Repository navigation
Bump undici from 8.10.0 to 8.10.2 - #21
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [undici](https://github.com/nodejs/undici) from 8.10.0 to 8.10.2. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.10.0...v8.10.2) --- updated-dependencies: - dependency-name: undici dependency-version: 8.10.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
rachita-17
added a commit
that referenced
this pull request
Sep 29, 2026
e2e/package.json undici ^8.10.0 -> ^8.10.2 (resolves to 8.11.2) override undici@6 -> ^6.28.1 (resolves to 6.29.0) CVE-2026-85024 carries two ranges, >= 6.25.0 < 6.28.1 and >= 8.1.0 < 8.10.2. The lockfile holds both an 8.x line (declared in e2e/package.json) and a 6.x line pulled in transitively, so closing the alert takes a direct bump and an override. Dependabot #21 bumps only the declared 8.x dep and leaves the 6.x instance vulnerable. 7.29.0 is outside both ranges and is left alone. Supersedes #21. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
rachita-17
added a commit
that referenced
this pull request
Sep 29, 2026
…verrides (#20) * Bump google.golang.org/grpc to v1.83.2 and OpenTelemetry to v1.45.0 Applies the security bumps across all 13 Go modules in the repo. Upstream gravitational/teleport has not picked these up yet, so this diverges from upstream until it does. google.golang.org/grpc v1.82.1 / v1.83.0 -> v1.83.2 go.opentelemetry.io/otel* v1.44.0 -> v1.45.0 Closes the largest remaining block of Dependabot alerts on master: grpc CVE-2026-84445, CVE-2026-84304, CVE-2026-84303 otel advisories published 2026-09-17 CVE-2026-84445 carries two vulnerable ranges: < 1.82.2 and >= 1.83.0 < 1.83.2. v1.83.1 satisfies only the first, so v1.83.2 is required to close it. Supersedes #9, #10, #14, #15, #16, #17, #18 and #19, which bump the same dependencies one module at a time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Close remaining Dependabot alerts: ebpf, thrift, and npm overrides Go: github.com/cilium/ebpf v0.20.0 -> v0.22.0 (root, terraform, terraform-mwi) github.com/apache/thrift v0.23.0 -> v0.24.0 (root) npm, via overrides in pnpm-workspace.yaml: @xmldom/xmldom 0.8.13 -> 0.8.15 fast-uri 3.1.5 -> 3.1.8 js-yaml 3.15.1 -> 3.15.2, 4.3.1 -> 4.3.2 browserslist 4.28.2 -> 4.29.1 baseline-browser-mapping 2.10.32 -> 2.11.26 esbuild 0.27.7 -> 0.28.1 All six npm packages are transitive, so they are pinned ahead of their parents rather than bumped directly. Each override should be dropped once the parent ships the fixed version on its own. Two details worth recording: - js-yaml is split by major because the lockfile carries both 3.x and 4.x and the advisory patches them separately. - The esbuild override is range-scoped to >=0.27.3 <0.28.1. The lockfile also holds 0.25.12, which is outside the vulnerable range, and a blanket bump would move it three minors for no security benefit. Overrides live in pnpm-workspace.yaml, not package.json: pnpm 11 no longer reads the "pnpm" field in package.json and ignores it silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Close undici alerts: bump e2e direct dep and pin the 6.x transitive e2e/package.json undici ^8.10.0 -> ^8.10.2 (resolves to 8.11.2) override undici@6 -> ^6.28.1 (resolves to 6.29.0) CVE-2026-85024 carries two ranges, >= 6.25.0 < 6.28.1 and >= 8.1.0 < 8.10.2. The lockfile holds both an 8.x line (declared in e2e/package.json) and a 6.x line pulled in transitively, so closing the alert takes a direct bump and an override. Dependabot #21 bumps only the declared 8.x dep and leaves the 6.x instance vulnerable. 7.29.0 is outside both ranges and is left alone. Supersedes #21. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Author
|
Looks like undici is no longer updatable, so this is no longer needed. |
Collaborator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps undici from 8.10.0 to 8.10.2.
Release notes
Sourced from undici's releases.
... (truncated)
Commits
5e541e0Bumped v8.10.2 (#5771)eb04cc3fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs (#5738)e905b5bfix(retry): settle exposed body on terminal failure0160a71fix(retry): validate resumed response framing66e1281fix(websocket): reject unrequested subprotocols7aac7f1fix(decompress): limit decompressed response sizecb75bbbfix(cache): do not cache Set-Cookie in shared caches6d58312fix(interceptor/dump): abort oversized chunked responses8f5868ffix: preserve BalancedPool connection options2be07bffix(cache): reject unsafe method response cachingDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.