chore(deps): bump undici, @release-it/conventional-changelog and release-it in /mcp-server

[dependabot]

Bumps undici to 7.29.0 and updates ancestor dependencies undici, @release-it/conventional-changelog and release-it. These dependencies need to be updated together.

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates @release-it/conventional-changelog from 11.0.0 to 12.0.0

Release notes

Sourced from @​release-it/conventional-changelog's releases.

Release 12.0.0

• Skip prereleases without a recommended bump (resolve #151) (3451b9d346c27228b02a099a22838216e833a1ba)
• Avoid shell interpolation when staging changelogs (resolve #149) (dbaba1c8eee91fa792986c90c9767a2f6f78e123)
• Use resolved tag as recommended bump boundary (resolve #99) (d7cce4d82cfce4b90998f34b99f624ae7cb7f454)
• Document stable prerelease promotion (resolve #152) (9fa21def00e690ed9c4cfb72ee6ebfe82d291b4d)
• Upgrade dependencies (41b3201f1746605e6cc11bea70ba9ddb2b7e2bb8)

Release 11.0.1

• Restore no-preset fallback to prevent whatBump error (636c254fd1df5c4858d9ab48d1e1c13a1f24412a)
• Bump tmp from 0.2.5 to 0.2.6 (#145) (ce9a599e2762247bc8c71143214ab1cc6c162489) - thanks @​dependabot[bot]!
• Update dependencies (063b6af211b095465490e5b1c801955c7d25e72e)
• Derive tag prefix from resolved tag for recommended bump (resolve #80) (8947320a51403c8eaf47eebad8d3cef637cc3279)
• Document transform override and parseCommits resolution (resolve #78, resolve #137) (f3461f1ed7133bb70022ae4e6dbdd011f6d4641d)
• Run tests on Node 26 (74812985412d061d39352071a0c04666e25c61c5)

Commits

• ee8b92e Release 12.0.0
• 41b3201 Upgrade dependencies
• 9fa21de Document stable prerelease promotion (resolve #152)
• d7cce4d Use resolved tag as recommended bump boundary (resolve #99)
• dbaba1c Avoid shell interpolation when staging changelogs (resolve #149)
• 3451b9d Skip prereleases without a recommended bump (resolve #151)
• 82f88c9 Release 11.0.1
• 7481298 Run tests on Node 26
• f3461f1 Document transform override and parseCommits resolution (resolve #78, resolve...
• 8947320 Derive tag prefix from resolved tag for recommended bump (resolve #80)
• Additional commits viewable in compare view

Updates release-it from 20.2.1 to 21.0.1

Release notes

Sourced from release-it's releases.

Release 21.0.1

• Fix regression and support --no-hooks to skip all hooks (a8888b45b1d9db40a8f8ea5ad625b15b53d78925)

Release 21.0.0

• fix(ci): do not run integration on forks (#1315) (1e90d9f28f08a847029ed58f8ac211028d4203ca) - thanks @​trueberryless!
• Pin GitHub Actions to immutable commits (#1316) (38355d8068ac5c0818bc183ddb39db643aeab0c3)
• Fix npm publish workspace config resolution (#1312) (3bf251f5ab4c3665397aef8a7a4db6a21e02a98f) - thanks @​cyphercodes!
• Add gitlab.repoId option (#1224) (e4e9d0e35cbd99492c8b1a7b48e5a695951af7a2) - thanks @​microHoffman!
• Exit successfully when no release version is available (56c70c3f1436101a9284c535bed233081af85960)
• Support numeric GitLab repository IDs (0332c4ac4ecb8b714c8971b3953c972f59fe1f30)
• Parse CLI arguments strictly (resolve #1196) (caf77c928bfefa48339e8246261ffb8e41d70a4c)
• fix: shell caching and working tree detection (#1317) (8d1f7522ffc6afb445a00ab03357fdc7554b48ac) - thanks @​Mopsgamer!
• Remove dependabot workflow (e7e04ef3fb6151324ffde438a278539fbbc24eec)
• Fix configured GitHub proxy routing (1ed9cddf5d18d2c4107500081254cc7af22eff42)
• Upgrade dependencies and require Node 22 (c055e7fa5b2dcaf5078d4a5c337140a5bea0ac7e)
• Fix npm custom registry argument handling (resolve #1318) (98c45c4503e1d8bad0b7c38d99f6fda380c3681e)
• Pin GitLab releases to the current commit (resolve #1216) (70ab5769852bc5a3fafe4ac193f28bd247fa067e)
• Refresh GitHub Actions and package preview runtime (5c5513966ba2d4f1133c9b33c33850470c12a934)
• Document v21 runtime requirements (daab8460c0f0ed7f8a97c0ef806ef506d59f7268)
• Simplify git-cliff recipe (resolve #1195) (52c89a7965d3aff0a5d2474903fc902dbde59cf5)
• Make GitLab CA tests platform-independent (ba4326fb1a79b700a909ac6adab8bd242401971c)
• Raise Node 22 requirement to 22.21 (df94838844154a6b885af1888af81a75d43c80d9)
• Verify GitLab server certificates by default (c381a2d4ce1deb26a9e54ead63339c4860231bfd)
• Update changelog for v21 (2637e8a91fb560f23686773d3f476bff20daa5ae)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: [https://github.com/release-it/release-it/releases][1]

v21 (2026-07-25)

• Removed support for Node.js v20 and raised the Node.js v22 minimum to v22.21.0.
• CLI argument parsing is now strict. Unknown options, invalid booleans, and extra positional arguments are rejected.
• GitLab server certificates are verified by default. Configure private CA or explicitly set gitlab.secure to false.

v20 (2026-03-24)

• Upgraded undici from v6 to v7 to resolve security vulnerabilities.
• Upgraded proxy-agent from v6 to v7 to fix DEP0169 (url.parse() deprecation).
• Migrated from deprecated inquirer to @inquirer/prompts.
• Bumped engines.node to minimum Node.js v20.19.0 (was v20.12.0).

v19 (2025-04-18)

• No breaking changes (dependency party)

v18 (2025-01-06)

• Removed support for Node.js v18.

v17 (2023-11-11)

• Removed support for Node.js v16.

v16 (2023-07-05)

• Removed support for Node.js v14.

v15 (2022-04-30)

• Removed support for Node.js v10 and v12.
• Removed support for GitLab v12.4 and lower.
• Removed anonymous metrics (and the option to disable it).
• Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

• Removed global property from plugins. Use this.config[key] instead.
• Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

... (truncated)

Commits

• 2a1d141 Release 21.0.1
• a8888b4 Fix regression and support --no-hooks to skip all hooks
• 5e9c193 Release 21.0.0
• 2637e8a Update changelog for v21
• c381a2d Verify GitLab server certificates by default
• df94838 Raise Node 22 requirement to 22.21
• ba4326f Make GitLab CA tests platform-independent
• 52c89a7 Simplify git-cliff recipe (resolve #1195)
• daab846 Document v21 runtime requirements
• 5c55139 Refresh GitHub Actions and package preview runtime
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

🤖 Dependabot PR Review — Automated Analysis

Dependencies Changed

• release-it: 20.2.1 → 21.0.1 (major, direct devDependency)
• @release-it/conventional-changelog: 11.0.0 → 12.0.0 (major, direct devDependency)
• undici: 7.28.0 → 7.29.0 (patch, transitive via release-it)

Build Result

✅ Passed — npm ci && npm run build completed successfully (tsdown build, no errors).

Test Result

✅ All tests passed — 407 tests across 15 files.

Execution Check

✅ Starts successfully — node dist/index.mjs boots with CURRENTS_API_KEY set (no --help flag; missing API key exits with expected config error).

Risk Assessment

MEDIUM — All three packages are release-tooling only (devDependencies / transitive); no runtime MCP server impact. Build, tests, and startup are unaffected. However, release-it@21 documents breaking changes: Node.js v20 dropped (minimum v22.21.0), strict CLI argument parsing, and GitLab certificate verification by default. @release-it/conventional-changelog@12 raises its engine requirement to ^22.21.0 || >=24.0.0 and upgrades the conventional-changelog ecosystem. The release CI workflow uses Node 24.x, so the Node requirement is satisfied. undici@7.29.0 is a patch with a CRLF header-injection security fix and a WebSocket stream bugfix.

Code Changes Proposed

None — no source or test changes required.

Decision

⚠️ Requires human review — build, tests, and execution all pass, but major-version bumps carry documented breaking changes in release tooling. Recommend a maintainer confirm the release workflow (release-it --ci in .github/workflows/release.yaml) still behaves as expected on Node 24.x before merging.

cc @miguelangaranocurrents