chore(deps): update dependency undici@<6.23.0 to v7 by renovate[bot] · Pull Request #1109 · anolilab/javascript-style-guide

renovate · 2026-08-12T12:08:22Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici@<6.23.0 (source)	`>=6.28.0` → `>=7.29.0`

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

nodejs/undici (undici@<6.23.0)

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is
an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the
earlier 7.2x line — the vulnerable single-pool code was still present through
v7.27.2. The per-origin pool fix is
3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream
against untrusted endpoints.
Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295
Fix: 04201f89 fix: honor requestTls when proxy is SOCKS5 (#5417)

The ProxyAgent silently discarded the requestTls option when configured with
a SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as ca, cert, key, rejectUnauthorized, and servername,
falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.

Affected: ProxyAgent / Socks5ProxyAgent over SOCKS5 that rely on
requestTls.
Workaround: route traffic through an HTTP-proxy ProxyAgent, where
requestTls functions correctly.

Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734

GHSA-hm92-r4w5-c3mj · CWE-346
Fix: 3805b8f8 fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#5041)

Socks5ProxyAgent reused a single connection pool across different origins
without verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.

Affected: applications using Socks5ProxyAgent across multiple origins
(introduced in 7.23.0 via #4385).
Workaround: use a separate agent instance per origin.

Moderate severity

Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678

GHSA-pr7r-676h-xcf6 · CWE-524
Fix: 85a24055 fix(cache): trim qualified field names

The cache interceptor mishandled responses with whitespace-padded
Cache-Control directives such as private=" authorization". In shared-cache
mode this could cause authenticated data to be cached and served to other users.

Affected: apps using the cache interceptor in shared mode that forward
Authorization upstream and receive non-canonical qualified directives.
Workaround: disable shared-cache mode for authenticated traffic, avoid
caching authenticated responses, or add Vary: Authorization upstream.

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

GHSA-p88m-4jfj-68fv · CWE-93
Fix: d0574cc4 fix(cookies): preserve values and parse SameSite strictly

parseSetCookie applied percent-decoding to cookie values, turning encoded
sequences like %0D%0A and %00 into literal bytes, contrary to RFC 6265 §5.4
and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via
#3789.

Workaround: sanitize values before forwarding — strip or reject CR, LF,
NUL, ;, and =.

Low severity

Set-Cookie SameSite attribute downgrade — CVE-2026-11525

GHSA-g8m3-5g58-fq7m · CWE-183
Fix: d0574cc4 fix(cookies): preserve values and parse SameSite strictly

The cookie parser accepted SameSite values containing Strict, Lax, or
None as substrings rather than requiring exact matches per RFC 6265. Values
like SameSite=NoneOfYourBusiness parsed as None, and SameSite=StrictLax
parsed as Lax, silently weakening cookie security policies for apps that
forward parsed attributes.

HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733

GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix: ea8930cf fix: guard idle socket validation to skip fresh sockets, hardened by 8e4046e4 keep idle validation on native timers (#5402) and 0fa80869 keep idle validation on global timers (#5409)

An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.

Requirements: attacker-controlled/compromised upstream and active
keep-alive reuse.
Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the
Client or Pool.

Release contents & deliberate backports

v7.28.0 is a security-only release — every change in it is one of the fixes
above, backported to the v7.x maintenance line on purpose from the v8
development line:

#5423 — backport of the WebSocket maxPayloadSize fragment-count / cumulative-size limits (CVE-2026-12151).
#5402 & #5409 — backport of the idle-validation hardening (native + global timers) for the queue-poisoning fix (CVE-2026-6733).
#5417 — requestTls over SOCKS5 fix (CVE-2026-9697).

The cookie (d0574cc4),
cache (85a24055) and
queue-poisoning core (ea8930cf)
fixes were applied directly to the v7.x branch. Full changelog:
v7.27.2...v7.28.0.

Credits

Per-advisory credits (as recorded in each GHSA):

CVE-2026-12151 — reported by @lpinca & @Nadav0077; reviewed by @UlisesGascon.
CVE-2026-9697 — reported by @tonghuaroot; reviewed by @UlisesGascon.
CVE-2026-6734 — reported by @ChALkeR; reviewed by @mcollina; verified by @UlisesGascon.
CVE-2026-9678 — fixed by @mcollina; reviewed by @UlisesGascon.
CVE-2026-9679 — reported by @tndud042713; fixed by @mcollina; reviewed by @KhafraDev & @UlisesGascon.
CVE-2026-11525 — fixed by @mcollina; reviewed by @UlisesGascon.
CVE-2026-6733 — fixed by @mcollina; verified by @UlisesGascon.

`v7.27.2`

Compare Source

What's Changed

fix: use legacy global dispatcher in v7 by @mcollina in #5368

Full Changelog: nodejs/undici@v7.27.1...v7.27.2

`v7.27.1`

Compare Source

What's Changed

fix: preserve raw headers in dispatch handler bridge by @mcollina in #5345

Full Changelog: nodejs/undici@v7.27.0...v7.27.1

`v7.27.0`

Compare Source

What's Changed

[7.x] fix: support Node 26 and legacy global dispatcher by @mcollina in #5319

Full Changelog: nodejs/undici@v7.26.0...v7.27.0

`v7.26.0`

Compare Source

What's Changed

fix: backport safe main fixes to v7.x by @mcollina in #5136
fix: validate EOF for chunked h1 responses by @mcollina in #5307

Full Changelog: nodejs/undici@v7.25.0...v7.26.0

`v7.25.0`

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.24.8...v7.25.0

`v7.24.8`

Compare Source

What's Changed

fix: backport 401 stream-backed body fix to v7.x by @mcollina in #5006

Full Changelog: nodejs/undici@v7.24.7...v7.24.8

`v7.24.7`

Compare Source

What's Changed

docs: update broken links in file "Dispatcher.md" by @samuel871211 in #4924
doc: remove unused parameter redirectionLimitReached by @samuel871211 in #4933
test: skip flaky macOS Node 20 cookie fetch cases by @mcollina in #4932
fix(types): align Response with DOM fetch types by @theamodhshetty in #4867
fix(types): Fix clone method type declaration to be an instance method rather than instance property by @mistval in #4925
test: skip IPv6 tests when IPv6 is not available by @mcollina in #4939
fix: correctly handle multi-value rawHeaders in fetch by @mcollina in #4938
ignore AGENTS.md by @mcollina in #4942

New Contributors

@samuel871211 made their first contribution in #4924
@mistval made their first contribution in #4925

Full Changelog: nodejs/undici@v7.24.6...v7.24.7

`v7.24.6`

Compare Source

What's Changed

fix(test): client wasm compatible with clang 22 by @rozzilla in #4909
fix(mock): improve error message when intercepts are exhausted by @travisbreaks in #4912
fix(websocket): support open diagnostics over h2 by @mcollina in #4921
fix: assume http/https scheme for scheme-less proxy env vars by @travisbreaks in #4914
fix(cache): check Authorization on request headers per RFC 9111 §3.5 by @metalix2 in #4911
fix: wrap kConnector call in try/catch to prevent client hang by @veeceey in #4834
docs: clarify fetch and FormData pairing by @mcollina in #4922
fix: support Connection header with connection-specific header names per RFC 7230 by @mcollina in #4775
fix: avoid prototype collisions in parseHeaders by @mcollina in #4923
build(deps-dev): bump typescript from 5.9.3 to 6.0.2 by @dependabot[bot] in #4926
test: auto-init WPT submodule by @mcollina in #4930

New Contributors

@rozzilla made their first contribution in #4909
@veeceey made their first contribution in #4834

Full Changelog: nodejs/undici@v7.24.5...v7.24.6

`v7.24.5`

Compare Source

What's Changed

Formdata tests by @KhafraDev in #4902
test: add unexpected disconnect guards to more client test files by @samayer12 in #4844
fix(cache): only apply 1-year deleteAt for immutable responses by @metalix2 in #4913

New Contributors

@metalix2 made their first contribution in #4913

Full Changelog: nodejs/undici@v7.24.4...v7.24.5

`v7.24.4`

Compare Source

What's Changed

fix(fetch): handle URL credentials in dispatch path extraction by @mcollina in #4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

`v7.24.3`

Compare Source

What's Changed

fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @hxinhan in #4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

`v7.24.2`

Compare Source

What's Changed

fix fetch path logic by @KhafraDev in #4890
remove maxDecompressedMessageSize by @KhafraDev in #4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

`v7.24.1`

Compare Source

What's Changed

fix: proto pollution by @rahulyadav5524 in #4885

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

`v7.24.0`

Compare Source

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).
GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.
GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).
GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
CRLF injection via the upgrade option.
GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.
GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
Unbounded memory consumption in WebSocket permessage-deflate decompression.

Affected and patched ranges

CVE-2026-1525: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-1528: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-2581: affected >= 7.17.0 < 7.24.0, patched 7.24.0
CVE-2026-1527: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-2229: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-1526: affected 7.0.0 < 7.24.0, patched 7.24.0

References

GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories
NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528
NVD CVE-2026-2581: https://nvd.nist.gov/vuln/detail/CVE-2026-2581
NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527
NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229
NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

`v7.23.0`

Compare Source

What's Changed

fix: prevent AbortController GC when redirect is 'error' by @mcollina in #4750
docs: clarify UndiciHeaders validation guidance by @mcollina in #4832
build(deps): bump actions/checkout from 5.0.0 to 6.0.2 by @dependabot[bot] in #4795
build(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in #4794
build(deps): bump github/codeql-action from 4.31.2 to 4.32.0 by @dependabot[bot] in #4793
test: add unexpected disconnect guards to client test files by @samayer12 in #4833
fix fetch stripping trailing ? from url by @KhafraDev in #4837
fix: forward onResponseStarted through WrapHandler and UnwrapHandler by @7rulnik in #4840
webidl: access keys in lexicographical order by @KhafraDev in #4841
ci: disable coverage on Node.js 25 by @mcollina in #4852
build(deps): bump uWebSockets.js from v20.56.0 to v20.58.0 in /benchmarks by @dependabot[bot] in #4855
fix(h2): TypeError: Cannot read properties of null (reading 'servername') in _resume when H2 stream completes by @hxinhan in #4847
fix(h2): ignore late data frames after request completion by @mcollina in #4845
fix(handler): preserve latin1 header encoding in WrapHandler by @theamodhshetty in #4859
docs(examples): add cache interceptor example with fetch by @nthbotast in #4864
docs(dispatcher): clarify onResponseStart return value is ignored by @nthbotast in #4865
feat: add SOCKS5 proxy support to ProxyAgent by @mcollina in #4385
fix: harden header iterable checks for prototype-pollution scenarios by @mcollina in #4824
fix(interceptor): preserve tuple headers in dns interceptor by @theamodhshetty in #4863
docs(dispatcher): use RFC 2606 domains in interceptor examples by @nthbotast in #4873
feat: add IP prioritization hints for HTTP/1.1 and HTTP/2 by @amyssnippet in #4831
docs: clarify when to install undici vs using Node's built-in fetch by @travisbreaks in #4868
docs(dispatcher): add cache interceptor fetch example by @nthbotast in #4870
fix(dispatcher): pass socketPath to custom connect callbacks by @theamodhshetty in #4857

New Contributors

@samayer12 made their first contribution in #4833
@7rulnik made their first contribution in #4840
@hxinhan made their first contribution in #4847
@theamodhshetty made their first contribution in #4859
@nthbotast made their first contribution in #4864
@amyssnippet made their first contribution in #4831
@travisbreaks made their first contribution in #4868

Full Changelog: nodejs/undici@v7.22.0...v7.23.0

`v7.22.0`

Compare Source

What's Changed

docs: fix syntax highlighting in WebSocket.md by @styfle in #4814
fix: use OR operator in includesCredentials per WHATWG URL Standard by @jackhax in #4816
feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk by @SuperOleg39 in #4676
fix: route WebSocket upgrades through onRequestUpgrade by @mcollina in #4787
build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by @dependabot[bot] in #4821
fix(deduplicate): do not deduplicate non-safe methods by default by @mcollina in #4818
feat: Support async cache stores in revalidation by @marcopiraccini in #4826

New Contributors

@jackhax made their first contribution in #4816
@marcopiraccini made their first contribution in #4826

Full Changelog: nodejs/undici@v7.21.0...v7.22.0

`v7.21.0`

Compare Source

What's Changed

build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by @dependabot[bot] in #4796
test: restore global dispatcher after fetch tests by @mcollina in #4790
Add missing close method to WebSocketStream interface by @piotr-cz in #4802
fix: error stream instead of canceling by @KhafraDev in #4804
Fix clientTtl cleanup race in Agent by @mcollina in #4807
feat(#4230): Implement pingInterval for dispatching PING frames by @metcoder95 in #4296
fix: handle undefined __filename in bundled environments by @mcollina in #4812
fix: set finalizer only for fetch responses by @tsctx in #4803

New Contributors

@piotr-cz made their first contribution in #4802

Full Changelog: nodejs/undici@v7.20.0...v7.21.0

`v7.20.0`

Compare Source

What's Changed

fix: preserve fetch stack traces by @mcollina in #4778
Fix error handling in MockPool example by @dave-kennedy in #4781
feat: expose statusText in request() ResponseData by @domenic in #4784
test: reduce retry-after invalid date flake by @mcollina in #4788
extractBody fixes by @KhafraDev in #4791
fix: MockAgent delayed response with AbortSignal (#4693) by @mcollina in #4772
fix: onParserTimeout potentially accessing undefined by @vbfox in #4758

New Contributors

@dave-kennedy made their first contribution in #4781
@vbfox made their first contribution in #4758

Full Changelog: nodejs/undici@v7.19.2...v7.20.0

`v7.19.2`

Compare Source

What's Changed

Minor code cleanups to decompress interceptor by @domenic in #4754
fix(h2): fix flaky stream end handling on macOS by @mcollina in #4762
return response when receiving 401 instead of network error by @KhafraDev in #4769
fix: properly close idle connections in test server cleanup by @mcollina in #4764
fix: decode HTTP headers as latin1 instead of utf8 by @mcollina in #4768
fix: submodule update by @Uzlopak in #4648
build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 by @dependabot[bot] in #4720

New Contributors

@domenic made their first contribution in #4754

Full Changelog: nodejs/undici@v7.19.1...v7.19.2

`v7.19.1`

Compare Source

What's Changed

fix: use commit hash when generating release (#4757) by @fenichelar in #4759
fix fetch 401 loop by @KhafraDev in #4761

New Contributors

@fenichelar made their first contribution in #4759

Full Changelog: nodejs/undici@v7.19.0...v7.19.1

`v7.19.0`

Compare Source

What's Changed

fix: Handle FormData body type correctly in RetryAgent retried requests by @eliotschu in #4692
feat(client): expose HTTP/2 flow-control options by @pabloelisseo in #4706
Implement origin normalization in MockAgent for case-insensitivity and URL handling by @SksOp in #4731
fix websocket basic auth by @KhafraDev in #4747
fix(cache): regenerate stream from source when cache.match is called after GC by @mcollina in #4713
chore: use testcontext for test:cache by @Uzlopak in #4571
chore: use testcontext for subresource integrity tests by @Uzlopak in #4575
feat(cache): add origins option for whitelist filtering by @mcollina in #4739
ci: test shared-builtin only on Node.js 24 and 25 by @mcollina in #4746
fix websocketstream open error by @KhafraDev in #4748

New Contributors

@eliotschu made their first contribution in #4692
@pabloelisseo made their first contribution in #4706
@SksOp made their first contribution in #4731

Full Changelog: nodejs/undici@v7.18.2...v7.19.0

`v7.18.2`

Compare Source

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in #4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

`v7.18.1`

Compare Source

What's Changed

Test and Fix running without SSL by @mcollina in #4727
docs: add security warning for strictContentLength option by @mcollina in #4726
build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in #4718
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

`v7.18.0`

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

`v7.17.0`

Compare Source

What's Changed

chore: extract infra and encoding methods by @Uzlopak in #4523
ci: remove h2 by @Uzlopak in #4534
ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in #4535
ci: fix nightly shared library case by @Uzlopak in #4543
test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in #4528
docs: add Cache Interceptor example to README by @tawseefnabi in #4393
test: remove node20 version check by @Uzlopak in #4544
types: use MessagePort instance type in MessageEvent by @Renegade334 in #4546
ci: set write permissions on job level by @Uzlopak in #4537
lint: activate n/no-process-exit by @Uzlopak in #4548
ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in #4536
chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in #4547
feat(H2): correct CONNECT behaviour by @metcoder95 in #4541
test: fix plans by @Uzlopak in #4550
feat: add runtime feature "detection" by @Uzlopak in #4545
perf: use less promises in extractBody by @Uzlopak in #4458
fix(proxy-agent): add missing return after callback-call by @Uzlopak in #4553
fix: remove redundant line in retry-handler by @Uzlopak in #4554
ci: add no-wasm-simd option by @Uzlopak in #4533
fix: use lazyloaders for runtime feature detection by @Uzlopak in #4557
fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in #4556
http2: refactor and split tests of http2.js into multiple files by @Uzlopak in #4561
fix: dns-interceptor test should await plan to complete by @Uzlopak in #4560
chore: remove istanbul instructions by @Uzlopak in #4559
fix: keep promise chains intact by @Uzlopak in #4558
build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @dependabot[bot] in #4567
chore: remove tspl from eventsource by @Uzlopak in #4569
chore: remove tspl from fetch by @Uzlopak in #4570
feat: add getUpstream() method to BalancedPool by @mcollina in #4586
fetch: handle invalid priority values properly by @Uzlopak in #4522
ci: fix test coverage for codecov by @Uzlopak in #4520
types: optional status in Response.redirect by @gineika in #4591
docs: unix socket add-on by @FelixVaughan in #4587
build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #4601
build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @dependabot[bot] in #4600
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4603
build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @dependabot[bot] in #4604
build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #4602
build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #4598
build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @dependabot[bot] in #4599
build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #4597
fix: cacheStores types and usage in README by @lucalooz in #4605
Feat dns interceptor storage by @SuperOleg39 in #4589
docs: add crawling best practices by @Uzlopak in #4590
fix: 304 not modified reply upon revalidation did not update cache. by @daan944 in #4617
chore: use testcontext for test:infra by @Uzlopak in #4579
fetch: improve regexes in data-uri.js by @Uzlopak in #4483
perf: optimize validate http token by @PandaWorker in #4608
test: improve long-lived-abort-controller test by @Uzlopak in #4621
ci: add node.js 25 to test matrix by @shivarm in #4626
chore: use testcontext for test/utils tests by @Uzlopak in #4577
chore: remove tspl from websocket by @Uzlopak in #4568
fix(ws) onSocketClose being called multiple times by @KhafraDev in #4632
fix: prevent duplicate debug logs when multiple undici instances exist by @mcollina in #4630
chore: use testcontext for busboy tests by @Uzlopak in #4572
test: fix flaky http2-dispatcher test by @mcollina in #4633
build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @dependabot[bot] in #4635
Run the gc() in long-lived-abort-controller test by @mcollina in #4638
Do not destroy the HTTP2 stream twice in tests by @mcollina in #4637
Fix http2-dispatcher test by @mcollina in #4640
fix: fetch blob with range off-by-one error by @platypii in [#4643](https://redirect.github.com/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

BREAKING CHANGE: updated dependencies to major versions

github-actions · 2026-08-12T12:08:39Z

Thank you for following the naming conventions! 🙏

chore(deps): update dependency undici@<6.23.0 to v7

b2193ba

BREAKING CHANGE: updated dependencies to major versions

renovate Bot requested a review from prisis as a code owner August 12, 2026 12:08

renovate Bot added the c: dependencies Pull requests that adds/updates a dependency label Aug 12, 2026

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update dependency undici@<6.23.0 to v7 - #1109

chore(deps): update dependency undici@<6.23.0 to v7#1109
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/undici-6.23.0-7.x

renovate Bot commented Aug 12, 2026

Uh oh!

github-actions Bot commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Aug 12, 2026

Release Notes

What's Changed

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734

Moderate severity

Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

Low severity

Set-Cookie SameSite attribute downgrade — CVE-2026-11525

HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733

Release contents & deliberate backports

Credits

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

Affected and patched ranges

References

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

⚠️ Security Release

What's Changed

What's Changed

What's Changed

What's Changed

Configuration

Uh oh!

github-actions Bot commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants