Skip to content

chore(deps): update undici to resolve vulnerabilities - #496

Merged
wrslatz merged 1 commit into
mainfrom
update-nextjs-undici
Aug 5, 2026
Merged

wrslatz merged 1 commit into
mainfrom
update-nextjs-undici

Conversation

@wrslatz

@wrslatz wrslatz commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Pull Request

Proposed Changes

Update undici to resolve audit findings

# npm audit report

undici  <=6.27.0
Severity: moderate
undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
fix available via `npm audit fix --force`
Will install undici@6.28.0, which is outside the stated dependency range
node_modules/undici

Readiness Checklist

Author/Contributor

  • If documentation is needed for this change, has that been included in this pull request
  • run npm run format and fix any formatting issues that have been introduced
  • run npm run lint and fix any linting issues that have been introduced
  • run npm run test and run tests

@wrslatz wrslatz self-assigned this Aug 4, 2026
@wrslatz
wrslatz requested review from a team as code owners August 4, 2026 01:53
@wrslatz wrslatz added dependencies Pull requests that update a dependency file maintenance vuln release labels Aug 4, 2026
@wrslatz
wrslatz enabled auto-merge August 4, 2026 01:53
@wrslatz
wrslatz disabled auto-merge August 5, 2026 23:22
@wrslatz
wrslatz force-pushed the update-nextjs-undici branch from 9475cb9 to d1d17a2 Compare August 5, 2026 23:25
@wrslatz wrslatz changed the title chore(deps): update next.js and undici to resolve vulnerabilities chore(deps): update undici to resolve vulnerabilities Aug 5, 2026
@wrslatz
wrslatz enabled auto-merge August 5, 2026 23:26
@wrslatz
wrslatz requested review from Miablo and riley-kohler August 5, 2026 23:26
@wrslatz
wrslatz merged commit 583301d into main Aug 5, 2026
13 checks passed
@wrslatz
wrslatz deleted the update-nextjs-undici branch August 5, 2026 23:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file maintenance release vuln

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants