Summary
@utxorpc/sdk pins the @connectrpc/connect* packages at 1.4, and @connectrpc/connect-node@1.x depends on undici@^5.28.4. That undici line carries a set of open advisories (HTTP request/response smuggling, Set-Cookie / CRLF injection, several WebSocket/decompression DoS issues) that are fixed only in undici@6.27.0+. Because connect-node v1 caps undici at ^5.28.x, downstream consumers cannot resolve a patched version — they're stuck on a vulnerable undici no matter what.
Impact
Any project depending on @utxorpc/sdk (directly or via @utxorpc/blaze-provider) inherits these advisories. For example, the Dolos blaze-client example (txpipe/dolos#1054) had to add an npm overrides entry forcing undici@^6.27.0 as a workaround, which crosses connect-node v1's declared ^5.28.x range.
Suggested fix
Upgrade the connect dependencies from 1.4 to 2.x:
@connectrpc/connect, @connectrpc/connect-node, @connectrpc/connect-web → ^2@connectrpc/connect-node@2.x has no runtime dependencies — it uses Node's global fetch/http2 and no longer bundles undici, so the vulnerable transitive dependency is removed entirely.
Note this is a major bump: the Connect ES v2 transport/interceptor APIs changed, so the SDK's transport-creation code will need updates. See the Connect ES v1→v2 migration notes.
Verification
After bumping, npm audit on a consumer of @utxorpc/sdk should no longer report the undici advisories, and the undici overrides workaround can be dropped downstream.
Summary
@utxorpc/sdkpins the@connectrpc/connect*packages at1.4, and@connectrpc/connect-node@1.xdepends onundici@^5.28.4. Thatundiciline carries a set of open advisories (HTTP request/response smuggling, Set-Cookie / CRLF injection, several WebSocket/decompression DoS issues) that are fixed only inundici@6.27.0+. Because connect-node v1 caps undici at^5.28.x, downstream consumers cannot resolve a patched version — they're stuck on a vulnerableundicino matter what.Impact
Any project depending on
@utxorpc/sdk(directly or via@utxorpc/blaze-provider) inherits these advisories. For example, the Dolosblaze-clientexample (txpipe/dolos#1054) had to add an npmoverridesentry forcingundici@^6.27.0as a workaround, which crosses connect-node v1's declared^5.28.xrange.Suggested fix
Upgrade the connect dependencies from
1.4to2.x:@connectrpc/connect,@connectrpc/connect-node,@connectrpc/connect-web→^2@connectrpc/connect-node@2.xhas no runtime dependencies — it uses Node's globalfetch/http2and no longer bundlesundici, so the vulnerable transitive dependency is removed entirely.Note this is a major bump: the Connect ES v2 transport/interceptor APIs changed, so the SDK's transport-creation code will need updates. See the Connect ES v1→v2 migration notes.
Verification
After bumping,
npm auditon a consumer of@utxorpc/sdkshould no longer report theundiciadvisories, and theundicioverrides workaround can be dropped downstream.