chore(deps): update dependency undici to v7.18.2 - abandoned by mend-on-mend[bot] · Pull Request #34 · mend/backstage-community-plugins

mend-on-mend · 2026-01-16T05:51:02Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	`7.5.0` -> `7.18.2`

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

CVE-2026-22036 / GHSA-g9mf-h72j-4rw9

More information

Details

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodejs/undici (undici)

`v7.18.2`

Compare Source

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in #4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

`v7.18.1`

Compare Source

What's Changed

Test and Fix running without SSL by @mcollina in #4727
docs: add security warning for strictContentLength option by @mcollina in #4726
build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in #4718
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

What's Changed

chore: extract infra and encoding methods by @Uzlopak in #4523
ci: remove h2 by @Uzlopak in #4534
ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in #4535
ci: fix nightly shared library case by @Uzlopak in #4543
test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in #4528
docs: add Cache Interceptor example to README by @tawseefnabi in #4393
test: remove node20 version check by @Uzlopak in #4544
types: use MessagePort instance type in MessageEvent by @Renegade334 in #4546
ci: set write permissions on job level by @Uzlopak in #4537
lint: activate n/no-process-exit by @Uzlopak in #4548
ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in #4536
chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in #4547
feat(H2): correct CONNECT behaviour by @metcoder95 in #4541
test: fix plans by @Uzlopak in #4550
feat: add runtime feature "detection" by @Uzlopak in #4545
perf: use less promises in extractBody by @Uzlopak in #4458
fix(proxy-agent): add missing return after callback-call by @Uzlopak in #4553
fix: remove redundant line in retry-handler by @Uzlopak in #4554
ci: add no-wasm-simd option by @Uzlopak in #4533
fix: use lazyloaders for runtime feature detection by @Uzlopak in #4557
fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in #4556
http2: refactor and split tests of http2.js into multiple files by @Uzlopak in #4561
fix: dns-interceptor test should await plan to complete by @Uzlopak in #4560
chore: remove istanbul instructions by @Uzlopak in #4559
fix: keep promise chains intact by @Uzlopak in #4558
build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @dependabot[bot] in #4567
chore: remove tspl from eventsource by @Uzlopak in #4569
chore: remove tspl from fetch by @Uzlopak in #4570
feat: add getUpstream() method to BalancedPool by @mcollina in #4586
fetch: handle invalid priority values properly by @Uzlopak in #4522
ci: fix test coverage for codecov by @Uzlopak in #4520
types: optional status in Response.redirect by @gineika in #4591
docs: unix socket add-on by @FelixVaughan in #4587
build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #4601
build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @dependabot[bot] in #4600
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4603
build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @dependabot[bot] in #4604
build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #4602
build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #4598
build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @dependabot[bot] in #4599
build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #4597
fix: cacheStores types and usage in README by @lucalooz in #4605
Feat dns interceptor storage by @SuperOleg39 in #4589
docs: add crawling best practices by @Uzlopak in #4590
fix: 304 not modified reply upon revalidation did not update cache. by @daan944 in #4617
chore: use testcontext for test:infra by @Uzlopak in #4579
fetch: improve regexes in data-uri.js by @Uzlopak in #4483
perf: optimize validate http token by @PandaWorker in #4608
test: improve long-lived-abort-controller test by @Uzlopak in #4621
ci: add node.js 25 to test matrix by @shivarm in #4626
chore: use testcontext for test/utils tests by @Uzlopak in #4577
chore: remove tspl from websocket by @Uzlopak in #4568
fix(ws) onSocketClose being called multiple times by @KhafraDev in #4632
fix: prevent duplicate debug logs when multiple undici instances exist by @mcollina in #4630
chore: use testcontext for busboy tests by @Uzlopak in #4572
test: fix flaky http2-dispatcher test by @mcollina in #4633
build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @dependabot[bot] in #4635
Run the gc() in long-lived-abort-controller test by @mcollina in #4638
Do not destroy the HTTP2 stream twice in tests by @mcollina in #4637
Fix http2-dispatcher test by @mcollina in #4640
fix: fetch blob with range off-by-one error by @platypii in #4643
fix: ensure HTTP/2 sends Content-Length for empty POST requests by @mcollina in #4613
build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @dependabot[bot] in #4645
feat(#2458): WebSocket through HTTP/2 by @metcoder95 in #4540
docs(README): correct the example code for the consumption of respons… by @tenkirin in #4658
build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #4653
build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @dependabot[bot] in #4655
build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #4652
build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #4651
build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @dependabot[bot] in #4654
don't freeze urlList for opaque filtered responses by @KhafraDev in #4656
fix fd parsing unquoted attribute values by @KhafraDev in #4662
build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @dependabot[bot] in #4665
feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @SuperOleg39 in #4659
Feat/round robin pool by @FelixVaughan in #4650
Formdata ignore epilogue preamble by @KhafraDev in #4672
build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #4682
fix: snapshot url exclusion by @FelixVaughan in #4670
feat: support h2c over unix domain sockets by @chrros95 in #4690
fix(docs): remove unused TypeScript example code block by @kerolloz in #4701
feat: add deduplicate interceptor for request deduplication by @mcollina in #4679
chore: use testcontext for mock tests by @Uzlopak in #4582
fix(test): remove hardcoded folder name in client-error-stack-trace test by @mcollina in #4707

New Contributors

@gineika made their first contribution in #4591
@lucalooz made their first contribution in #4605
@SuperOleg39 made their first contribution in #4589
@daan944 made their first contribution in #4617
@PandaWorker made their first contribution in #4608
@platypii made their first contribution in #4643
@tenkirin made their first contribution in #4658
@kerolloz made their first contribution in #4701

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

`v7.16.0`

Compare Source

What's Changed

Drop npm token, use OIDC instead by @mcollina in #4447
fetch: instantiate readableStream in extractBody with sync methods by @Uzlopak in #4350
fix: remove async on [kClose] and [kDestroy], only return Promise by @Uzlopak in #4450
fetch: make consumeBody sync by @Uzlopak in #4449
perf: make client.connect() sync by @Uzlopak in #4455
fetch: remove promise in exported fetch by @Uzlopak in #4452
fix(#4451): implement http2 cookie support by @metcoder95 in #4453
test: cache store tests should properly be skipped by @Uzlopak in #4463
test: fix IPv6 skip check for test/client.js by @Uzlopak in #4466
test: remove skip check for AbortSignal.timeout, as it exists since node18 by @Uzlopak in #4464
test: investigate macos failing by @Uzlopak in #4467
test: remove obsolete < node v18 test case for http2 by @Uzlopak in #4461
perf: avoid intermediate promise on BodyReadable.dump by @Uzlopak in #4459
test: remove skip check for long-lived-abort-controller test (was flaky 10 months ago) by @Uzlopak in #4465
test: remove skip checks for existance of global available Blob and File by @Uzlopak in #4460
perf (fetch): use less promises for ReadableStream by @Uzlopak in #4457
fix: catch synchronous errors in request callbacks by @mcollina in #4443
fix: avoid instanceof MockNotMatchedError by @Uzlopak in #4474
eventsource: remove promise for #reconnect method by @Uzlopak in #4469
feat: make UndiciErrors reliable to instanceof by @Uzlopak in #4472
chore: call super() after type checks by @Uzlopak in #4475
chore: FixedQueue does not need special constructor by @Uzlopak in #4476
fix: buildAndValidateMockOptions should always get an object passed and always return an object by @Uzlopak in #4479
fix: remove unused ResponseStatusCodeError by @Uzlopak in #4473
chore: pool and dispatcherbase dont need constructor, use no array helper functions by @Uzlopak in #4477
lint: avoid unintented use of globals in code and tests, improve test for installing/overwriting globals by @Uzlopak in #4478
test: fix macos flakyness by @Uzlopak in #4468
fix: 'no-referrer-when-downgrade' in determineRequestsReferrer should return referrerURL by @Uzlopak in #4482
fix: deflake cache-fastimers-fix.js by @Uzlopak in #4491
fix: improve validation of IP addresses as trustworthy, correct ipv4 check by @Uzlopak in #4489
test (pool.js): fix flakyness of clientTtl test by @Uzlopak in #4494
test (eventsource): refactor tests for eventsource, speed them up by @Uzlopak in #4493
fix: remove useless catch in client-h1.js by @Uzlopak in #4481
test: skip flaky encoding test on macos and node20 by @Uzlopak in #4497
fix: implement proper stale-while-revalidate behavior per RFC 5861 by @mcollina in #4492
test (websocket): speed up test/websocket/issue-2679.js by @Uzlopak in #4501
webidl: fix existing and add missing buffer source converters by @Renegade334 in #4503
use real wpt test server by @KhafraDev in #4486
test: another try to fix flaky macos and node 20 by @Uzlopak in #4490
build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #4507
build(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.3 by @dependabot[bot] in #4509
fix writing to websocketstream with SharedArrayBuffer/SharedArrayBuff… by @KhafraDev in #4504
test: use faketimers for test/client-keep-alive, refactor a little by @Uzlopak in #4499
build(deps): bump github/codeql-action from 3.29.7 to 3.30.0 by @dependabot[bot] in #4510
build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in #4508
fix(h2): adjust :scheme on h2 requests by @metcoder95 in #4454
chore: use lowercase filenames, remove unused verifyVersion.js by @Uzlopak in #4514
chore: refactor workflows by @Uzlopak in #4513
chore: use [] instead of new Array(0) by @Uzlopak in #4435
change webidl attribute to bitwise flag by @KhafraDev in #4505
chore: make also cache-tests integrated as a submodule by @Uzlopak in #4517
ci: fine grained test nodejs workflow by @Uzlopak in #4516
feat: Support for capping the number of origins in Agent by @JoshMock in #4365
wpt: properly handle write permissions errors in wpt-runner setup by @Uzlopak in #4518
fetch: process content-encoding header only if relevant by @Uzlopak in #4496
websocket: always emit error event by @KhafraDev in #4521
refactor: parseHttpDate by @Uzlopak in #4421
fix: wpt should use master branch by @Uzlopak in #4524
fix: shell command built from environment values by @ptrgits in #4392
example: use metcoders https-pem for the example by @Uzlopak in #4436
Disable SIMD for PPC64 architecture, add UNDICI_NO_WASM_SIMD env to facilitate testing by @mcollina in #4530
fix: make error symbols non enumerable by @Uzlopak in #4531

New Contributors

@Renegade334 made their first contribution in #4503
@JoshMock made their first contribution in #4365
@ptrgits made their first contribution in #4392

Full Changelog: nodejs/undici@v7.15.0...v7.16.0

`v7.15.0`

Compare Source

What's Changed

feat: extract sri from fetch, upgrade to latest spec by @Uzlopak in #4307
Update WPT by @github-actions[bot] in #4422
build(deps-dev): bump @fastify/busboy from 3.1.1 to 3.2.0 by @dependabot[bot] in #4428
fix: memory leak in Agent by @hexchain in #4425
chore: remove lib/api/util.js by @Uzlopak in #3578
ci: reenable shared builtin CI tests by @richardlau in #4426
Decompression Interceptor by @FelixVaughan in #4317
chore: update llhttp by @Uzlopak in #4431
chore: remove unused exceptions in try catch blocks by @Uzlopak in #4440
types: remove type Error = unknown for diagnostic-channels by @Uzlopak in #4438
chore: avoid overriding global escape and unescape by @Uzlopak in #4437
cache : serialize Query only if needed, avoid throwing error by @Uzlopak in #4441
types: add SnapshotRecorderMode by @Uzlopak in #4442

New Contributors

@hexchain made their first contribution in #4425

Full Changelog: nodejs/undici@v7.14.0...v7.15.0

`v7.14.0`

Compare Source

What's Changed

Fix flaky snapshot-testing by @mcollina in #4367
Actually flush the file in lib/mock/snapshot-recorder.js by @mcollina in #4378
docs: clarify Node.js version support in LTS table by @mcollina in #4375
cache: fix excessive caching and some other lack of caching by @fredericDelaporte in #4335
feat(websocket): add handshake response info to undici:websocket:open diagnostic event by @tawseefnabi in #4396
feat: add install() function to type definitions by @jsaguet in #4384
build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in #4380
build(deps): bump cronometro from 4.0.3 to 5.3.0 in /benchmarks by @dependabot[bot] in #4171
build(deps): bump step-security/harden-runner from 2.12.0 to 2.13.0 by @dependabot[bot] in #4379
fix: h2 CI by @metcoder95 in #4395
feat: EventSource can be configured with reconnectionTime by @Uzlopak in #4260
build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in #4404
eventsource: deflake reconnectionTime tests by @Uzlopak in #4406
cache: change normaliseHeaders to normalizeHeaders by @Uzlopak in #4408
build(deps-dev): bump jest from 29.7.0 to 30.0.5 by @dependabot[bot] in #4387
build(deps-dev): bump cross-env from 7.0.3 to 10.0.0 by @dependabot[bot] in #4386
cache-control: no-cache: use quoted-string form by @alxndrsn in #4177
test: fix snapshot testing flaky test by @Uzlopak in #4410
fix formdata constructor args mark optional by @tsctx in #4411
Update WPT by @github-actions[bot] in #4358
Update Cache Tests by @github-actions[bot] in #4096
chore: improve imports and requires by @Uzlopak in #4418
refactor: snapshot-recorder by @Uzlopak in #4413
Update WPT by @github-actions[bot] in #4416
fix: better set a finalizer on cloned response by @tsctx in #4419

New Contributors

@tawseefnabi made their first contribution in #4396
@jsaguet made their first contribution in #4384

Full Changelog: nodejs/undici@v7.13.0...v7.14.0

`v7.13.0`

Compare Source

What's Changed

MockAgent.prototype.get support ignoreTrailingSlash option by @lisez in #4344
chore: more jsdoc and minor improvements for lib/api/readable.js, by @Uzlopak in #4351
ci: skip Node.js 20 tests on Windows by @mcollina in #4353
Update WPT by @github-actions[bot] in #4267
feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#4180) by @caitp in #4340
fix: detect and prevent redirect loops with Client/Pool by @mcollina in #4361
remove node:buffer imports by @KhafraDev in #4362
fix: remove deprecated maxRedirections option from types by @mcollina in #4363
Amend the GC warning in the README to clarify that consuming bodies is recommended but not required by @mcollina in #4364
fix(inteceptor/dump): handle preemptive network errors by @metcoder95 in #4354
feat: add SnapshotAgent for HTTP request recording and playback by @mcollina in #4270

New Contributors

@lisez made their first contribution in #4344

Full Changelog: nodejs/undici@v7.12.0...v7.13.0

`v7.12.0`

Compare Source

What's Changed

test: remove tspl on 2283 test by @Uzlopak in #4301
chore: reduce amount of intermediate functions by @Uzlopak in #4298
ci: disable shared builtin CI tests by @mcollina in #4276
webidl: remove unnecessary parameters from webidl.converters.RequestInfo and webidl.converters.RequestInit by @Uzlopak in #4304
fetch: remove await, add jsdoc for some body read functions by @Uzlopak in #4303
test: use assert and not testcontext in issue-2283.js by @Uzlopak in #4306
chore: jsdoc use @returns everywhere by @Uzlopak in #4302
chore: fix typo by @pimothyxd in #4312
build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @dependabot[bot] in #4315
feat: throw error when maxRedirections is used with undici.request() by @mcollina in #4311
Clarify the type option of the cache interceptor by @fredericDelaporte in #4299
cache: allow caching heuristically cacheable error status codes by @mcollina in #4318
chore(doc): update undici vs fetch by @styfle in #4319
don't set a finalizer on cloned request by @tsctx in #4320
websocketstream: close readablestream properly by @KhafraDev in #4322
add ping(websocket, payload) util by @KhafraDev in #4325
fix sending ping with no payload by @KhafraDev in #4329
refactor: eliminate eager llhttp promise creation by @mcollina in #4337
Fix misleading cacheByDefault documentation by @fredericDelaporte in #4338
add websocket to websocket diagnostic channels by @KhafraDev in #4321
speed up flaky websocket test by @KhafraDev in #4343
fetch: minor modifications by @Uzlopak in #4347
fetch: make readable-stream methods sync by @Uzlopak in #4346
remove creating an extra Promise just for common cleanup by @bmeck in #4339
chore: extract createDeferredPromise from fetch/utils.js by @Uzlopak in #4345

New Contributors

@pimothyxd made their first contribution in #4312
@fredericDelaporte made their first contribution in #4299
@bmeck made their first contribution in #4339

Full Changelog: nodejs/undici@v7.11.0...v7.12.0

`v7.11.0`

Compare Source

What's Changed

Update WPT by @github-actions in #4214
feat(fetch): add zstandard decompression support by @J3m5 in #4238
fix(debug): remove extra forward slash in logs by @aidant in #4236
types: EventSource short handlers can be null by @Uzlopak in #4246
remove finalizationregistry workaround by @mcollina in #4250
build(deps): bump actions/dependency-review-action from 4.5.0 to 4.7.1 by @dependabot in #4255
build(deps): bump github/codeql-action from 3.28.1 to 3.28.18 by @dependabot in #4252
build(deps): bump codecov/codecov-action from 5.1.2 to 5.4.3 by @dependabot in #4253
build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot in #4254
Query unaware interceptors cache fix by @FelixVaughan in #4240
docs: fix interceptor order description in compose method by @mcollina in #4251
chore: require node native modules with node:-prefix by @Uzlopak in #4256
fix: eventsource does not reconnect on network error by @Uzlopak in #4247
fix: add guard by @GeoffreyBooth in #4262
Extract webidl by @Uzlopak in #4259
build(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.8 by @dependabot in #4132
build(deps-dev): bump fast-check from 3.23.2 to 4.1.1 by @dependabot in #4167
build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.2 by @dependabot in #4137
build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @dependabot in #4168
build(deps): bump hendrikmuhs/ccache-action from 1.2.14 to 1.2.18 by @dependabot in #4190
build(deps): bump fastify/github-action-merge-dependabot from 3.11.0 to 3.11.1 by @dependabot in #4135
build(deps): bump step-security/harden-runner from 2.11.1 to 2.12.0 by @dependabot in #4188
build(deps-dev): bump borp from 0.19.0 to 0.20.0 by @dependabot in #4194
Fix several WPT failures by @tsctx in #4263
Update WPT by @github-actions in #4235
node.js fetch is wrongly typed (#4271) by @bpasero in #4272
Fix: Provide body on retry error, preserve socket by @fatal10110 in #4228
add cause to WebSocket error by @KhafraDev in #4274
doc: undici vs fetch by @FelixVaughan in #4245
bench: add websockets by @tsctx in #3203
webidl: remove fallback for USVString by @Uzlopak in #4264
fix: Use correct Dispatcher.RequestOptions by @IvanDimanov-OfficeRnD in #4281
feat: add install() function for global WHATWG fetch classes by @mcollina in #4286
Fixed RedirectHandler type by @rahulyadav5524 in #4278
feat(#4086): proxy keep alive by @metcoder95 in #4128
Add cleanMocks to MockClient and MockPool by @DemianParkhomenko in #4176
fetch: add missing new operator on TypeError instantiation in readAllBytes by @Uzlopak in #4297
Skip failing wpts by @mcollina in #4294
feat: add request body diagnostic channels by @legendecas in #4289
Fix timer guards to avoid TypeError under fake‐timers and polyfilled … by @1ly4s0 in [#4213](https://redi

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Signed-off-by: mend-on-mend[bot] <mend-on-mend[bot]@users.noreply.github.com>

coderabbitai · 2026-01-16T05:51:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

mend-on-mend · 2026-01-16T07:39:35Z

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

mend-on-mend · 2026-01-16T11:10:26Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

chore(deps): update dependency undici to v7.18.2

f7c2a2b

Signed-off-by: mend-on-mend[bot] <mend-on-mend[bot]@users.noreply.github.com>

mend-on-mend bot added dependencies security labels Jan 16, 2026

mend-on-mend bot changed the title ~~chore(deps): update dependency undici to v7.18.2~~ chore(deps): update dependency undici to v7.18.2 - abandoned Jan 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency undici to v7.18.2 - abandoned#34

chore(deps): update dependency undici to v7.18.2 - abandoned#34
mend-on-mend[bot] wants to merge 1 commit intomainfrom
whitesource-remediate/npm-undici-vulnerability

mend-on-mend bot commented Jan 16, 2026

Uh oh!

coderabbitai bot commented Jan 16, 2026

Review skipped

Uh oh!

mend-on-mend bot commented Jan 16, 2026

Uh oh!

mend-on-mend bot commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

mend-on-mend bot commented Jan 16, 2026

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

⚠️ Security Release

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Configuration

Uh oh!

coderabbitai bot commented Jan 16, 2026

Review skipped

Uh oh!

mend-on-mend bot commented Jan 16, 2026

Autoclosing Skipped

Uh oh!

mend-on-mend bot commented Jan 16, 2026

Edited/Blocked Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants