chore(deps): update devdependency undici to v8 by renovate[bot] · Pull Request #562 · unjs/ofetch

renovate · 2026-04-02T10:52:05Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	`^7.16.0` → `^8.12.3`

Release Notes

nodejs/undici (undici)

`v8.12.3`

Compare Source

What's Changed

ci: use Python 3.14 for the WPT server on macOS by @mrityunjay-pandey in #6029
build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @dependabot[bot] in #6006
build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @dependabot[bot] in #5967
docs: document the options of interceptors.cache() by @qodelicious in #6050
fix(h2): replace a connection that stops responding after a stream timeout by @mcollina in #6052
fix(pool): keep caller async context for queued requests by @mcollina in #5982

New Contributors

@qodelicious made their first contribution in #6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

`v8.12.2`

Compare Source

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped `Agent` options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive `Content-Encoding` values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the `decompress` interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

Full Changelog: nodejs/undici@v8.12.1...v8.12.2

`v8.12.1`

Compare Source

What's Changed

fix: restore build:wasm npm script by @mcollina in #6009
test: add unexpected disconnect guards to http2-body-delete.js by @Kesavamoorthig06 in #5970

New Contributors

@Kesavamoorthig06 made their first contribution in #5970

Full Changelog: nodejs/undici@v8.12.0...v8.12.1

`v8.12.0`

Compare Source

What's Changed

fix(cookies): ignore a numeric expires outside the Date range by @xia-chao in #5832
fix(http2): pause bodyTimeout while applying backpressure by @jasnell in #5884
fix(cache): track cached response abort state by @mcollina in #5820
fix(deduplicate): make terminal callbacks exception-safe by @mcollina in #5838
fix(decompress): stop inflating compress and x-compress by @luantaraschi in #5665
fix(cache): evict least recently used entries in MemoryCacheStore by @jasnell in #5869
fix(eventsource): fix redirect targets in eventsource by @jasnell in #5878
fix(redirect): fix throwOnMaxRedirect edge by @jasnell in #5879
fix: normalize HTTP/2 headers for legacy dispatch handlers by @Knowzzz in #5867
fix(session cache): fix bug in tls session caching by @jasnell in #5882
docs: fix relative links broken by the README move by @v1teka in #5843
fix(redirect): add error code to max redirects error by @mcollina in #5895
fix(eventsource): fix retry wrap bug by @jasnell in #5875
fix(retry): keep request headers when resuming a download by @jasnell in #5870
fix(proxyagent): correct handling of the host header by @jasnell in #5868
fix(http1): fix handling of 204/304 responses by @jasnell in #5864
test: add unexpected disconnect guards to two more h2 tests by @zeexzeex in #5825
fix(cache): preserve 304 response event order with async stores by @marcopiraccini in #5797
fix(dns): handle a null pick, and stop failing over to an expired record by @datrixlab in #5791
fix: keep a header named proto across features by @luantaraschi in #5688
ci: exclude tests from CodeQL analysis by @mcollina in #5905
fix(pool): ensure that removed clients don't pick up requests by @jasnell in #5881
feat: Added @perseveranza-pets/milo as alternative experimental HTTP parser by @ShogunPanda in #5492
extractBody fixes 2 by @KhafraDev in #5926
reenable cachestorage wpts by @KhafraDev in #5907
fix(fetch): parse language tag in filename* parameters by @fallintoplace in #5908
fix(client): preserve tracked response header field boundaries by @ronag in #5940
fix(http1): fixup strictContentLength handling by @jasnell in #5897
feat(cache): compress big sqlite cache entries with zstd by @mcollina in #5744
fix(eventsource): enforce maxEventSize on unterminated lines by @mcollina in #5814
limit zstd window size to 8 MB by @KhafraDev in #5955
test: add unexpected disconnect guards to http2-body.js by @GhostCoder6969 in #5914
test: fix "specifiy" typo in cache interceptor test by @ump45nose in #5922
Wpt/wpt runner fixes by @KhafraDev in #5959
fix(h2): unref a session detached by GOAWAY with no open streams by @kjsik11 in #5960
feat: Throw an error when WebAssembly is not available. by @ShogunPanda in #5966
chore: Vendor milo 0.9.0. by @ShogunPanda in #5954
build(deps-dev): bump ws from 8.21.3 to 8.22.0 by @dependabot[bot] in #5968
build(deps-dev): bump undici from 6.28.0 to 6.29.0 by @dependabot[bot] in #5933
fix(typemap): .md -> .html by @avivkeller in #5602
build(deps): bump js-yaml from 4.1.1 to 4.3.2 by @dependabot[bot] in #5810
build(deps): bump brace-expansion by @dependabot[bot] in #5934
build(deps-dev): bump fast-check from 4.10.1 to 4.10.2 by @dependabot[bot] in #5921
test(fetch): settle h2 internal stream errors by @Yahiro025 in #5927
docs(errors): clarify timeout error codes and related options by @theamodhshetty in #4856
fix(interceptor): limit response error body size by @mcollina in #5942
build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #5946
build(deps): bump hendrikmuhs/ccache-action from 1.2.23 to 1.2.24 by @dependabot[bot] in #5951
build(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by @dependabot[bot] in #5952
build(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.2 by @dependabot[bot] in #5950
build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by @dependabot[bot] in #5948
build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @dependabot[bot] in #5947
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #5630
fix(http1): reset connections for no-body transfer encoding by @mcollina in #5941
fix: exclude experimental milo from node.js core bundle by @mcollina in #5935
test: re-enable HTTP/2 churn test on Node.js 26 by @mcollina in #5961
test: keep the h2c unix socket path within sun_path limits by @mcollina in #5978
fix(cache): preserve abort reasons after completion by @domenic in #5958
test: update milo paths in bundle-parser test by @mcollina in #5979
fix(cache): always treat zero-lifetime entries as stale by @mcollina in #5980
build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @dependabot[bot] in #5949
fix(websocket,eventsource): keep receive limits behind dispatcher wrappers by @jasnell in #5896
fix(http2): enforce max concurrent streams by @jasnell in #5885
docs: sync WG collaborators with nodejs/undici team by @mcollina in #5991
build(deps-dev): bump @fastify/busboy from 3.2.2 to 3.2.3 by @dependabot[bot] in #6005
fix: ignore missing release ref during cleanup by @mcollina in #5891
fix: reject unsupported FormData request bodies by @mcollina in #5913
split wpt out of npm test by @mcollina in #5588

New Contributors

@xia-chao made their first contribution in #5832
@jasnell made their first contribution in #5884
@Knowzzz made their first contribution in #5867
@v1teka made their first contribution in #5843
@datrixlab made their first contribution in #5791
@fallintoplace made their first contribution in #5908
@GhostCoder6969 made their first contribution in #5914
@ump45nose made their first contribution in #5922

Full Changelog: nodejs/undici@v8.11.2...v8.12.0

`v8.11.2`

Compare Source

What's Changed

fix: close rejected HTTP/2 WebSocket handshake streams by @mcollina in #5873
fix: avoid reconnecting aborted requests by @Junaid-PK in #5846

New Contributors

@Junaid-PK made their first contribution in #5846

Full Changelog: nodejs/undici@v8.11.1...v8.11.2

`v8.11.1`

Compare Source

What's Changed

deslopify websocket test by @KhafraDev in #5851
Revert "fix: preserve HTTP/2 for legacy fetch consumers" by @mcollina in #5860
fix websocketstream bugs by @KhafraDev in #5863
fix hang on 3xx response with large body by @KhafraDev in #5850
docs: warn about buffering response bodies by @mcollina in #5872
test: cover native fetch gzip decoding through the legacy bridge by @mcollina in #5874

Full Changelog: nodejs/undici@v8.11.0...v8.11.1

`v8.11.0`

Compare Source

What's Changed

fix: complete upgrade diagnostics lifecycle by @BridgeAR in #5761
build(deps): bump step-security/harden-runner from 2.19.4 to 2.21.0 by @dependabot[bot] in #5753
fix(decompress): join a repeated content-encoding header by @luantaraschi in #5664
fix(cookies): keep a cookie named proto in getCookies by @luantaraschi in #5663
build(deps-dev): bump jest from 30.5.0 to 30.5.1 by @dependabot[bot] in #5784
build(deps): bump got from 15.1.0 to 16.0.0 in /benchmarks by @dependabot[bot] in #5785
fix: selectively re-enable SIMD for ppc64 by @richardlau in #5776
use private fields for brand checks by @KhafraDev in #5792
fix(h2): do not unref a session with open streams by @kjsik11 in #5782
fix(h2): avoid pool fan-out during ALPN negotiation by @mcollina in #5799
fix issue #5715 by @KhafraDev in #5805
ci: extend macOS Node.js workflow timeout by @mcollina in #5775
fix(env-http-proxy-agent): NO_PROXY wildcard semantics by @mcollina in #5777
fix(h2): do not replay a request whose response already started after GOAWAY by @kjsik11 in #5788
test: skip HTTP/2 churn test on Node.js 25 on all platforms by @kjsik11 in #5790
fix(proxy-agent): preserve repeated iterable headers by @GiHoon1123 in #5779
docs(errors): document ProxyConnectionError (UND_ERR_PRX_CONN) by @kilisamemarisaaa in #5781
dataurl parsing improvements + update WPT by @KhafraDev in #5812
fix(decompress): treat inherited Object.prototype names as unsupported encodings by @NgoQuocViet2001 in #5807
test(h2): stabilize http2-connection by @ViniciusDev26 in #5801
fix: preserve HTTP/2 for non-upgrade legacy requests by @mcollina in #5811
fix: skip drain dispatch for clientTtl-evicted clients in PoolBase by @vwong in #5677
chore: update tests blocking release by @vwong in #5828
build(deps): bump uWebSockets.js from v20.68.0 to v20.70.0 in /benchmarks by @dependabot[bot] in #5824
fix(deduplicate): settle requests when composed with retry by @mcollina in #5817
fix(cache): do not report aborted on successful cache hits by @Yahiro025 in #5819
fix(cookies): keep an Expires of 0 when serializing a cookie by @NgoQuocViet2001 in #5808
fix: honor backpressure in decompression interceptor by @mcollina in #5829
fix(h2): validate h2Options.maxConcurrentStreams itself by @kjsik11 in #5830
test(fetch): make pull-dont-push exceed any socket buffer by @kjsik11 in #5840
test(decompress): wait for highWaterMark via readable instead of setImmediate loop by @kjsik11 in #5841
fix(h2): keep the session ref'd while requests are queued by @kjsik11 in #5839
fix cache.addAll and cache.add hanging by @KhafraDev in #5844
fix(retry): settle responses after connection close by @mcollina in #5815
fix(h2): validate response content-length by @mcollina in #5816
fix(redirect): ignore informational responses in history by @mcollina in #5813
fix(websocket): reset the compressed flag when a message completes by @askalf in #5827
fix(h2): keep queued requests alive when the last stream closes by @kjsik11 in #5847
build(deps-dev): bump jest from 30.5.1 to 30.5.2 by @dependabot[bot] in #5854
build(deps-dev): bump fast-check from 4.9.0 to 4.10.1 by @dependabot[bot] in #5852
build(deps): bump uWebSockets.js from v20.70.0 to v20.71.0 in /benchmarks by @dependabot[bot] in #5856
build(deps-dev): bump @metcoder95/https-pem from 1.0.0 to 1.0.1 by @dependabot[bot] in #5853

New Contributors

@luantaraschi made their first contribution in #5664
@kilisamemarisaaa made their first contribution in #5781
@NgoQuocViet2001 made their first contribution in #5807
@ViniciusDev26 made their first contribution in #5801
@vwong made their first contribution in #5677
@Yahiro025 made their first contribution in #5819
@askalf made their first contribution in #5827

Full Changelog: nodejs/undici@v8.10.2...v8.11.0

`v8.10.2`

Compare Source

⚠️ Security fixes

High severity

GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #5653
build(deps-dev): bump jest from 30.4.2 to 30.5.0 by @dependabot[bot] in #5750
build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 by @dependabot[bot] in #5752
build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 by @dependabot[bot] in #5754
test(h2): cover stream reset with NGHTTP2_INTERNAL_ERROR by @zeexzeex in #5725
fix(retry): reject invalid resumed responses by @mcollina in #5724
test: make stale-while-revalidate cache update test deterministic by @mcollina in #5722
fix: avoid unbounded recursion in Set-Cookie attribute parser by @mcollina in #5757
fix: honor SOCKS5 connection timeout by @mcollina in #5733
fix(eventsource): validate Last-Event-ID on reconnect by @mcollina in #5746
fix: avoid duplicate release attempts by @mcollina in #5745
fix(cache): refetch when 304 adds vary fields by @mcollina in #5732
types: expose PendingInterceptor and PendingInterceptorsFormatter on the MockAgent namespace by @RaphaelFakhri in #5721
ci(codeql): align CodeQL action versions to v4.37.9 by @mcollina in #5759
build(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 by @dependabot[bot] in #5760
fix(proxy-agent): guard Proxy-Authorization in iterable header containers by @mcollina in #5758
docs: name the parameters these two blocks describe by @darkdi in #5735
fix(websocket): fail the connection on a non-200 h2 extended CONNECT response by @kjsik11 in #5751
test(node-fetch): re-enable the set-cookie header combining test by @pacocartones in #5730
fix(retry): forward rawHeaders writes through RetryController by @official-burak in #5727
fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs by @kjsik11 in #5738

New Contributors

@darkdi made their first contribution in #5735
@kjsik11 made their first contribution in #5751
@official-burak made their first contribution in #5727

Full Changelog: nodejs/undici@v8.10.1...v8.10.2

`v8.10.1`

Compare Source

What's Changed

fix(mock): re-invoke reply callback for persistent mocks by @mcollina in #5650
fix: preserve MockAgent interceptors for legacy global fetch by @pacocartones in #5648
ci: align codeql-action autobuild and analyze with init at v4.37.3 by @ostapondo in #5655
ci: test against the current Node.js nightly major by @ostapondo in #5654
ci: only accept a numeric nightly major by @ostapondo in #5657
test: complete the h2 settings round-trip before asserting single-session multiplexing by @ostapondo in #5656
fix: propagate dispatcher origin to composed interceptors by @jibin7jose in #5624
fix: limit EventSource event size by @mcollina in #5552
build(deps-dev): bump ws from 8.21.1 to 8.21.3 by @dependabot[bot] in #5678
fix(retry): honor the retryAfter option in the default retry strategy by @codeAnqiang-ma in #5683
fix(interceptor/dump): reject aborted requests when response is smaller than maxSize by @codeAnqiang-ma in #5685
test: add unexpected disconnect guards to remaining http2 tests by @zeexzeex in #5686
test: harden http2-request-never-settles against late session errors by @pacocartones in #5674
fix(test): skip cache-tests when submodule is missing by @edenbuilds in #5661
fix(retry): honor the abort signal during the retry backoff by @pacocartones in #5675
fix(deduplicate): settle the deduplicated request when it is aborted by @pacocartones in #5673
build(deps-dev): bump esbuild from 0.28.1 to 0.28.2 by @dependabot[bot] in #5698
build(deps-dev): bump @fastify/busboy from 3.2.0 to 3.2.1 by @dependabot[bot] in #5697
fix: accept a negative Set-Cookie Max-Age attribute by @arshsmith1 in #5571
fix(h2): honour maxResponseSize by @ondraulehla in #5676
test: stabilize HTTP/2 timeout tests by @mcollina in #5689
fix: forward onBodySent/onRequestSent through interceptor handlers by @adarshx01 in #5696
perf(h1): drop idle-socket timer floor with a ref'd setImmediate by @anonrig in #5707
perf(fetch): skip empty RequestInit work by @anonrig in #5701
fix: propagate dispatcher options to base class by @mcollina in #5687
fix(env-http-proxy-agent): ignore trailing dots when matching no_proxy by @pacocartones in #5637
build(deps-dev): bump @fastify/busboy from 3.2.1 to 3.2.2 by @dependabot[bot] in #5718
build(deps): bump brace-expansion by @dependabot[bot] in #5719
fix(socks5-proxy-agent): destroy socket when negotiation times out by @abhijeet117 in #5709
fix(cache): evict entries when a key holds a single entry by @mcollina in #5737
test: restore /xhr to the WPT filter by @RaphaelFakhri in #5723
fix(h2): forward 1xx informational responses to onInfo by @pacocartones in #5712
fix(agent): preserve pools with pending GOAWAY replays by @mcollina in #5740
test: skip HTTP/2 churn test on Node.js 26 by @mcollina in #5742

New Contributors

@ostapondo made their first contribution in #5655
@jibin7jose made their first contribution in #5624
@codeAnqiang-ma made their first contribution in #5683
@zeexzeex made their first contribution in #5686
@edenbuilds made their first contribution in #5661
@arshsmith1 made their first contribution in #5571
@ondraulehla made their first contribution in #5676
@adarshx01 made their first contribution in #5696
@abhijeet117 made their first contribution in #5709
@RaphaelFakhri made their first contribution in #5723

Full Changelog: nodejs/undici@v8.10.0...v8.10.1

`v8.10.0`

Compare Source

What's Changed

feat: namespace h2 options by @metcoder95 in #5498
test: update WPT expectations by @mcollina in #5587
test: add cache/dedupe + dns re-dispatch integration tests by @GiHoon1123 in #5535
fix(websocket): support process.unref by @mcollina in #5578
fix(h2): ensure every request settles by @mcollina in #5603
fix(readable): consume a body whose end has already been emitted by @marko1olo in #5617
fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by @marko1olo in #5610
fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by @marceli1404 in #5606
fix(env-http-proxy-agent): match bare IPv6 addresses in no_proxy by @marko1olo in #5623
test: handle aggregate balanced pool errors by @marko1olo in #5377
fix(readable): keep body bytes that arrive after setEncoding() by @mcollina in #5620
fix(socks5): evict unused origin pools by @Kkartik14 in #5595
fix: skip deduplication for upgrade requests by @Ram-blip in #5593
fix(retry): forward informational responses by @mcollina in #5625
fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by @marko1olo in #5619
fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by @marko1olo in #5628
build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #5633
build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by @dependabot[bot] in #5634
build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #5636
fix(mock): emit request body lifecycle hooks by @marko1olo in #5367
fix(h2): detach upgrade close handler after GOAWAY by @pacocartones in #5641

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-09-22T23:54:39Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: c3cb9b25-0026-4512-8273-49b9a1a2ba6c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

renovate Bot force-pushed the renovate/undici-8.x branch 2 times, most recently from 0dfd7fa to 5dd2b80 Compare April 4, 2026 10:07

renovate Bot force-pushed the renovate/undici-8.x branch 2 times, most recently from 64005ac to edd4c1b Compare April 13, 2026 15:58

renovate Bot force-pushed the renovate/undici-8.x branch from edd4c1b to 959f7bb Compare May 1, 2026 23:27

renovate Bot force-pushed the renovate/undici-8.x branch from 959f7bb to 26670fd Compare May 14, 2026 19:28

renovate Bot force-pushed the renovate/undici-8.x branch from 26670fd to cbf28f0 Compare May 22, 2026 17:29

renovate Bot force-pushed the renovate/undici-8.x branch 3 times, most recently from bc3d084 to 58a763a Compare June 11, 2026 22:07

renovate Bot force-pushed the renovate/undici-8.x branch from 58a763a to e0f9fae Compare June 18, 2026 17:41

renovate Bot force-pushed the renovate/undici-8.x branch from e0f9fae to ae621b2 Compare June 28, 2026 09:16

renovate Bot force-pushed the renovate/undici-8.x branch 3 times, most recently from cfd442d to 041cfdb Compare July 8, 2026 09:54

renovate Bot force-pushed the renovate/undici-8.x branch 4 times, most recently from 089ee12 to e3c4458 Compare July 27, 2026 16:15

renovate Bot force-pushed the renovate/undici-8.x branch from e3c4458 to 5612614 Compare August 6, 2026 16:08

renovate Bot force-pushed the renovate/undici-8.x branch from 5612614 to a7e49fc Compare August 26, 2026 09:57

renovate Bot force-pushed the renovate/undici-8.x branch 3 times, most recently from 04491bd to 9a84aee Compare September 7, 2026 20:03

renovate Bot force-pushed the renovate/undici-8.x branch from 9a84aee to c6d72c5 Compare September 22, 2026 23:54

renovate Bot force-pushed the renovate/undici-8.x branch 3 times, most recently from 8e79db1 to b47f876 Compare September 27, 2026 12:31

renovate Bot force-pushed the renovate/undici-8.x branch from b47f876 to 93d7f2a Compare October 17, 2026 12:22

renovate Bot force-pushed the renovate/undici-8.x branch 2 times, most recently from e4dd43c to 56716b1 Compare October 20, 2026 16:08

chore(deps): update devdependency undici to v8

fe708ac

renovate Bot force-pushed the renovate/undici-8.x branch from 56716b1 to fe708ac Compare October 22, 2026 17:14

Navigation Menu

Repository navigation

chore(deps): update devdependency undici to v8 - #562

chore(deps): update devdependency undici to v8#562
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/undici-8.x

renovate Bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 22, 2026 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

TLS certificate validation bypass through dropped Agent options

Cache poisoning and cross-user disclosure through cross-origin redirects

Denial of service through excessive Content-Encoding values

Medium severity

Denial of service through the decompress interceptor

Subresource Integrity bypass with non-lowercase algorithm tokens

Denial of service through unbounded EventSource parser state

Denial of service through unbounded automatic WebSocket PONG buffering

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

⚠️ Security fixes

High severity

Medium severity

Low severity

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Configuration

Uh oh!

coderabbitai Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 2, 2026 •

edited

Loading

TLS certificate validation bypass through dropped `Agent` options

Denial of service through excessive `Content-Encoding` values

Denial of service through the `decompress` interceptor

coderabbitai Bot commented Sep 22, 2026 •

edited

Loading