Repository navigation
refactor: Bump undici from 6.29.0 to 6.29.1 and 7.30.0 to 7.30.1 - #307
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update undici lock entries package-lock.json |
The nested undici entry changes to 6.29.1. The top-level entry changes to 7.30.1. Both entries have updated registry URLs and integrity hashes. |
Priority:
Estimated code review effort: 1 (Trivial) | ~5 minutes
Severity of issue fixed: High
Merge Risk: 
bdbc2
-
No merge-blocking risk is evident from this dependency-only update.
Pre-merge checks: 
-
Check name Status Explanation Title check The title begins with the allowed prefix "refactor:" and clearly describes the undici dependency updates. The first letter after the prefix is capitalized. Linked Issues check The directly linked issue [ #306] requires both relatedundiciupdates.package-lock.jsonupdatesnode_modules/@actions/http-client/node_modules/undicifrom 6.29.0 to 6.29.1 and `node_modules/und…Out of Scope Changes check The pull request changes only the two required undicilock-file entries. The changes directly implement [#306]. No unrelated source, configuration, dependency, or test changes are present in the rev…Security Check PASS — The reviewed range changes only package-lock.json. It updates the two registryundicientries from 6.29.0 to 6.29.1 and 7.30.0 to 7.30.1 with matching integrity changes. Both entries remain…Engage In Review Feedback PASS: The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, no review feedback required engagement, implementation, or discussion before reso… Description check The description provides the linked issue, a detailed approach, affected dependencies, security rationale, validation results, and scope information. It does not use the template headings or explicitl… Full details: Linked Issues check
-
Explanation
The directly linked issue [
#306] requires both relatedundiciupdates.package-lock.jsonupdatesnode_modules/@actions/http-client/node_modules/undicifrom 6.29.0 to 6.29.1 andnode_modules/undicifrom 7.30.0 to 7.30.1, including matching registry URLs and integrity hashes. These releases include the security fixes identified by the issue, including process-crash or memory-exhaustion fixes, TLS validation handling, cache isolation, and SRI validation. No additional coding or automated-test requirement appears in [#306].
Full details: Out of Scope Changes check
-
Explanation
The pull request changes only the two required
undicilock-file entries. The changes directly implement [#306]. No unrelated source, configuration, dependency, or test changes are present in the reviewed diff.
Full details: Security Check
-
Explanation
PASS — The reviewed range changes only
package-lock.json. It updates the two registryundicientries from 6.29.0 to 6.29.1 and 7.30.0 to 7.30.1 with matching integrity changes. Both entries remain development-only, and no application code or new security-sensitive pattern was introduced. The bundled npm copy at 6.29.0 is unchanged and is not caused by this pull request.
Full details: Engage In Review Feedback
-
Explanation
PASS: The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, no review feedback required engagement, implementation, or discussion before resolution.
Full details: Description check
-
Explanation
The description provides the linked issue, a detailed approach, affected dependencies, security rationale, validation results, and scope information. It does not use the template headings or explicitly address the test and documentation task checkboxes, but the required information is present and the description is substantially complete.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #307 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 4 4
Lines 159 159
=========================================
Hits 159 159 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Closes #306
Security update for a transitive development dependency (lock file only).
undiciis not inpackage.json. The upgrade resolves the high-severity advisory GHSA-xjj6-f33q-929c (CVE-2026-109869), a denial of service through an unhandled error when a server sends more than five content codings and closes the connection before the body. It affectsundici>= 6.23.0, < 6.29.1and>= 7.18.0, < 7.30.1.node_modules/undici@semantic-release/github12.0.9 (^7.0.0)node_modules/@actions/http-client/node_modules/undici@actions/http-client4.0.0 (^6.23.0), via@actions/core3.0.0 and@semantic-release/npm13.2.0The lock file was regenerated with
npm update undici --ignore-scripts --package-lock-only. Both target versions are the latest releases of their lines.npm ls undici --omit=devis empty, so the package is development-only. The declared Node.js engines are unchanged (>=20.18.1for 7.30.x,>=18.17for 6.29.x); the CI test matrix starts at Node 20.19.5 and the release job runs Node 24.Dependabot alerts addressed by this upgrade:
The upgrade also includes the fixes for GHSA-qrxm-fqhp-jwvm, GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6 and GHSA-9fm3-97px-rjf6, which have no alerts in this repository.
Bundled copy in
npmThe copy of
undici6.29.0 that is bundled inside thenpmpackage (node_modules/npm/node_modules/undici, markedinBundle, required bynode-gyp12.4.0 insidenpm11.21.1, which@semantic-release/npmdepends on) ships with npm's published tarball and cannot be changed by this PR. npm 11.21.1 is the latest 11.x release, so no npm version bundlesundici6.29.1 yet.GitHub's dependency graph counts bundled entries. Before #300, this bundled copy (6.28.0) was the only 6.x copy below 6.28.1, because the
@actions/http-clientcopy was already at 6.29.0. The alerts for GHSA-rfgv-xxqx-mfg5 and GHSA-r53p-7pc4-xj5r (fixed in 6.28.1) were marked fixed at 2026-10-17T23:06:52Z, six seconds after #300 merged and moved the bundled copy to 6.29.0. Alerts 243 and 241 will therefore likely stay open until a newer npm 11.x release bundlesundici6.29.1.Inside npm,
undiciis only used bynode-gyp(lib/download.js) to download Node.js headers for native addon builds.@semantic-release/npmonly runsnpm whoami,version,pack,publishanddist-tagwith it, none of which builds native addons.Changes
Agentno longer passes itstlsoption through a JSON-based clone, so function-valued TLS options such ascheckServerIdentityare kept for per-origin dispatchers.compose(redirect(), cache()), the cache interceptor no longer stores a response from a cross-origin redirect under the original URL, and it honorsno-storeand (for shared caches)privatefrom redirect hops. The deduplication handler passes the primary request's context to waiting handlers.fetch()checks the content-encoding chain (at most 5 codings) before it creates the response body stream and aborts the request, so an orphaned stream can no longer raise an unhandled error.decompressinterceptor's asynchronous callbacks become per-request errors.fetch()accept mixed-case and uppercase algorithm tokens such asSHA256instead of treating them as unknown.EventSourceparser bounds its retained state. A new dispatcher optioneventSource.maxEventSize(defaultbuffer.kStringMaxLength,0disables the limits) caps the bytes retained for a pending event. Each unfinished line is capped atmaxEventSize+ 7 bytes, and thedata:lines per event and the buffered chunks of an unfinished line are each capped atmin(131072, max(1024, floor(maxEventSize / 128))), which is 131,072 with the default. Exceeding a cap errors the stream withEventSource message size exceeded. Thedispatcherinit option ofEventSourcenow defaults to the global dispatcher.drain.Set-Cookieattribute parser used bygetSetCookies()loops instead of recursing once per attribute, so a header with thousands of attributes no longer exceeds the call stack ([Backport v7.x] fix: avoid unbounded recursion in Set-Cookie attribute parser nodejs/undici#5997, backport of fix: avoid unbounded recursion in Set-Cookie attribute parser nodejs/undici#5757).getCookies()returns a null-prototype object and keeps a cookie named__proto__, andsetCookie()keeps anExpiresof0and ignores a numericexpiresoutside theDaterange.eventSource.maxEventSizeoption) and GHSA-9fm3-97px-rjf6 (medium), with the same changes as in 7.30.1.fetch()([v6.x] fix(fetch): fix aborting Streams (#3754) nodejs/undici#6000, backport of fix aborting Streams nodejs/undici#3754): the fetch controller'sterminatedlistener is now registered once per fetch and is no longer removed inonComplete. Aborting theAbortSignalafter the raw body has arrived but before it has been consumed now rejects the body read; previously, the read completed. As a consequence, acontent-encodingbody that fails to decompress after it has arrived now errors the body stream, wheretext(),json()or a stream read previously never settled if the body came in a later packet than the headers. Nothing in this repository reaches this change, because thefetch()of the 6.x copy is never called.Breaking Changes
None
Code Changes Required
None — the upgrade is a drop-in replacement.
@semantic-release/github12.0.9 (lib/octokit.js) is the only caller of the 7.x copy. In the release job it sends each GitHub API request throughfetch(url, { ...opts, dispatcher })withnew Agent(), or withnew ProxyAgent({ uri })if a proxy is configured. It passes notlsoption and uses no interceptors, cookie helpers,EventSource,WebSocketorintegrity. Of the changes above, it can only reach thefetch()content-encoding check (responses with more than 5 codings), the removed TLS assertion (certificate hostname errors after connect) and the TLS session cache fix (a full cache of 100 sessions, which a newAgentper request does not reach).@actions/http-client4.0.0 importsProxyAgentfrom the 6.x copy at the top level oflib/index.js, so the 6.x copy is loaded whenever the module is imported.ProxyAgentis only constructed in_getProxyAgentDispatcher(), which is reached throughgetAgentDispatcher(), and neither@actions/core3.0.0 nor@semantic-release/npm13.2.0 calls it.HttpClientrequests, such as the GitHub Actions OIDC token request for npm trusted publishing, go through Node'shttpandhttpsmodules.fetchwithnew Agent()) returned the same results on 7.30.0 and 7.30.1 for plain, gzip, brotli, 5-fold gzip, invalid gzip, truncated gzip, 6 codings with a body, a same-origin redirect and a 404 response. The only difference was the case of 6 codings with the connection closed before the body: both versions rejectedfetch(), and 7.30.0 also raised an uncaughtSocketError: other side closed, which would crash the process. 7.30.1 did not.Summary by CodeRabbit