Repository navigation
refactor: Bump undici from 6.27.0 to 6.29.1 and 7.28.0 to 7.30.1 - #226
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update undici lock entries package-lock.json |
The nested and top-level undici entries use updated versions, tarball URLs, and integrity hashes. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Severity of issue fixed: High
Merge Risk: 
afaf3
-
No actionable merge-blocking risk was identified in these dependency-only lockfile updates.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed prefix "refactor:" and uses a capitalized first word. It accurately describes the undici dependency updates in the lockfile. Linked Issues check Issue #223requires both lock-file versions to change together and to incorporate the fixes inundici7.30.1 and 6.29.1. The PR changesnode_modules/undicifrom 7.28.0 to 7.30.1 and `node_modules/…Out of Scope Changes check The whole-PR diff changes only the two requested undicientries inpackage-lock.json. No unrelated source, dependency, or configuration changes are present. The lock-file metadata changes directly…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Security Check PASS: The pull request changes only six lockfile fields for undici. It upgrades the direct development copy from 7.28.0 to 7.30.1 and the@actions/http-clientdevelopment copy from 6.27.0 to 6.29.…Engage In Review Feedback The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, no review feedback required engagement, implementation, or discussion. Full details: Linked Issues check
-
Explanation
Issue
#223requires both lock-file versions to change together and to incorporate the fixes inundici7.30.1 and 6.29.1. The PR changesnode_modules/undicifrom 7.28.0 to 7.30.1 andnode_modules/@actions/http-client/node_modules/undicifrom 6.27.0 to 6.29.1. The entries remain development-only and include updated registry URLs and integrity hashes. The target releases provide the required upstream security fixes. Issue#5663is closed and supplies no requirements.
Full details: Out of Scope Changes check
-
Explanation
The whole-PR diff changes only the two requested
undicientries inpackage-lock.json. No unrelated source, dependency, or configuration changes are present. The lock-file metadata changes directly support Issue#223.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: Security Check
-
Explanation
PASS: The pull request changes only six lockfile fields for
undici. It upgrades the direct development copy from 7.28.0 to 7.30.1 and the@actions/http-clientdevelopment copy from 6.27.0 to 6.29.1, with registry integrity hashes. No application code or production dependency changes are present. The unchangednpm-bundled 6.26.0 copy is pre-existing and also marked development-only; it is not introduced by this pull request.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #226 +/- ##
=======================================
Coverage 95.87% 95.87%
=======================================
Files 23 23
Lines 849 849
=======================================
Hits 814 814
Misses 35 35 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Closes #223
Lock-file-only update of the two
undicientries in the dependency tree. Both are development-only (npm ls undici --omit=devis empty):node_modules/undici7.28.0 → 7.30.1, used by@semantic-release/github(^7.0.0)node_modules/@actions/http-client/node_modules/undici6.27.0 → 6.29.1, used by@semantic-release/npm→@actions/core→@actions/http-client(^6.23.0)The copy bundled inside
npm(node_modules/npm/node_modules/undici6.26.0, via@semantic-release/npm→npm→node-gyp) is part of thenpmpackage and cannot be changed through the lock file.Security
This resolves these open Dependabot alerts (all development scope) for the 7.x copy:
For the 6.x copy under
@actions/http-client, it moves out of the vulnerable range (< 6.28.0) of GHSA-v3r7-h72x-cjcm, GHSA-8xcm-r25x-g524 and GHSA-m8rv-5g2x-5cg5. These three alerts, and the< 6.27.0alerts GHSA-g8m3-5g58-fq7m, GHSA-35p6-xmwp-9g52 and GHSA-p88m-4jfj-68fv, still match thenpm-bundled undici 6.26.0. They stay open until a newernpmrelease bundles a patched undici.Changes
undici 7.28.0 → 7.30.1
privateCache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crashtypeproperty on a blob-like HTTP/1.1 request body could inject CRLF sequences into thecontent-typeheader=in qualifiedno-cacheandprivatedirectives could bypass shared-cache restrictionsContent-Lengthafter resuming a partial responsedomainandunparsedvalues passed tosetCookie()could inject cookie attributesInvalidArgumentError(fix: validate coerced header values for CRLF nodejs/undici#5579)BalancedPoolcould drop function-valued connection options, including custom TLS certificate validation callbacksTypeErrorWebSocketStreamclose could create an unobserved rejected promiseSet-CookiemaxSizeoption and limited each decompression stage to 64 MiB by default. 7.30.0 reverted that default (see below)headersTimeout(fix(h2): honour headersTimeout nodejs/undici#5604)setImmediate([v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) nodejs/undici#5769)maxSizedefault back to0(no limit).maxSizeremains an opt-in per-stage limit. 7.30.1 therefore applies no default decompression limit, the same as 7.28.0Agentdropped function-valued TLS options such ascheckServerIdentitycompose(redirect(), cache())Content-Encodingvalues could crash the processdecompressinterceptor could escape as uncaught exceptionseventSource: { maxEventSize }to configure the EventSource parser limits added for GHSA-4qv8-2p9j-2685. The default isbuffer.kStringMaxLength, and0disables the limitsundici 6.27.0 → 6.29.1
typeproperty on a blob-like HTTP/1.1 request body could inject CRLF sequences into thecontent-typeheaderContent-Lengthafter resuming a partial responsedomainandunparsedvalues passed tosetCookie()could inject cookie attributesInvalidArgumentError(fix: validate coerced header values for CRLF nodejs/undici#5579)TypeErrorsetImmediate([v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) nodejs/undici#5770)Agentdropped function-valued TLS options such ascheckServerIdentityContent-Encodingvalues could crash the processeventSource: { maxEventSize }to configure the EventSource parser limits added for GHSA-4qv8-2p9j-2685. The default isbuffer.kStringMaxLength, and0disables the limitsBreaking Changes
None
Code Changes Required
None. The upgrade is a drop-in replacement. The parent packages use only
ProxyAgentandfetch(with adispatcheroption) from undici. Neither API changed in these releases. The other behavior changes listed above do not affect the parents either:maxSizechanges do not apply.maxEventSizeoption does not apply.fetch/HeadersandProxyAgent, so the coerced-header validation does not apply. Both target versions declare the sameengines.nodeas the current versions:>=20.18.1for 7.x and>=18.17for 6.x.