-
Notifications
You must be signed in to change notification settings - Fork 90
chore(deps): update dependency undici@>=6.0.0 to ^6.21.2 [security] #3432
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate-npm-undici>=6.0.0-vulnerability
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for brilliant-pasca-3e80ec canceled.
|
🚀 Performance Test ResultsTest Configuration:
Test Metrics:
📜 Logs
|
6940acd
to
3ec9b2d
Compare
3ec9b2d
to
23148f9
Compare
23148f9
to
aea5dce
Compare
53e8534
to
c2642ef
Compare
c2642ef
to
8b1c8bc
Compare
9a03252
to
93b5f3f
Compare
93b5f3f
to
e5e1809
Compare
e5e1809
to
1c2fa2f
Compare
1c2fa2f
to
031b7d2
Compare
031b7d2
to
85c3890
Compare
85c3890
to
e7ff9f7
Compare
e7ff9f7
to
23869aa
Compare
23869aa
to
3d1abcd
Compare
3d1abcd
to
e4f0455
Compare
e4f0455
to
7b87e44
Compare
7b87e44
to
8ac8f34
Compare
8ac8f34
to
0a83556
Compare
0a83556
to
dfe63db
Compare
dfe63db
to
9cd6213
Compare
9cd6213
to
2022720
Compare
2022720
to
9e727e7
Compare
9e727e7
to
d205a7e
Compare
d205a7e
to
7c82b4f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^6.21.1
->^6.21.2
GitHub Vulnerability Alerts
CVE-2025-47279
Impact
Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.
Patches
This has been patched in https://github.com/nodejs/undici/pull/4088.
Workarounds
If a webhook fails, avoid keep calling it repeatedly.
References
Reported as: https://github.com/nodejs/undici/issues/3895
Release Notes
nodejs/undici (undici@>=6.0.0)
v6.21.2
Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v6.21.1...v6.21.2
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.