chore(deps): update dependency undici to v5 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
undici (source)	^4.12.1 → ^5.0.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

ProxyAgent vulnerable to MITM

CVE-2022-32210 / GHSA-pgw7-wx7w-2w33

More information

Details

Description

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

Impact

This affects all use of HTTPS via HTTP proxy using Undici.ProxyAgent with Undici or Node's global fetch. In this case, it removes all HTTPS security from all requests sent using Undici's ProxyAgent, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server's ISP, etc).
This less seriously affects HTTPS via HTTPS proxies. When you send HTTPS via a proxy to a remote server, the proxy can freely view or modify all HTTPS traffic unexpectedly (but only the proxy).

Patches

This issue was patched in Undici v5.5.1.

Workarounds

At the time of writing, the only workaround is to not use ProxyAgent as a dispatcher for TLS Connections.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33
• https://nvd.nist.gov/vuln/detail/CVE-2022-32210
• https://hackerone.com/reports/1583680
• https://github.com/advisories/GHSA-pgw7-wx7w-2w33

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

undici before v5.8.0 vulnerable to CRLF injection in request headers

CVE-2022-31150 / GHSA-3cvr-822r-rqcc

More information

Details

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc
• https://nvd.nist.gov/vuln/detail/CVE-2022-31150
• https://github.com/nodejs/undici/commit/a29a151d0140d095742d21a004023d024fe93259
• https://hackerone.com/reports/409943
• https://github.com/nodejs/undici/releases/tag/v5.8.0
• https://security.netapp.com/advisory/ntap-20220915-0002/
• https://github.com/advisories/GHSA-3cvr-822r-rqcc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

CVE-2022-31151 / GHSA-q768-x9m6-m9qp

More information

Details

Impact

Authorization headers are already cleared on cross-origin redirect in
https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.

However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in v5.8.0.

Workarounds

By default, this vulnerability is not exploitable.
Do not enable redirections, i.e. maxRedirections: 0 (the default).

References

https://hackerone.com/reports/1635514
https://curl.se/docs/CVE-2018-1000007.html
https://curl.se/docs/CVE-2022-27776.html

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
• https://nvd.nist.gov/vuln/detail/CVE-2022-31151
• https://github.com/nodejs/undici/issues/872
• https://github.com/nodejs/undici/pull/1441
• https://github.com/nodejs/undici/commit/0a5bee9465e627be36bac88edf7d9bbc9626126d
• https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189
• https://github.com/nodejs/undici/releases/tag/v5.8.0
• https://hackerone.com/reports/1635514
• https://security.netapp.com/advisory/ntap-20220909-0006/
• https://github.com/advisories/GHSA-q768-x9m6-m9qp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

undici.request vulnerable to SSRF using absolute URL on pathname

CVE-2022-35949 / GHSA-8qr4-xgw6-wmr3

More information

Details

Impact

undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request.

If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1

const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})

Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1.

If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

Patches

This issue was fixed in undici@5.8.1.

Workarounds

The best workaround is to validate user input before passing it to the undici.request call.

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3
• https://nvd.nist.gov/vuln/detail/CVE-2022-35949
• https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895
• https://github.com/nodejs/undici/releases/tag/v5.8.2
• https://github.com/advisories/GHSA-8qr4-xgw6-wmr3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

CVE-2022-35948 / GHSA-f772-66g8-q5h3

More information

Details

Impact

=< undici@5.8.0 users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Example:

import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})

The above snippet will perform two requests in a single request API call:

1. http://localhost:3000/
2. http://localhost:3000/foo2

Patches

This issue was patched in Undici v5.8.1

Workarounds

Sanitize input when sending content-type headers using user input.

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3
• https://nvd.nist.gov/vuln/detail/CVE-2022-35948
• https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80
• https://github.com/nodejs/undici/releases/tag/v5.8.2
• https://github.com/advisories/GHSA-f772-66g8-q5h3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

CRLF Injection in Nodejs ‘undici’ via host

CVE-2023-23936 / GHSA-5r9g-qh6m-jxff

More information

Details

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@​timon8) for reporting this vulnerability.

Severity

• CVSS Score: 4.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
• https://nvd.nist.gov/vuln/detail/CVE-2023-23936
• https://github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
• https://hackerone.com/reports/1820955
• https://github.com/nodejs/undici/releases/tag/v5.19.1
• https://github.com/advisories/GHSA-5r9g-qh6m-jxff

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Regular Expression Denial of Service in Headers

CVE-2023-24807 / GHSA-r6ch-mqf9-qc9w

More information

Details

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

• https://hackerone.com/bugs?report_id=1784449

Credits

Carter Snook reported this vulnerability.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w
• https://nvd.nist.gov/vuln/detail/CVE-2023-24807
• https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf
• https://github.com/nodejs/undici/releases/tag/v5.19.1
• https://hackerone.com/bugs?report_id=1784449
• https://github.com/advisories/GHSA-r6ch-mqf9-qc9w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Undici's cookie header not cleared on cross-origin redirect in fetch

CVE-2023-45143 / GHSA-wqq4-5wpv-mx2g

More information

Details

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

Severity

• CVSS Score: 3.9 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp
• https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g
• https://nvd.nist.gov/vuln/detail/CVE-2023-45143
• https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76
• https://hackerone.com/reports/2166948
• https://github.com/nodejs/undici/releases/tag/v5.26.2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y
• https://github.com/advisories/GHSA-wqq4-5wpv-mx2g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

CVE-2024-24758 / GHSA-3787-6prv-h9w3

More information

Details

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

• https://fetch.spec.whatwg.org/#authentication-entries
• GHSA-wqq4-5wpv-mx2g

Severity

• CVSS Score: 3.9 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
• https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c2568730434ef
• https://github.com/nodejs/undici/commit/d3aa574b1259c1d8d329a0f0f495ee82882b1458
• https://github.com/nodejs/undici/releases/tag/v5.28.3
• https://github.com/nodejs/undici/releases/tag/v6.6.1
• https://nvd.nist.gov/vuln/detail/CVE-2024-24758
• https://security.netapp.com/advisory/ntap-20240419-0007
• http://www.openwall.com/lists/oss-security/2024/03/11/1
• https://github.com/advisories/GHSA-3787-6prv-h9w3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

CVE-2024-30260 / GHSA-m4v8-wqvr-p9f7

More information

Details

Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

This has been patched in nodejs/undici@6805746.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

• https://hackerone.com/reports/2408074
• GHSA-3787-6prv-h9w3

Severity

• CVSS Score: 3.9 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7
• https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f
• https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75
• https://hackerone.com/reports/2408074
• https://nvd.nist.gov/vuln/detail/CVE-2024-30260
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E
• https://security.netapp.com/advisory/ntap-20240905-0008
• https://github.com/advisories/GHSA-m4v8-wqvr-p9f7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

CVE-2024-30261 / GHSA-9qxr-qj54-h672

More information

Details

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in nodejs/undici@d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

Severity

• CVSS Score: 2.6 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References

• https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672
• https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055
• https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3
• https://hackerone.com/reports/2377760
• https://nvd.nist.gov/vuln/detail/CVE-2024-30261
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
• https://security.netapp.com/advisory/ntap-20240905-0008
• https://github.com/advisories/GHSA-9qxr-qj54-h672

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nodejs/undici (undici)

v5.28.4

Compare Source

⚠️ Security Release ⚠️

• Fixes GHSA-m4v8-wqvr-p9f7 CVE-2024-30260
• Fixes GHSA-9qxr-qj54-h672 CVE-2024-30261

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

Compare Source

⚠️ Security Release ⚠️

Fixes:

• CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

Compare Source

What's Changed

• fix: remove optional chainning for compatible with Nodejs12 and below by @​bugb in #​2470
• fix: remove node: prefix by @​tsctx in #​2471
• perf: avoid Headers initialization by @​tsctx in #​2468
• fix: handle SharedArrayBuffer correctly by @​tsctx in #​2466
• fix: Add null type to signal in RequestInit by @​gebsh in #​2455
• fix: correctly handle data URL with hashes. by @​tsctx in #​2475
• fix: check response for timinginfo allow flag by @​ToshB in #​2477
• Make call to onBodySent conditional in RetryHandler by @​MzUgM in #​2478
• refactor: better integrity check by @​tsctx in #​2462
• fix: Added support for inline URL username:password proxy auth by @​matt-way in #​2473
• build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @​dependabot in #​2472
• build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @​dependabot in #​2405
• build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @​dependabot in #​2396
• build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @​dependabot in #​2395
• build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @​dependabot in #​2392
• build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @​dependabot in #​2389
• build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @​dependabot in #​2302

