Repository navigation
fix(deps): bump jsdom's undici from 8.10.0 to 8.11.2 - #2
Merged
Merged
Conversation
Closes the seven open Dependabot alerts against undici 8.x (three high: TLS validation bypass in BalancedPool, cross-origin cache poisoning, plus cookie disclosure, retry-handler DoS and response-splitting). undici is a dev-only dependency pulled in by jsdom (^8.9.0), so this is an in-range lockfile update. Receipts for the three scenarios that pin package-lock.json are refreshed; no source file changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status: LGTM. CI is green on this exact tree.
What was wrong:
jsdom@30(a dev dependency) resolvedundici@8.10.0, which has 7 open Dependabot alerts: #4, #6, #7, #8, #11, #12 and #13. Three of them are high severity: a TLS validation bypass in BalancedPool, cross-origin cache poisoning, and cookie disclosure through shared caches. Dependabot's grouped PR (#1) fixed only the separateundici@7copy under miniflare.How it was fixed: an in-range lockfile update (
npm update undici) to 8.11.2. jsdom declares^8.9.0, sopackage.jsonis unchanged. The SHA-256 receipts inscripts/quality-dependencies.jsonfor the three endocrine scenarios that listpackage-lock.jsonas evidence are refreshed. No source file changed.Proof:
npm ls undiciresolves tojsdom → undici@8.11.2andminiflare → undici@7.29.1, both at or above the patched versions.main.Notes: together with #1, this closes all 13 open Dependabot alerts. All of them were dev-only, so the shipped bundle was not affected.
🤖 Generated with Claude Code