Skip to content

chore(deps): bump undici from 7.8.0 to 7.29.0 - #88

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/undici-7.29.0
Open

chore(deps): bump undici from 7.8.0 to 7.29.0#88
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/undici-7.29.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps undici from 7.8.0 to 7.29.0.

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98
GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89
GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8
GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

... (truncated)

Commits
  • 9e38fc1 Bumped v7.29.0 (#5590)
  • d887e34 fix: validate coerced header values for CRLF (#5579)
  • 33928bc fix: validate blob body content type
  • 98011a8 fix(cache): harden cache directive parsing
  • 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
  • 1b5a531 fix(retry): reject partial content length mismatch
  • 466e99d test: cover crash on mixed unqualified and qualified private cache directives
  • 9f10f1e fix: handle empty qualified private cache directive
  • 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
  • f9eba0a Bumped v7.28.0 (#5430)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [undici](https://github.com/nodejs/undici) from 7.8.0 to 7.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.8.0...v7.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

Size Change: 0 B

Total Size: 123 MB

ℹ️ View Unchanged
Filename Size
frontend/dist/368Hedgehogs 5.26 kB
frontend/dist/abap 14.2 kB
frontend/dist/Action 20.5 kB
frontend/dist/Actions 1.02 kB
frontend/dist/AdvancedActivityLogsScene 33.9 kB
frontend/dist/AgenticAuthorize 5.25 kB
frontend/dist/apex 3.95 kB
frontend/dist/ApprovalDetail 16.2 kB
frontend/dist/array.full.es5.js 324 kB
frontend/dist/array.full.js 420 kB
frontend/dist/array.js 176 kB
frontend/dist/AsyncMigrations 13.1 kB
frontend/dist/AuthorizationStatus 716 B
frontend/dist/azcli 846 B
frontend/dist/bat 1.84 kB
frontend/dist/BatchExportScene 70.3 kB
frontend/dist/bicep 2.55 kB
frontend/dist/Billing 493 B
frontend/dist/BillingSection 20.7 kB
frontend/dist/BoxPlot 4.99 kB
frontend/dist/browserAll-0QZMN1W2 37.4 kB
frontend/dist/ButtonPrimitives 562 B
frontend/dist/CalendarHeatMap 4.79 kB
frontend/dist/cameligo 2.19 kB
frontend/dist/changeRequestsLogic 544 B
frontend/dist/CLIAuthorize 11.3 kB
frontend/dist/CLILive 3.98 kB
frontend/dist/clojure 9.64 kB
frontend/dist/coffee 3.59 kB
frontend/dist/Cohort 23.2 kB
frontend/dist/CohortCalculationHistory 6.22 kB
frontend/dist/Cohorts 9.39 kB
frontend/dist/ConfirmOrganization 4.48 kB
frontend/dist/conversations.js 63.8 kB
frontend/dist/Coupons 720 B
frontend/dist/cpp 5.3 kB
frontend/dist/Create 655 B
frontend/dist/crisp-chat-integration.js 1.88 kB
frontend/dist/csharp 4.52 kB
frontend/dist/csp 1.42 kB
frontend/dist/css 4.51 kB
frontend/dist/cssMode 4.16 kB
frontend/dist/CustomCssScene 3.55 kB
frontend/dist/CustomerAnalyticsConfigurationScene 1.99 kB
frontend/dist/CustomerAnalyticsScene 26.4 kB
frontend/dist/CustomerJourneyBuilderScene 1.6 kB
frontend/dist/CustomerJourneyTemplatesScene 7.39 kB
frontend/dist/customizations.full.js 17.8 kB
frontend/dist/CyclotronJobInputAssignee 1.32 kB
frontend/dist/CyclotronJobInputTicketTags 711 B
frontend/dist/cypher 3.38 kB
frontend/dist/dart 4.25 kB
frontend/dist/Dashboard 1.04 kB
frontend/dist/Dashboards 14.7 kB
frontend/dist/DataManagementScene 646 B
frontend/dist/DataPipelinesNewScene 2.32 kB
frontend/dist/DataWarehouseScene 1.19 kB
frontend/dist/DataWarehouseSourceScene 634 B
frontend/dist/Deactivated 1.13 kB
frontend/dist/dead-clicks-autocapture.js 13 kB
frontend/dist/DeadLetterQueue 5.38 kB
frontend/dist/DebugScene 20 kB
frontend/dist/decompressionWorker 2.85 kB
frontend/dist/decompressionWorker.js 2.85 kB
frontend/dist/DefinitionEdit 7.11 kB
frontend/dist/DefinitionView 22.7 kB
frontend/dist/DestinationsScene 2.71 kB
frontend/dist/dist 575 B
frontend/dist/dockerfile 1.87 kB
frontend/dist/EarlyAccessFeature 719 B
frontend/dist/EarlyAccessFeatures 2.84 kB
frontend/dist/ecl 5.34 kB
frontend/dist/EditorScene 828 B
frontend/dist/elixir 10.3 kB
frontend/dist/elk.bundled 1.44 MB
frontend/dist/EmailMFAVerify 2.98 kB
frontend/dist/EndpointScene 37.1 kB
frontend/dist/EndpointsScene 21 kB
frontend/dist/ErrorTrackingConfigurationScene 2.19 kB
frontend/dist/ErrorTrackingIssueFingerprintsScene 6.98 kB
frontend/dist/ErrorTrackingIssueScene 81.8 kB
frontend/dist/ErrorTrackingScene 12.9 kB
frontend/dist/EvaluationTemplates 575 B
frontend/dist/EventsScene 2.44 kB
frontend/dist/exception-autocapture.js 11.7 kB
frontend/dist/Experiment 261 kB
frontend/dist/Experiments 17.1 kB
frontend/dist/exporter 20 MB
frontend/dist/exporter.js 20 MB
frontend/dist/ExportsScene 3.86 kB
frontend/dist/FeatureFlag 102 kB
frontend/dist/FeatureFlags 572 B
frontend/dist/FeatureFlagTemplatesScene 7.03 kB
frontend/dist/FlappyHog 5.78 kB
frontend/dist/flow9 1.81 kB
frontend/dist/freemarker2 16.7 kB
frontend/dist/fsharp 2.98 kB
frontend/dist/go 2.65 kB
frontend/dist/graphql 2.26 kB
frontend/dist/Group 14.5 kB
frontend/dist/Groups 3.92 kB
frontend/dist/GroupsNew 7.34 kB
frontend/dist/handlebars 7.34 kB
frontend/dist/hcl 3.59 kB
frontend/dist/HealthScene 12 kB
frontend/dist/HeatmapNewScene 4.16 kB
frontend/dist/HeatmapRecordingScene 3.92 kB
frontend/dist/HeatmapScene 6.04 kB
frontend/dist/HeatmapsScene 3.88 kB
frontend/dist/hls 394 kB
frontend/dist/HogFunctionScene 59 kB
frontend/dist/HogRepl 7.37 kB
frontend/dist/html 5.58 kB
frontend/dist/htmlMode 4.62 kB
frontend/dist/image-blob-reduce.esm 49.4 kB
frontend/dist/InboxScene 57.2 kB
frontend/dist/index 267 kB
frontend/dist/index.js 267 kB
frontend/dist/ini 1.1 kB
frontend/dist/InsightOptions 4.79 kB
frontend/dist/InsightScene 27 kB
frontend/dist/IntegrationsRedirect 733 B
frontend/dist/intercom-integration.js 1.93 kB
frontend/dist/InviteSignup 13.3 kB
frontend/dist/java 3.22 kB
frontend/dist/javascript 985 B
frontend/dist/jsonMode 13.9 kB
frontend/dist/julia 7.22 kB
frontend/dist/kotlin 3.4 kB
frontend/dist/lazy 151 kB
frontend/dist/LegacyPluginScene 26.6 kB
frontend/dist/LemonTextAreaMarkdown 502 B
frontend/dist/less 3.9 kB
frontend/dist/lexon 2.44 kB
frontend/dist/lib 2.22 kB
frontend/dist/Link 468 B
frontend/dist/LinkScene 24.8 kB
frontend/dist/LinksScene 4.19 kB
frontend/dist/liquid 4.52 kB
frontend/dist/LiveDebugger 19.1 kB
frontend/dist/LiveEventsTable 4.44 kB
frontend/dist/LLMAnalyticsClusterScene 15.7 kB
frontend/dist/LLMAnalyticsClustersScene 43 kB
frontend/dist/LLMAnalyticsDatasetScene 19.7 kB
frontend/dist/LLMAnalyticsDatasetsScene 3.28 kB
frontend/dist/LLMAnalyticsEvaluation 40.5 kB
frontend/dist/LLMAnalyticsEvaluationsScene 29.3 kB
frontend/dist/LLMAnalyticsPlaygroundScene 36.3 kB
frontend/dist/LLMAnalyticsScene 113 kB
frontend/dist/LLMAnalyticsSessionScene 13.4 kB
frontend/dist/LLMAnalyticsTraceScene 127 kB
frontend/dist/LLMAnalyticsUsers 526 B
frontend/dist/LLMASessionFeedbackDisplay 4.83 kB
frontend/dist/LLMPromptScene 16.9 kB
frontend/dist/LLMPromptsScene 4.21 kB
frontend/dist/Login 8.49 kB
frontend/dist/Login2FA 4.21 kB
frontend/dist/logs.js 38.3 kB
frontend/dist/LogsScene 18.7 kB
frontend/dist/lua 2.12 kB
frontend/dist/m3 2.81 kB
frontend/dist/main 819 kB
frontend/dist/ManagedMigration 14 kB
frontend/dist/markdown 3.79 kB
frontend/dist/MarketingAnalyticsScene 24.6 kB
frontend/dist/MaterializedColumns 10.2 kB
frontend/dist/Max 835 B
frontend/dist/mdx 5.39 kB
frontend/dist/MessageTemplate 16.3 kB
frontend/dist/MetricsScene 833 B
frontend/dist/mips 2.58 kB
frontend/dist/ModelsScene 13.6 kB
frontend/dist/MonacoDiffEditor 403 B
frontend/dist/monacoEditorWorker 288 kB
frontend/dist/monacoEditorWorker.js 288 kB
frontend/dist/monacoJsonWorker 419 kB
frontend/dist/monacoJsonWorker.js 419 kB
frontend/dist/monacoTsWorker 7.02 MB
frontend/dist/monacoTsWorker.js 7.02 MB
frontend/dist/MoveToPostHogCloud 4.46 kB
frontend/dist/msdax 4.91 kB
frontend/dist/mysql 11.3 kB
frontend/dist/NavTabChat 4.63 kB
frontend/dist/NewSourceWizard 758 B
frontend/dist/NewTabScene 681 B
frontend/dist/NodeDetailScene 15.5 kB
frontend/dist/NotebookCanvasScene 3.06 kB
frontend/dist/NotebookPanel 5.08 kB
frontend/dist/NotebookScene 8.07 kB
frontend/dist/NotebooksScene 7.58 kB
frontend/dist/OAuthAuthorize 573 B
frontend/dist/objective-c 2.41 kB
frontend/dist/Onboarding 671 kB
frontend/dist/OnboardingCouponRedemption 1.19 kB
frontend/dist/pascal 2.99 kB
frontend/dist/pascaligo 2 kB
frontend/dist/passkeyLogic 484 B
frontend/dist/PasswordReset 4.32 kB
frontend/dist/PasswordResetComplete 2.94 kB
frontend/dist/perl 8.25 kB
frontend/dist/PersonScene 16 kB
frontend/dist/PersonsScene 4.73 kB
frontend/dist/pgsql 13.5 kB
frontend/dist/php 8.02 kB
frontend/dist/PipelineStatusScene 6.22 kB
frontend/dist/pla 1.68 kB
frontend/dist/posthog 251 kB
frontend/dist/postiats 7.86 kB
frontend/dist/powerquery 16.9 kB
frontend/dist/powershell 3.27 kB
frontend/dist/PreflightCheck 5.53 kB
frontend/dist/product-tours.js 115 kB
frontend/dist/ProductTour 273 kB
frontend/dist/ProductTours 4.7 kB
frontend/dist/ProjectHomepage 21.9 kB
frontend/dist/protobuf 9.05 kB
frontend/dist/pug 4.82 kB
frontend/dist/python 4.76 kB
frontend/dist/qsharp 3.19 kB
frontend/dist/r 3.13 kB
frontend/dist/razor 9.35 kB
frontend/dist/recorder-v2.js 111 kB
frontend/dist/recorder.js 111 kB
frontend/dist/redis 3.55 kB
frontend/dist/redshift 11.8 kB
frontend/dist/RegionMap 29.4 kB
frontend/dist/render-query 19.7 MB
frontend/dist/render-query.js 19.7 MB
frontend/dist/ResourceTransfer 9.17 kB
frontend/dist/restructuredtext 3.9 kB
frontend/dist/RevenueAnalyticsScene 25.6 kB
frontend/dist/ruby 8.5 kB
frontend/dist/rust 4.16 kB
frontend/dist/SavedInsights 664 B
frontend/dist/sb 1.82 kB
frontend/dist/scala 7.32 kB
frontend/dist/scheme 1.77 kB
frontend/dist/scss 6.41 kB
frontend/dist/SdkDoctorScene 11 kB
frontend/dist/SessionAttributionExplorerScene 6.6 kB
frontend/dist/SessionGroupSummariesTable 4.62 kB
frontend/dist/SessionGroupSummaryScene 17 kB
frontend/dist/SessionProfileScene 15.8 kB
frontend/dist/SessionRecordingDetail 1.73 kB
frontend/dist/SessionRecordingFilePlaybackScene 4.46 kB
frontend/dist/SessionRecordings 742 B
frontend/dist/SessionRecordingsKiosk 8.84 kB
frontend/dist/SessionRecordingsPlaylistScene 4.1 kB
frontend/dist/SessionRecordingsSettingsScene 1.9 kB
frontend/dist/SessionsScene 3.86 kB
frontend/dist/SettingsScene 2.98 kB
frontend/dist/SharedMetric 15.7 kB
frontend/dist/SharedMetrics 515 B
frontend/dist/shell 3.07 kB
frontend/dist/SignupContainer 22.8 kB
frontend/dist/Site 1.18 kB
frontend/dist/solidity 18.6 kB
frontend/dist/sophia 2.76 kB
frontend/dist/SourcesScene 5.96 kB
frontend/dist/sourceWizardLogic 662 B
frontend/dist/sparql 2.55 kB
frontend/dist/sql 10.3 kB
frontend/dist/SqlVariableEditScene 7.24 kB
frontend/dist/st 7.4 kB
frontend/dist/StartupProgram 21.2 kB
frontend/dist/SupportSettingsScene 40.3 kB
frontend/dist/SupportTicketScene 22.7 kB
frontend/dist/SupportTicketsScene 733 B
frontend/dist/Survey 746 B
frontend/dist/SurveyFormBuilder 1.54 kB
frontend/dist/Surveys 18.2 kB
frontend/dist/surveys.js 89.8 kB
frontend/dist/SurveyWizard 56.1 kB
frontend/dist/swift 5.27 kB
frontend/dist/SystemStatus 16.8 kB
frontend/dist/systemverilog 7.61 kB
frontend/dist/TaskDetailScene 19 kB
frontend/dist/TaskTracker 16.3 kB
frontend/dist/tcl 3.57 kB
frontend/dist/TextCardMarkdownEditor 10.9 kB
frontend/dist/toolbar 9.47 MB
frontend/dist/toolbar.js 9.47 MB
frontend/dist/ToolbarLaunch 2.52 kB
frontend/dist/tracing-headers.js 1.74 kB
frontend/dist/TracingScene 14.7 kB
frontend/dist/TransformationsScene 1.95 kB
frontend/dist/tsMode 24 kB
frontend/dist/twig 5.97 kB
frontend/dist/TwoFactorReset 3.98 kB
frontend/dist/typescript 240 B
frontend/dist/typespec 2.82 kB
frontend/dist/Unsubscribe 1.62 kB
frontend/dist/UserInterview 4.53 kB
frontend/dist/UserInterviews 2.01 kB
frontend/dist/vb 5.79 kB
frontend/dist/VercelConnect 4.02 kB
frontend/dist/VercelLinkError 1.9 kB
frontend/dist/VerifyEmail 4.48 kB
frontend/dist/vimMode 211 kB
frontend/dist/VisualReviewRunScene 18.7 kB
frontend/dist/VisualReviewRunsScene 6.12 kB
frontend/dist/VisualReviewSettingsScene 9.95 kB
frontend/dist/web-vitals.js 6.39 kB
frontend/dist/WebAnalyticsScene 5.7 kB
frontend/dist/WebGLRenderer-DYjOwNoG 60.3 kB
frontend/dist/WebGPURenderer-B_wkl_Ja 36.3 kB
frontend/dist/WebScriptsScene 2.57 kB
frontend/dist/webworkerAll-puPV1rBA 319 B
frontend/dist/wgsl 7.34 kB
frontend/dist/Wizard 4.45 kB
frontend/dist/WorkflowScene 101 kB
frontend/dist/WorkflowsScene 46.9 kB
frontend/dist/WorldMap 4.73 kB
frontend/dist/xml 2.98 kB
frontend/dist/yaml 4.6 kB

compressed-size-action

@github-actions

Copy link
Copy Markdown

This PR hasn't seen activity in a week! Should it be merged, closed, or further worked on? If you want to keep it open, please remove the stale label – otherwise this will be closed in another week. If you want to permanently keep it open, use the waiting label.

@github-actions github-actions Bot added the stale label Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code stale

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants