Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented May 15, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
undici (source) 6.21.1 -> 6.21.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-47279

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895


Release Notes

nodejs/undici (undici)

v6.21.2

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v6.21.1...v6.21.2


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 15, 2025
@renovate renovate bot requested a review from a team as a code owner May 15, 2025 19:29
@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 15, 2025
@github-actions github-actions bot requested review from david-luna and trentm May 15, 2025 19:29
@codecov
Copy link

codecov bot commented May 15, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.64%. Comparing base (393b515) to head (099ad46).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2829      +/-   ##
==========================================
- Coverage   89.69%   89.64%   -0.05%     
==========================================
  Files         184      184              
  Lines        8966     8966              
  Branches     1835     1835              
==========================================
- Hits         8042     8038       -4     
- Misses        924      928       +4     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot force-pushed the renovate/npm-undici-vulnerability branch from bf05627 to 446baa6 Compare May 15, 2025 19:42
@renovate renovate bot force-pushed the renovate/npm-undici-vulnerability branch from 446baa6 to 099ad46 Compare May 15, 2025 20:05
@david-luna david-luna merged commit 24d8eab into main May 15, 2025
23 checks passed
@david-luna david-luna deleted the renovate/npm-undici-vulnerability branch May 15, 2025 23:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file pkg:instrumentation-undici

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants