[dependabot]

Bumps and undici. These dependencies needed to be updated together.
Updates undici from 7.29.1 to 7.30.2

Release notes

Sourced from undici's releases.

v7.30.2

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 7.30.1 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

In Undici 7.x, a shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

In Undici 7.x, a cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

In Undici 7.x, the redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

In Undici 7.x, a downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

Undici 7.15.0 through 7.30.1 could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

• [v7.x] fix(decompress): join a repeated content-encoding header (#5664) by @​mrityunjay-pandey in nodejs/undici#6026
• ci: fix macOS WPT (Python 3.15) and job timeout on v7.x by @​mcollina in nodejs/undici#6087
• fix(h1): backport ignore type of service errors to v7.x (#5547) by @​mcollina in nodejs/undici#6076
• [Backport v7.x] extractBody fixes 2 by @​github-actions[bot] in nodejs/undici#6093

Full Changelog: nodejs/undici@v7.30.1...v7.30.2

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

... (truncated)

Commits

• 6be5720 Bumped v7.30.2 (#6163)
• 4bca0ab test: support Node.js 20 in cache replay tests
• 520d95b docs: add v7.30.2 security release notes
• bcba54b fix(redirect): normalize tuple headers on v7
• faba415 fix(cache): adapt security fixes to v7 lifecycle
• 3df9ff5 test(cache): align redirect caching with hop policy
• 4d54152 fix(cache): detect an actual redirect, not a plain revalidation
• c363766 test(cache): cover credentialed revalidation refresh
• b790905 fix(cache): treat proxy-authorization as a credential when caching redirects
• 95a17aa test(cache): cover proxy-authorization credential on same-origin redirect
• Additional commits viewable in compare view

Updates undici from 6.28.1 to 6.29.1

Release notes

Sourced from undici's releases.

v7.30.2

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 7.30.1 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

In Undici 7.x, a shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

In Undici 7.x, a cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

In Undici 7.x, the redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

In Undici 7.x, a downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

Undici 7.15.0 through 7.30.1 could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

• [v7.x] fix(decompress): join a repeated content-encoding header (#5664) by @​mrityunjay-pandey in nodejs/undici#6026
• ci: fix macOS WPT (Python 3.15) and job timeout on v7.x by @​mcollina in nodejs/undici#6087
• fix(h1): backport ignore type of service errors to v7.x (#5547) by @​mcollina in nodejs/undici#6076
• [Backport v7.x] extractBody fixes 2 by @​github-actions[bot] in nodejs/undici#6093

Full Changelog: nodejs/undici@v7.30.1...v7.30.2

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

... (truncated)

Commits

• 6be5720 Bumped v7.30.2 (#6163)
• 4bca0ab test: support Node.js 20 in cache replay tests
• 520d95b docs: add v7.30.2 security release notes
• bcba54b fix(redirect): normalize tuple headers on v7
• faba415 fix(cache): adapt security fixes to v7 lifecycle
• 3df9ff5 test(cache): align redirect caching with hop policy
• 4d54152 fix(cache): detect an actual redirect, not a plain revalidation
• c363766 test(cache): cover credentialed revalidation refresh
• b790905 fix(cache): treat proxy-authorization as a credential when caching redirects
• 95a17aa test(cache): cover proxy-authorization credential on same-origin redirect
• Additional commits viewable in compare view

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: dc0c4005-96fc-4c0a-9daa-be685a1b68e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.23%. Comparing base (5701d66) to head (c912142).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10836   +/-   ##
=======================================
  Coverage   94.23%   94.23%           
=======================================
  Files         193      193           
  Lines       17455    17455           
  Branches      247      247           
=======================================
+ Hits        16448    16449    +1     
+ Misses        987      986    -1     
  Partials       20       20           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.

[parse-github-assistant]

I will reformat the title to use the proper commit message syntax.