From df2984019c9dc30ac66d90f7105c0fc8f3dadcd4 Mon Sep 17 00:00:00 2001 From: rachita-17 Date: Tue, 29 Sep 2026 13:57:48 +0530 Subject: [PATCH] Pin undici 7.x to close CVE-2026-85397 override undici@7 -> ^7.29.1 (resolves to 7.30.0) Advisory published 2026-09-29 covers >= 7.28.0 < 7.29.1. The lockfile carried 7.29.0, which was outside every known range when #20 was built, so #20 left it alone. 6.x and 8.x were already pinned there and are unaffected. Co-Authored-By: Claude Opus 5 --- pnpm-lock.yaml | 9 +++++---- pnpm-workspace.yaml | 1 + 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 51eaec4318f3..cb3e4c0a43ea 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,6 +13,7 @@ overrides: baseline-browser-mapping: ^2.11.0 esbuild@>=0.27.3 <0.28.1: ^0.28.1 undici@6: ^6.28.1 + undici@7: ^7.29.1 packageExtensionsChecksum: sha256-wJryviKpT2yBHdvlJDdnwzUQ1C8SWN6MXUeQYXbrNIo= @@ -7513,8 +7514,8 @@ packages: resolution: {integrity: sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==} engines: {node: '>=18.17'} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.30.0: + resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} engines: {node: '>=20.18.1'} undici@8.11.2: @@ -9077,7 +9078,7 @@ snapshots: semver: 7.8.5 sumchecker: 3.0.1(supports-color@8.1.1) optionalDependencies: - undici: 7.29.0 + undici: 7.30.0 transitivePeerDependencies: - supports-color @@ -16019,7 +16020,7 @@ snapshots: undici@6.29.0: {} - undici@7.29.0: + undici@7.30.0: optional: true undici@8.11.2: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index b73c9177e702..754c9170672b 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -14,6 +14,7 @@ overrides: 'baseline-browser-mapping': ^2.11.0 'esbuild@>=0.27.3 <0.28.1': ^0.28.1 'undici@6': ^6.28.1 + 'undici@7': ^7.29.1 allowBuilds: '@swc/core': true