Skip to content

chore(deps): update dependency undici to v8 - #1923

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/undici-8.x
Closed

chore(deps): update dependency undici to v8#1923
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/undici-8.x

Conversation

@renovate

@renovate renovate Bot commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
undici (source) >=7.28.0 <8 → <9 age confidence

Release Notes

nodejs/undici (undici)

v8.10.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

v8.9.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.7.0...v8.8.0

v8.7.0

Compare Source

What's Changed
New Contributors

Full Changelog: nodejs/undici@v8.6.0...v8.7.0

v8.6.0

Compare Source

v8.5.0

Compare Source

⚠️ Security Release

This release line addresses 8 security advisories. Most are fixed in
v8.5.0; the SOCKS5 pool-reuse issue was fixed earlier in v8.2.0.

Action required: Upgrade to undici 8.5.0 or later.

npm install undici@^8.5.0

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 8.5.0 32dbf0b3
GHSA-38rv-x7px-6hhq CVE-2026-9675 High (7.5) 8.5.0 b4c287b3
GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 8.5.0 42d49559
GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 8.2.0 a516f870
GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 8.5.0 cb105d7c
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 8.5.0 5655ea43
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 8.5.0 5655ea43
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 8.5.0 6ea54ef8

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: 32dbf0b3 websocket: limit the number of fragments in a message (also c5ed7875 handle empty fragments and stream limits)

A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.

  • Affected: applications using new WebSocket(...) or WebSocketStream
    against untrusted endpoints.
  • Workaround: none — upgrade is required.
WebSocket DoS via cumulative fragment bypass — CVE-2026-9675

GHSA-38rv-x7px-6hhq · CWE-400, CWE-770
Fix: b4c287b3 fix(websocket): enforce max payload size across fragments

Undici validated the size of individual frames but did not track cumulative size
across a fragmented message. An attacker could send many small fragments that
each pass per-frame validation but collectively exceed the configured limit,
causing memory exhaustion. This is a regression introduced in 8.1.0 (the
6.x and 7.x lines are not affected).

  • Workaround: none — upgrade is required.
TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295
Fix: 42d49559 fix: honor requestTls when proxy is SOCKS5

The ProxyAgent silently discarded the requestTls option when configured with
a SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured
parameters such as ca, cert, key, rejectUnauthorized, and servername,
falling back to the default Mozilla CA bundle. Applications relying on
certificate pinning to an internal CA were exposed to man-in-the-middle attacks.

  • Affected: ProxyAgent / Socks5ProxyAgent over SOCKS5 that rely on
    requestTls.
  • Workaround: route traffic through an HTTP-proxy ProxyAgent, where
    requestTls functions correctly.
Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734

GHSA-hm92-r4w5-c3mj · CWE-346 · Fixed in 8.2.0
Fix: a516f870 fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing (#​5041)

Socks5ProxyAgent reused a single connection pool across different origins
without verifying the pool's origin matched the requested origin. This could
route credentials and request data to unintended destinations, cause responses
from the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.

  • Affected: applications using Socks5ProxyAgent across multiple origins
    (introduced via #​4385).
  • Workaround: use a separate agent instance per origin.

Moderate severity

Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678

GHSA-pr7r-676h-xcf6 · CWE-524
Fix: cb105d7c fix(cache): trim qualified field names

The cache interceptor mishandled responses with whitespace-padded
Cache-Control directives such as private=" authorization". In shared-cache
mode this could cause authenticated data to be cached and served to other users.

  • Affected: apps using the cache interceptor in shared mode that forward
    Authorization upstream and receive non-canonical qualified directives.
  • Workaround: disable shared-cache mode for authenticated traffic, avoid
    caching authenticated responses, or add Vary: Authorization upstream.
HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

GHSA-p88m-4jfj-68fv · CWE-93
Fix: 5655ea43 fix(cookies): preserve values and parse SameSite strictly

parseSetCookie applied percent-decoding to cookie values, turning encoded
sequences like %0D%0A and %00 into literal bytes, contrary to RFC 6265 §5.4
and browser behavior. Applications forwarding parsed Set-Cookie values into
response headers were exposed to header injection, enabling session fixation,
open redirects, and cache poisoning. Introduced in 7.0.0 via
#​3789.

  • Workaround: sanitize values before forwarding — strip or reject CR, LF,
    NUL, ;, and =.

Low severity

Set-Cookie SameSite attribute downgrade — CVE-2026-11525

GHSA-g8m3-5g58-fq7m · CWE-183
Fix: 5655ea43 fix(cookies): preserve values and parse SameSite strictly

The cookie parser accepted SameSite values containing Strict, Lax, or
None as substrings rather than requiring exact matches per RFC 6265. Values
like SameSite=NoneOfYourBusiness parsed as None, and SameSite=StrictLax
parsed as Lax, silently weakening cookie security policies for apps that
forward parsed attributes.

HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733

GHSA-35p6-xmwp-9g52 · CWE-367 (TOCTOU race condition)
Fix: 6ea54ef8 fix: guard idle socket validation to skip fresh sockets, hardened by c9fbe9d2 keep idle validation on native timers (#​5397) and ac5394b8 keep idle validation on global timers (#​5407)

An attacker controlling an upstream HTTP/1.1 server could inject unsolicited
responses onto idle keep-alive sockets. On socket reuse, the injected response
was associated with a new request, delivering responses to the wrong requests.

  • Requirements: attacker-controlled/compromised upstream and active
    keep-alive reuse.
  • Workaround: disable keep-alive reuse with keepAliveTimeout: 0 on the
    Client or Pool.

Also in v8.5.0 (non-security)

v8.5.0 shipped the security fixes above alongside the following changes. These
are not security fixes — they are listed for completeness of the release. (The
two queue-poisoning hardening PRs, #​5397
and #​5407, are covered under
CVE-2026-6733 above and are not repeated here.)

  • HTTP/2: #5408 don't rewind kPendingIdx past in-flight requests · #5391 allow h2 POST request multiplexing · #5406 reap idle HTTP/2 sessions · #5410 preserve h2 queue on out-of-order completion
  • Features: #5416 add bodyMixin.textStream() · #5418 align EventSource with spec
  • Docs / CI / tests: #5413 document request header validation · #5383 absorb h2 stream timeout resets (test) · #5420 remove stale repro + lint · #5426 extend Windows CI timeout · #5427 detect available python in WPT runner

Full changelog: v8.4.1...v8.5.0.

Credits

Per-advisory credits (as recorded in each GHSA):

v8.4.1

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.4.0...v8.4.1

v8.4.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.3.0...v8.4.0

v8.3.0

Compare Source

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 13, 2026 22:22
@changeset-bot

changeset-bot Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 9db7a57

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@vercel

vercel Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nimbus-documentation Ready Ready Preview Aug 17, 2026 7:47am
nimbus-storybook Ready Ready Preview Aug 17, 2026 7:47am

Request Review

@github-actions

github-actions Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bundle Size Report

Last updated: 2026-08-17 07:45:39 UTC

Package Format Current Baseline Delta Status
@commercetools/nimbus dist 18950.9 KB 18950.9 KB +0.0% ✅ ok
@commercetools/nimbus-icons dist 4787.6 KB 4787.6 KB +0.0% ✅ ok
@commercetools/nimbus-tokens dist 408.9 KB 408.9 KB +0.0% ✅ ok

Baseline source: comment-chain

@chromatic-com

chromatic-com Bot commented Aug 13, 2026

Copy link
Copy Markdown

Important

Testing in progress…

🟢 UI Tests: 1207 tests unchanged
⏳ UI Review: Comparing 1207 stories…
Storybook icon Storybook Publish: 1207 stories published

@chromatic-com

chromatic-com Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Tip

All tests passed and all changes approved!

🟢 UI Tests: 1207 tests unchanged
🟢 UI Review: 1207 stories published -- no changes
Storybook icon Storybook Publish: 1207 stories published

@renovate
renovate Bot force-pushed the renovate/undici-8.x branch from f1d9f21 to 9db7a57 Compare August 17, 2026 07:43
@misama-ct misama-ct mentioned this pull request Aug 18, 2026
Merged
@misama-ct

misama-ct commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

Closing — same shape as #1918.

">=7.28.0 <8" → "<9" drops the >=7.28.0 security floor and removes a deliberate major cap, leaving a bare ceiling that no longer encodes why the override exists.

Consumers in this tree: jsdom@29.0.1, @chakra-ui/cli@3.36.1, @figma/code-connect@1.5.3.

Alternative if we do want undici 8: do it deliberately with the floor retained —

undici: ">=8.0.0 <9"

— after confirming jsdom@29's expected undici range, since jsdom backs our whole test:unit suite.

Root cause fixed in #1928.

@misama-ct misama-ct closed this Aug 18, 2026
@renovate

renovate Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 8.x releases. But if you manually upgrade to 8.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/undici-8.x branch August 18, 2026 07:33
ByronDWall pushed a commit that referenced this pull request Aug 18, 2026
@misama-ct @claude
ci(renovate): stop major bumps on pnpm override bands and tj-actions …
cec7e2b 
…downgrade (#1928)

Renovate opened seven dependency PRs that must never merge. Six of them
(#1917 #1918 #1919 #1920 #1923 #1924) bump pnpm override entries across a
major boundary. Those keys are selectors, not package names: "yaml@1"
means "consumers resolving to yaml v1 get this patched v1", so raising the
value to 2.9.0 forces a v2 API onto v1 consumers. Two are already red in
CI ("TypeError: expand is not a function" for brace-expansion@2 -> ^5.0.0,
and gray-matter's yaml.safeLoad.bind() for js-yaml ^3.15.0 -> ^5.0.0); the
rest are green only because CI never exercises the affected transitive
consumers -- the same blind spot that let #1904 ship the minimatch v10
break that #1913 had to revert, and which #1920 now proposes again.

Renovate also rewrites floor+cap ranges into bare caps
(immutable ">=4.3.9 <5" -> "<6", undici ">=7.28.0 <8" -> "<9"), discarding
the security floor that justified the override.

Suppress majors on override depTypes. Minor/patch still flow so floors can
be raised, and CVE remediation is unaffected because vulnerabilityAlerts
already bypasses packageRules.

Separately, #1915 proposed a tj-actions/changed-files digest "update" that
is really a 7-month downgrade: upstream never moved the floating v47 tag
past v47.0.0, so Renovate resolved our newer v47.0.6 pin backwards.
Retagging the pin comment to the exact patch restores semver comparison.
Audited all nine pinned actions; this was the only one affected.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

🤖 Type: Dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@misama-ct