Skip to content

chore(deps): bump undici from 6.27.0 to 6.28.0 - #2076

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/undici-6.28.0
Open

chore(deps): bump undici from 6.27.0 to 6.28.0#2076
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/undici-6.28.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps undici from 6.27.0 to 6.28.0.

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 4, 2026
@dependabot
dependabot Bot temporarily deployed to test-trigger-is August 4, 2026 10:58 Inactive
@rugpanov

rugpanov commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ✅ all 35 test jobs passed for cc218a53.
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from cc218a5 to 75f6f14 Compare August 5, 2026 09:43
@dependabot
dependabot Bot temporarily deployed to test-trigger-is August 5, 2026 09:43 Inactive
@rugpanov

rugpanov commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

🤖 Integration tests triggered for 75f6f14b — ⏳ running.
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from 75f6f14 to 13b2acd Compare August 5, 2026 10:08
@dependabot
dependabot Bot temporarily deployed to test-trigger-is August 5, 2026 10:08 Inactive
@rugpanov

rugpanov commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ✅ all 35 test jobs passed for 13b2acd6.
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from 13b2acd to 7586c75 Compare August 6, 2026 09:18
@dependabot
dependabot Bot temporarily deployed to test-trigger-is August 6, 2026 09:18 Inactive
@rugpanov

rugpanov commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ❌ 1 of 35 test jobs failed for 7586c753 (34 passed).
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from 7586c75 to d4cc3bd Compare August 6, 2026 12:17
@dependabot
dependabot Bot temporarily deployed to test-trigger-is August 6, 2026 12:17 Inactive
@rugpanov

rugpanov commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ❌ 18 of 35 test jobs failed for d4cc3bd6 (17 passed).
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from d4cc3bd to 87f458b Compare August 6, 2026 14:53
@dependabot
dependabot Bot temporarily deployed to test-trigger-is August 6, 2026 14:53 Inactive
@rugpanov

rugpanov commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ❌ 2 of 35 test jobs failed for 87f458b6 (33 passed).
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from 87f458b to e84cc25 Compare August 12, 2026 08:53
@dependabot
dependabot Bot deployed to test-trigger-is August 12, 2026 08:53 Active
@rugpanov

rugpanov commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ❌ 2 of 35 test jobs failed for e84cc25f (33 passed).
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from e84cc25 to 83fa262 Compare August 12, 2026 14:19
@dependabot
dependabot Bot deployed to test-trigger-is August 12, 2026 14:19 Active
@rugpanov

rugpanov commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ✅ all 35 test jobs passed for 83fa2620.
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from 83fa262 to 910c196 Compare August 13, 2026 09:34
@dependabot
dependabot Bot deployed to test-trigger-is August 13, 2026 09:34 Active
@rugpanov

rugpanov commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ✅ all 35 test jobs passed for 910c196a.
View run

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from 910c196 to de1847a Compare August 14, 2026 08:16
@dependabot
dependabot Bot deployed to test-trigger-is August 14, 2026 08:16 Active
@rugpanov

rugpanov commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ✅ all 35 test jobs passed for de1847ab.
View run

@dependabot
chore(deps): bump undici from 6.27.0 to 6.28.0
d7f9e1f 
Bumps [undici](https://github.com/nodejs/undici) from 6.27.0 to 6.28.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.28.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from de1847a to d7f9e1f Compare August 14, 2026 09:53
@dependabot
dependabot Bot deployed to test-trigger-is August 14, 2026 09:53 Active
@rugpanov

rugpanov commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 Integration tests ❌ 1 of 35 test jobs failed for d7f9e1f5 (34 passed).
View run

@github-actions

github-actions Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/vscode

Inputs:

  • PR number: 2076
  • Commit SHA: d7f9e1f5c11bdf217ccac17cc0d6a83dd2b9f81d

Checks will be approved automatically on success.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rugpanov