Upgrade graphql-request to remove url.parse deprecation warnings

[isaacroldan]

WHY are these changes introduced?

GraphQL requests in the bundled CLI can emit Node's DEP0169 warning because graphql-request 6 uses cross-fetch and node-fetch 2, which call the deprecated url.parse() API.

WHAT is this pull request doing?

Upgrade graphql-request to 7.4.0 in CLI Kit and App, so GraphQL uses native fetch. Remove the custom fetch override and cast, and use the new document-analysis API.

Preserve Shopify proxy support with an Undici dispatcher for the command's lifetime, including HTTPS fallback and SHOPIFY_NO_PROXY. Load the proxy implementation only when configured, and restore and close the dispatcher when the command ends. Keep network retries and TLS error classification by reading native fetch error causes, and remove the Keep-Alive header that native fetch rejects.

Update response fixtures for version 7's types. Add DOM types explicitly to the App package because its WebAssembly APIs previously received them through cross-fetch.

How to manually test your changes?

With Node 26, build and bundle the CLI. From the repository root, run the following with an already linked app directory. This calls the bootstrap directly so Node's warning listener remains active.

node --trace-deprecation --input-type=module -e '
  process.argv = ["node", "shopify", "app", "versions", "list", "--path", "/path/to/linked-app"];
  const {default: runCLI} = await import("./packages/cli/dist/bootstrap.js");
  await runCLI({development: true});
'

Confirm that app versions are listed without a url.parse() warning. Repeat with SHOPIFY_HTTPS_PROXY set to a working HTTP proxy and confirm the request appears in its logs. Set SHOPIFY_NO_PROXY to the GraphQL host and confirm the request bypasses the proxy.

Validation

• 482 selected tests passed: 312 HTTP/GraphQL/Theme/analytics tests, 160 App tests, and 10 real request/proxy tests.
• The request/proxy tests passed on Node 22.12.0 and 26.1.0, including socket retries, cancellation, proxy selection, bypass, and dispatcher cleanup.
• Complete HTTPS GraphQL requests passed through both Shopify proxy variables with certificate validation enabled, including in a bundle with code splitting.
• CLI Kit, App, and CLI type checks passed; the App and CLI builds and full CLI bundle passed.
• Lint for all changed TypeScript files, Knip, and the frozen lockfile check passed.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type and added a patch changeset