fix(deps): update dependency undici to v6.11.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
undici (source)	6.7.0 -> 6.11.1

GitHub Vulnerability Alerts

CVE-2024-30260

Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

This has been patched in nodejs/undici@6805746.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

• https://hackerone.com/reports/2408074
• GHSA-3787-6prv-h9w3

CVE-2024-30261

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in nodejs/undici@d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

---

Release Notes

nodejs/undici (undici)

v6.11.1

Compare Source

v6.11.0

Compare Source

v6.10.2

Compare Source

What's Changed

• Do not fail test if streams support typed arrays by @​mcollina in https://github.com/nodejs/undici/pull/2978
• fix(fetch): properly redirect non-ascii location header url by @​Xvezda in https://github.com/nodejs/undici/pull/2971
• perf: Remove double-stringify in setCookie by @​peterver in https://github.com/nodejs/undici/pull/2980
• [fix #​2982] use DispatcherInterceptor type for Dispatcher#Compose by @​clovis-guillemot in https://github.com/nodejs/undici/pull/2983
• fix: make EventSource properties enumerable by @​MattBidewell in https://github.com/nodejs/undici/pull/2987
• docs: ✏️ fixed benchmark links by @​benhalverson in https://github.com/nodejs/undici/pull/2991
• fix(#​2986): bad start check by @​metcoder95 in https://github.com/nodejs/undici/pull/2992
• fix(H2 Client): bind stream 'data' listener only after received 'response' event by @​St3ffGv4 in https://github.com/nodejs/undici/pull/2985
• feat: added search input by @​benhalverson in https://github.com/nodejs/undici/pull/2993
• chore: validate responses can be consumed without a Content-Length or… by @​jacob-ebey in https://github.com/nodejs/undici/pull/2995
• fix error message by @​KhafraDev in https://github.com/nodejs/undici/pull/2998
• Revert "perf: reuse TextDecoder instance (#​2863)" by @​panva in https://github.com/nodejs/undici/pull/2999
• test: remove only by @​metcoder95 in https://github.com/nodejs/undici/pull/3001

New Contributors

• @​Xvezda made their first contribution in https://github.com/nodejs/undici/pull/2971
• @​peterver made their first contribution in https://github.com/nodejs/undici/pull/2980
• @​clovis-guillemot made their first contribution in https://github.com/nodejs/undici/pull/2983
• @​MattBidewell made their first contribution in https://github.com/nodejs/undici/pull/2987
• @​benhalverson made their first contribution in https://github.com/nodejs/undici/pull/2991
• @​St3ffGv4 made their first contribution in https://github.com/nodejs/undici/pull/2985
• @​jacob-ebey made their first contribution in https://github.com/nodejs/undici/pull/2995

Full Changelog: nodejs/undici@v6.10.0...v6.10.2

v6.10.1

Compare Source

v6.10.0

Compare Source

What's Changed

• test: fix flakyness of issue-803 test by @​Uzlopak in https://github.com/nodejs/undici/pull/2960
• Cleanup format by @​KhafraDev in https://github.com/nodejs/undici/pull/2959
• Chore: run tests daily against node nightly by @​mweberxyz in https://github.com/nodejs/undici/pull/2969
• fix: fix retry handler option by @​acommodari in https://github.com/nodejs/undici/pull/2962
• build(deps): bump node from 4999fa1 to 577f8eb in /build by @​dependabot in https://github.com/nodejs/undici/pull/2974
• feat(TS): add types for composed dispatchers by @​metcoder95 in https://github.com/nodejs/undici/pull/2967
• fix: count for error response and network errors by @​metcoder95 in https://github.com/nodejs/undici/pull/2966

New Contributors

• @​mweberxyz made their first contribution in https://github.com/nodejs/undici/pull/2969
• @​acommodari made their first contribution in https://github.com/nodejs/undici/pull/2962

Full Changelog: nodejs/undici@v6.9.0...v6.10.0

v6.9.0

Compare Source

What's Changed

• feat: add new dispatch compose by @​metcoder95 in https://github.com/nodejs/undici/pull/2826
• ci: add macos-latest to test-matrix by @​Uzlopak in https://github.com/nodejs/undici/pull/2952
• types: align RequestInit.body type with lib.dom.ts by @​jdufresne in https://github.com/nodejs/undici/pull/2956
• ci: pin versions of github actions by @​UlisesGascon in https://github.com/nodejs/undici/pull/2957
• fetch: improve output for FormData, Response, Request by @​mertcanaltin in https://github.com/nodejs/undici/pull/2955
• perf: optimize collectASequenceOfBytes by @​tsctx in https://github.com/nodejs/undici/pull/2958

New Contributors

• @​jdufresne made their first contribution in https://github.com/nodejs/undici/pull/2956
• @​UlisesGascon made their first contribution in https://github.com/nodejs/undici/pull/2957

Full Changelog: nodejs/undici@v6.8.0...v6.9.0

v6.8.0

Compare Source

What's Changed

• fix: send correct SNI for proxy connections by @​chrros95 in https://github.com/nodejs/undici/pull/2939
• build(deps): bump node from 8bf9240 to 7bfef1d in /build by @​dependabot in https://github.com/nodejs/undici/pull/2937
• fetch: improve util.inspect output for web specifications by @​mertcanaltin in https://github.com/nodejs/undici/pull/2938
• ci: fix broken ci on windows and node v21 because of libuv bug by @​Uzlopak in https://github.com/nodejs/undici/pull/2941
• perf: improve getResolveErrorBodyCallback by @​Uzlopak in https://github.com/nodejs/undici/pull/2940
• fix: don't assign kAgent twice by @​ronag in https://github.com/nodejs/undici/pull/2942
• perf: dump immediatly if known size exceeds limit by @​ronag in https://github.com/nodejs/undici/pull/2882
• build(deps): bump node from 7bfef1d to 4999fa1 in /build by @​dependabot in https://github.com/nodejs/undici/pull/2946
• try to fix windows failure by @​ronag in https://github.com/nodejs/undici/pull/2950
• perf: improve parsing form-data by @​tsctx in https://github.com/nodejs/undici/pull/2944

New Contributors

• @​chrros95 made their first contribution in https://github.com/nodejs/undici/pull/2939

Full Changelog: nodejs/undici@v6.7.1...v6.8.0

v6.7.1

Compare Source

What's Changed

• fetch: use EOL of os-module by @​Uzlopak in https://github.com/nodejs/undici/pull/2915
• ci: only send codecov from ubuntu and node by @​Uzlopak in https://github.com/nodejs/undici/pull/2914
• tests: improve skip for unix.js tests, remove skipped tests by @​Uzlopak in https://github.com/nodejs/undici/pull/2916
• chore: fix typo in isHistoryNavigation comments by @​kachick in https://github.com/nodejs/undici/pull/2920
• fix(benchmark): set body correctly by @​tsctx in https://github.com/nodejs/undici/pull/2918
• chore: increase test coverage to 100% for /lib/api/api-request.js by @​Uzlopak in https://github.com/nodejs/undici/pull/2912
• fix: chunksDecode cuts off 3 characters at the end if having BOM by @​Uzlopak in https://github.com/nodejs/undici/pull/2922
• docs: clarify URI parsing behavior of ProxyAgent constructor by @​rossilor95 in https://github.com/nodejs/undici/pull/2893
• implement sync formdata parser by @​KhafraDev in https://github.com/nodejs/undici/pull/2911
• Fix docs links and add examples to sidebar by @​tastypackets in https://github.com/nodejs/undici/pull/2895
• doc: update diagnostics channel request headers type change by @​jessezhang91 in https://github.com/nodejs/undici/pull/2925
• perf: optimize getResolveErrorBodyCallback by @​tsctx in https://github.com/nodejs/undici/pull/2921
• override request dispatcher from init by @​matthieusieben in https://github.com/nodejs/undici/pull/2928
• add busboy tests by @​KhafraDev in https://github.com/nodejs/undici/pull/2924
• fix(benchmark): make it fair by @​tsctx in https://github.com/nodejs/undici/pull/2929
• Revert "chore: remove no-simd wasm" by @​Uzlopak in https://github.com/nodejs/undici/pull/2935
• build(deps): bump node from d3271e4 to 8bf9240 in /build by @​dependabot in https://github.com/nodejs/undici/pull/2936
• Flip link between docs and README by @​mcollina in https://github.com/nodejs/undici/pull/2933

New Contributors

• @​kachick made their first contribution in https://github.com/nodejs/undici/pull/2920
• @​tastypackets made their first contribution in https://github.com/nodejs/undici/pull/2895
• @​jessezhang91 made their first contribution in https://github.com/nodejs/undici/pull/2925
• @​matthieusieben made their first contribution in https://github.com/nodejs/undici/pull/2928

Full Changelog: nodejs/undici@v6.7.0...v6.7.1

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.