Repository navigation
refactor: Bump undici from 6.27.0 to 6.29.1 and 7.28.0 to 7.30.1 - #436
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update locked undici versions package-lock.json |
The nested undici 6.x entry changes to 6.29.1. The top-level undici entry changes to 7.30.1. Both entries receive updated resolved URLs and integrity hashes. |
Priority:
Estimated code review effort: 2 (Simple) | ~8 minutes
Severity of issue fixed: High
Merge Risk: 
9c920
-
No actionable merge-blocking risk remains from the reviewed changes.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed prefix "refactor:" and uses a capitalized first letter in "Bump." It accurately describes the undici dependency updates. Linked Issues check Issue #433requires both lock entries to update together. The reviewed diff updatesnode_modules/@actions/http-client/node_modules/undicifrom 6.27.0 to 6.29.1 andnode_modules/undicifrom 7.28.0 …Out of Scope Changes check The reviewed diff changes only the two undicilock entries required by issue#433, including their resolved URLs and integrity hashes. No unrelated file or dependency change is present.Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Security Check The pull request changes only package-lock.json. It updates the two direct lock entries fromundici6.27.0 to 6.29.1 and from 7.28.0 to 7.30.1, with matching registry URLs and integrity hashes. Bo…Engage In Review Feedback No review feedback comments or actionable findings were supplied. Therefore, there was no feedback requiring discussion, implementation, or reviewer agreement. Full details: Linked Issues check
-
Explanation
Issue
#433requires both lock entries to update together. The reviewed diff updatesnode_modules/@actions/http-client/node_modules/undicifrom 6.27.0 to 6.29.1 andnode_modules/undicifrom 7.28.0 to 7.30.1. It also updates each registry URL and integrity hash. These package versions incorporate the required release security fixes, including TLS validation protection, cache protection, process-crash fixes, and resource-bound protections. No source-code change is required for this lockfile-only dependency update.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: Security Check
-
Explanation
The pull request changes only
package-lock.json. It updates the two direct lock entries fromundici6.27.0 to 6.29.1 and from 7.28.0 to 7.30.1, with matching registry URLs and integrity hashes. Both entries remain development-only. No application code or new security-sensitive pattern was introduced.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #436 +/- ##
=======================================
Coverage 46.54% 46.54%
=======================================
Files 106 106
Lines 6196 6196
Branches 950 950
=======================================
Hits 2884 2884
Misses 3004 3004
Partials 308 308 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Closes #433
Updates the two
undicilock entries that can be updated.undiciis a transitive, development-only dependency ofsemantic-releaseand is only used by the release workflow (release-automated.yml, Node 22). The PR CI does not install npm dependencies.node_modules/@actions/http-client/node_modules/undici@semantic-release/npm→@actions/core→@actions/http-client4.0.0 (^6.23.0)node_modules/undici@semantic-release/github12.0.6 (^7.0.0)The copy bundled inside
npm(node_modules/npm/node_modules/undici6.27.0, used by npm's ownnode-gyp) ships inside thenpmpackage tarball and cannot be changed through the lock file.Changes
undici 7.x
7.29.0: Security fixes:
privateCache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crashcontent-typeheader through thetypeproperty of a blob-like request body=in qualifiedno-cacheandprivatedirectives could bypass shared-cache restrictionsContent-Lengthafter resuming a partial responsedomainandunparsedvalues passed tosetCookie()Fixes (not listed in the upstream release notes):
InvalidArgumentError7.29.1: Security fixes:
BalancedPooldropped function-valued connection options, including custom TLS certificate validation callbacksTypeErrorwhen a WebSocket server selects a subprotocol that was not requestedWebSocketStreamcloseSet-CookiemaxSize(7.30.0 changes this default back to no limit, see below)Fixes and performance:
headersTimeout(fix(h2): honour headersTimeout nodejs/undici#5604)setImmediate([v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) nodejs/undici#5769)7.30.0:
maxSizefrom 64 MiB to0(no limit) and now acceptsmaxSize: 0, so the 64 MiB default from 7.29.1 no longer applies at 7.30.1 (not listed in the upstream release notes)7.30.1: Security fixes:
Agentdropped function-valued TLS options such ascheckServerIdentitycompose(redirect(), cache())Content-EncodingvaluesdecompressinterceptoreventSource: { maxEventSize }Fixes:
undici 6.x
setImmediate([v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) nodejs/undici#5770)eventSource: { maxEventSize }Breaking Changes
None
Code Changes Required
None. The upgrade is a drop-in replacement. Both target versions keep the Node requirements of the installed versions (7.x
>=20.18.1, 6.x>=18.17), and the release workflow runs on Node 22.@semantic-release/githubuses undici'sfetchfor GitHub API requests andProxyAgentonly when a proxy is configured;@actions/http-clientuses onlyProxyAgent, also only with a proxy. None of the changed interceptor (cache, decompress, retry, dump), cookie, WebSocket or EventSource APIs are used. The changes not listed in the upstream release notes do not affect them either: neither parent uses undici interceptors, so the decompressmaxSizedefault does not apply;fetchrequest headers are already validated by theHeadersclass; theProxyAgenttokenset by@actions/http-clientis a plain string; and the neweventSourceoption is opt-in.Security Alerts
This resolves the open
undici7.x alerts (< 7.29.0and< 7.29.1). The 6.x alerts for GHSA-m8rv-5g2x-5cg5, GHSA-8xcm-r25x-g524 and GHSA-v3r7-h72x-cjcm (< 6.28.0) are fixed for the@actions/http-clientcopy, but may stay open because of the copy bundled innpm11.18.0, which can only be updated through a newernpmrelease.Summary by CodeRabbit