Skip to content

chore(deps): update dependency undici to v6.21.2 [security] #2829

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 15, 2025

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented May 15, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
undici (source) 6.21.1 -> 6.21.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-47279

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895


Release Notes

nodejs/undici (undici)

v6.21.2

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v6.21.1...v6.21.2


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 15, 2025
@renovate renovate bot requested a review from a team as a code owner May 15, 2025 19:29
@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 15, 2025
@github-actions github-actions bot requested review from david-luna and trentm May 15, 2025 19:29
Copy link

codecov bot commented May 15, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.64%. Comparing base (393b515) to head (099ad46).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2829      +/-   ##
==========================================
- Coverage   89.69%   89.64%   -0.05%     
==========================================
  Files         184      184              
  Lines        8966     8966              
  Branches     1835     1835              
==========================================
- Hits         8042     8038       -4     
- Misses        924      928       +4     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot force-pushed the renovate/npm-undici-vulnerability branch from bf05627 to 446baa6 Compare May 15, 2025 19:42
@renovate renovate bot force-pushed the renovate/npm-undici-vulnerability branch from 446baa6 to 099ad46 Compare May 15, 2025 20:05
@david-luna david-luna merged commit 24d8eab into main May 15, 2025
23 checks passed
@david-luna david-luna deleted the renovate/npm-undici-vulnerability branch May 15, 2025 23:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file pkg:instrumentation-undici
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants