Skip to content

(docs deps): Bump undici from 6.27.0 to 6.28.0 - #5111

Merged
mergify[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/undici-6.28.0
Aug 5, 2026
Merged

(docs deps): Bump undici from 6.27.0 to 6.28.0#5111
mergify[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/undici-6.28.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor

Bumps undici from 6.27.0 to 6.28.0.

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • See full diff in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 5, 2026

@mergify mergify Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatic approval for Dependabot update.

@mergify mergify Bot added the queued label Aug 5, 2026
@mergify

mergify Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • Entered queue2026-08-05 17:44 UTC · Rule: default · triggered by rule Automatic merge and approval for Dependabot
  • 🟠 Checks running · on draft merge queue: checking main (6b12ad9) and #5111 together #5113
  • 🚫 Left the queue2026-08-05 17:47 UTC · at a64f0a5562c29991fc62f37f4d6de495347f1c01

This pull request spent 2 minutes 32 seconds in the queue, with no time running CI.

Waiting for
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/DotNet Format
    • check-skipped = @github-actions/DotNet Format
    • check-success = @github-actions/DotNet Format
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Release
    • check-skipped = @github-actions/Release
    • check-success = @github-actions/Release
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Build & Test (new-cli)
    • check-skipped = @github-actions/Build & Test (new-cli)
    • check-success = @github-actions/Build & Test (new-cli)
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Build & Package / macos-26
    • check-skipped = @github-actions/Build & Package / macos-26
    • check-success = @github-actions/Build & Package / macos-26
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Build & Package / ubuntu-24.04
    • check-skipped = @github-actions/Build & Package / ubuntu-24.04
    • check-success = @github-actions/Build & Package / ubuntu-24.04
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Build & Package / windows-2025-vs2026
    • check-skipped = @github-actions/Build & Package / windows-2025-vs2026
    • check-success = @github-actions/Build & Package / windows-2025-vs2026
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Test / macos-26 - net10.0
    • check-skipped = @github-actions/Test / macos-26 - net10.0
    • check-success = @github-actions/Test / macos-26 - net10.0
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Test / ubuntu-24.04 - net10.0
    • check-skipped = @github-actions/Test / ubuntu-24.04 - net10.0
    • check-success = @github-actions/Test / ubuntu-24.04 - net10.0
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @github-actions/Test / windows-2025-vs2026 - net10.0
    • check-skipped = @github-actions/Test / windows-2025-vs2026 - net10.0
    • check-success = @github-actions/Test / windows-2025-vs2026 - net10.0
  • any of: [🛡 GitHub repository ruleset rule main branch rule]
    • check-neutral = @sonarqubecloud/SonarCloud Code Analysis
    • check-skipped = @sonarqubecloud/SonarCloud Code Analysis
    • check-success = @sonarqubecloud/SonarCloud Code Analysis
All conditions
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/DotNet Format
    • check-skipped = @github-actions/DotNet Format
    • check-success = @github-actions/DotNet Format
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Release
    • check-skipped = @github-actions/Release
    • check-success = @github-actions/Release
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Build & Test (new-cli)
    • check-skipped = @github-actions/Build & Test (new-cli)
    • check-success = @github-actions/Build & Test (new-cli)
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Build & Package / macos-26
    • check-skipped = @github-actions/Build & Package / macos-26
    • check-success = @github-actions/Build & Package / macos-26
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Build & Package / ubuntu-24.04
    • check-skipped = @github-actions/Build & Package / ubuntu-24.04
    • check-success = @github-actions/Build & Package / ubuntu-24.04
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Build & Package / windows-2025-vs2026
    • check-skipped = @github-actions/Build & Package / windows-2025-vs2026
    • check-success = @github-actions/Build & Package / windows-2025-vs2026
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Test / macos-26 - net10.0
    • check-skipped = @github-actions/Test / macos-26 - net10.0
    • check-success = @github-actions/Test / macos-26 - net10.0
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Test / ubuntu-24.04 - net10.0
    • check-skipped = @github-actions/Test / ubuntu-24.04 - net10.0
    • check-success = @github-actions/Test / ubuntu-24.04 - net10.0
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @github-actions/Test / windows-2025-vs2026 - net10.0
    • check-skipped = @github-actions/Test / windows-2025-vs2026 - net10.0
    • check-success = @github-actions/Test / windows-2025-vs2026 - net10.0
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = @sonarqubecloud/SonarCloud Code Analysis
    • check-skipped = @sonarqubecloud/SonarCloud Code Analysis
    • check-success = @sonarqubecloud/SonarCloud Code Analysis
  • github-review-approved [🛡 GitHub repository ruleset rule main branch rule]
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = Mergify Merge Protections
    • check-skipped = Mergify Merge Protections
    • check-success = Mergify Merge Protections

Reason

The pull request #5111 has been manually updated

Failing checks:

Requeued — the merge queue status continues in this comment ↓.

Bumps [undici](https://github.com/nodejs/undici) from 6.27.0 to 6.28.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.28.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.28.0 branch from a64f0a5 to e31f3a4 Compare August 5, 2026 17:45
@mergify mergify Bot removed the queued label Aug 5, 2026
@sonarqubecloud

sonarqubecloud Bot commented Aug 5, 2026

Copy link
Copy Markdown

@mergify mergify Bot added the queued label Aug 5, 2026
@mergify

mergify Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • Entered queue2026-08-05 18:06 UTC · Rule: default · triggered by rule Automatic merge and approval for Dependabot
  • Checks skipped · PR is already up-to-date
  • Merged2026-08-05 18:06 UTC · at e31f3a4ef057688bf4b733538c1aaab0437e5acb · merge

This pull request spent 23 seconds in the queue, including 5 seconds running CI.

Required conditions to merge
  • github-review-approved [🛡 GitHub repository ruleset rule main branch rule]
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/DotNet Format
    • check-neutral = @github-actions/DotNet Format
    • check-skipped = @github-actions/DotNet Format
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Release
    • check-neutral = @github-actions/Release
    • check-skipped = @github-actions/Release
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Build & Test (new-cli)
    • check-neutral = @github-actions/Build & Test (new-cli)
    • check-skipped = @github-actions/Build & Test (new-cli)
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Build & Package / macos-26
    • check-neutral = @github-actions/Build & Package / macos-26
    • check-skipped = @github-actions/Build & Package / macos-26
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Build & Package / ubuntu-24.04
    • check-neutral = @github-actions/Build & Package / ubuntu-24.04
    • check-skipped = @github-actions/Build & Package / ubuntu-24.04
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Build & Package / windows-2025-vs2026
    • check-neutral = @github-actions/Build & Package / windows-2025-vs2026
    • check-skipped = @github-actions/Build & Package / windows-2025-vs2026
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Test / macos-26 - net10.0
    • check-neutral = @github-actions/Test / macos-26 - net10.0
    • check-skipped = @github-actions/Test / macos-26 - net10.0
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Test / ubuntu-24.04 - net10.0
    • check-neutral = @github-actions/Test / ubuntu-24.04 - net10.0
    • check-skipped = @github-actions/Test / ubuntu-24.04 - net10.0
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @github-actions/Test / windows-2025-vs2026 - net10.0
    • check-neutral = @github-actions/Test / windows-2025-vs2026 - net10.0
    • check-skipped = @github-actions/Test / windows-2025-vs2026 - net10.0
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-neutral = Mergify Merge Protections
    • check-skipped = Mergify Merge Protections
    • check-success = Mergify Merge Protections
  • any of [🛡 GitHub repository ruleset rule main branch rule]:
    • check-success = @sonarqubecloud/SonarCloud Code Analysis
    • check-neutral = @sonarqubecloud/SonarCloud Code Analysis
    • check-skipped = @sonarqubecloud/SonarCloud Code Analysis

@mergify
mergify Bot merged commit 5454c5b into main Aug 5, 2026
59 checks passed
@mergify
mergify Bot deleted the dependabot/npm_and_yarn/undici-6.28.0 branch August 5, 2026 18:06
@mergify mergify Bot removed the queued label Aug 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants