Skip to content

build(deps): Bump undici from 6.28.0 to 6.29.0 - #357

Merged
flex-development[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/undici-6.29.0
Oct 1, 2026
Merged

flex-development[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/undici-6.29.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •

Copy link
Copy Markdown
Contributor

Bumps undici from 6.28.0 to 6.29.0.

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

@dependabot dependabot Bot added scope:dependencies dependency updates type:build changes to the build system or external dependencies labels Oct 1, 2026
@flex-development
flex-development Bot enabled auto-merge (squash) October 1, 2026 08:45
@codecov

codecov Bot commented Oct 1, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@codecov

codecov Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (2f40cd9) to head (4a5ee96).
⚠️ Report is 11 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff            @@
##              main      #357   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           42        42           
  Lines         1141      1141           
  Branches       233       233           
=========================================
  Hits          1141      1141           
Flag Coverage Δ
bun-canary 100.00% <ø> (ø)
bun-latest 100.00% <ø> (ø)
node22 100.00% <ø> (ø)
node24 100.00% <ø> (ø)
node25 100.00% <ø> (ø)
node26 100.00% <ø> (ø)
Components Coverage Δ
docmark 100.00% <ø> (ø)
docmark-factory-block 100.00% <ø> (ø)
docmark-factory-identifier 100.00% <ø> (ø)
docmark-factory-line 100.00% <ø> (ø)
docmark-factory-markers 100.00% <ø> (ø)
docmark-factory-space 100.00% <ø> (ø)
docmark-grammar 100.00% <ø> (ø)
docmark-util-combine-extensions 100.00% <ø> (ø)
docmark-util-subtokenize 100.00% <ø> (ø)
docmark-util-symbol 100.00% <ø> (ø)

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0afe9da...4a5ee96. Read the comment docs.

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.29.0 branch from 32538bd to e80a2db Compare October 1, 2026 08:52
Bumps [undici](https://github.com/nodejs/undici) from 6.28.0 to 6.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.28.0...v6.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.29.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.29.0 branch from e80a2db to 4a5ee96 Compare October 1, 2026 08:59

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

@flex-development
flex-development Bot merged commit 9676689 into main Oct 1, 2026
45 checks passed
@flex-development
flex-development Bot deleted the dependabot/npm_and_yarn/undici-6.29.0 branch October 1, 2026 09:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

scope:dependencies dependency updates type:build changes to the build system or external dependencies

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

0 participants