明書検証バイパス（SOCKS5 ProxyAgent）・Set-Cookie 経由の HTTP ヘッダーインジェクション・keep-alive ソケット再利用によるレスポンスキュー汚染・WebSocket DoS 等の advisory を解消し、`npm audit` を 0 件にした。`undici` は自動更新（`update-deps.mjs`）の対象外（手動レビュー必須の HTTP 層）のため手動で更新。skill 自身のテスト（node `--test` 40 件）と `npm ci` 整合を確認済み
+
 ## [0.72.0] - 2026-06-12
 
 個人設定の置き場所ガイダンスと監査コマンドを追加（v0.71.1 の `user-*` 予約規約の活用面）。
diff --git a/skills/web-content-extraction/package-lock.json b/skills/web-content-extraction/package-lock.json
index 272fea4..69a0c78 100644
--- a/skills/web-content-extraction/package-lock.json
+++ b/skills/web-content-extraction/package-lock.json
@@ -11,7 +11,10 @@
         "defuddle": "^0.18.1",
         "jsdom": "^29.1.1",
         "pdfjs-dist": "^6.0.227",
-        "undici": "^8.4.1"
+        "undici": "^8.5.0"
+      },
+      "engines": {
+        "node": ">=22.19.0"
       }
     },
     "node_modules/@asamuzakjp/css-color": {
@@ -524,9 +527,9 @@
       }
     },
     "node_modules/jsdom/node_modules/undici": {
-      "version": "7.27.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.27.2.tgz",
-      "integrity": "sha512-uZsKNuzQxDMUY6M3pIMvy5tvlGmtq8XJ2oLAkfRKGNu+1VQAIvLy2xIVG5ATZl5wDXl/tddByAWCizRbOme+TA==",
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
+      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"
@@ -1015,9 +1018,9 @@
       "optional": true
     },
     "node_modules/undici": {
-      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.4.1.tgz",
-      "integrity": "sha512-RNHlB4fxZK0IrkhBsxhlbx7s8kFWwr7rzzOqj5nvZugw3ig3RsB7KW3zVlV0eu8POl+rx5d1hmL7rRg0z1owow==",
+      "version": "8.5.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.5.0.tgz",
+      "integrity": "sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==",
       "license": "MIT",
       "engines": {
         "node": ">=22.19.0"
diff --git a/skills/web-content-extraction/package.json b/skills/web-content-extraction/package.json
index ce20e6a..bc80b6d 100644
--- a/skills/web-content-extraction/package.json
+++ b/skills/web-content-extraction/package.json
@@ -17,6 +17,6 @@
     "defuddle": "^0.18.1",
     "jsdom": "^29.1.1",
     "pdfjs-dist": "^6.0.227",
-    "undici": "^8.4.1"
+    "undici": "^8.5.0"
   }
 }