New Contributors

• @​bugb made their first contribution in #​2470
• @​gebsh made their first contribution in #​2455
• @​ToshB made their first contribution in #​2477
• @​MzUgM made their first contribution in #​2478
• @​matt-way made their first contribution in #​2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

Compare Source

What's Changed

• perf: Improve normalizeMethod by @​tsctx in #​2456
• fix: dispatch error handling by @​ronag in #​2459
• perf(request): optimize if headers are given by @​tsctx in #​2454

Full Changelog: nodejs/undici@v5.28.0...v5.28.1

v5.28.0

Compare Source

What's Changed

• fix(parseHeaders): util.parseHeaders handle correctly array of buffer… by @​mdoria12 in #​2398
• docs: add license to undici-types by @​dancastillo in #​2401
• perf: optimize Readable.dump by @​ronag in #​2402
• perf(headers): Improve Headers by @​tsctx in #​2397
• test: re-enable conditional WPT Report for websockets by @​panva in #​2407
• fix: delay abort on 'close' by @​ronag in #​2408
• refactor: use substring instead of substr by @​tsctx in #​2411
• add additional http2 test with fetch by @​KhafraDev in #​2419
• fix: HTTPToken check by @​tsctx in #​2410
• perf: optimize HeadersList.get by @​tsctx in #​2420
• properly handle pseudo-headers in fetch by @​KhafraDev in #​2422
• perf(headers): if the guard is immutable by @​tsctx in #​2424
• fix(mock-agent): send stream body by @​tsctx in #​2425
• build(deps): bump github/codeql-action from 2.21.5 to 2.22.5 by @​dependabot in #​2394
• feat(#​2264): Expose Retry Handler by @​metcoder95 in #​2281
• fix: implement Headers#set correctly by @​tsctx in #​2432
• fix: implement Headers#delete correctly by @​tsctx in #​2430
• test: update websocket wpt availability by @​panva in #​2437
• fix: type comment position by @​tsctx in #​2443
• fix: onHeaders type declaration by @​tsctx in #​2444
• remove http2 status pseudo header from headers by @​KhafraDev in #​2438
• docs: Clarify path matching in intercept() by @​oliversalzburg in #​2426
• fix: set-cookie clone by @​tsctx in #​2446
• docs: fix typo in maxConcurrentStreams by @​tniessen in #​2450
• refactor: remove leftovers by @​metcoder95 in #​2451
• refactor: add missing new operator by @​tsctx in #​2452

New Contributors

• @​mdoria12 made their first contribution in #​2398
• @​tsctx made their first contribution in #​2397
• @​oliversalzburg made their first contribution in #​2426

Full Changelog: nodejs/undici@v5.27.2...v5.28.0

v5.27.2

Compare Source

Full Changelog: nodejs/undici@v5.27.1...v5.27.2

v5.27.1

Compare Source

What's Changed

• add regression test by @​KhafraDev in #​2376
• fix: define conditions when content-length should be sent by @​pxue in #​2305
• refactor: removed unnecessary default by @​nikelborm in #​2381
• fix: stream body handling by @​ronag in #​2391

New Contributors

• @​pxue made their first contribution in #​2305
• @​nikelborm made their first contribution in #​2381

Full Changelog: nodejs/undici@v5.27.0...v5.27.1

v5.27.0

Compare Source

What's Changed

• Use sets and reusable TextEncoder/TextDecoder instances by @​kibertoad in #​2368
• feat: forward onRequestSent to handler by @​ronag in #​2375
• skip bundle test on node 16 by @​KhafraDev in #​2377
• fix windows CI by @​KhafraDev in #​2379

Full Changelog: nodejs/undici@v5.26.5...v5.27.0

v5.26.5

Compare Source

What's Changed

• Drop race condition in connect-timeout test by @​mcollina in #​2360
• Remove a couple of unnecessary async functions by @​kibertoad in #​2367
• Update namespace type with Fetch exports by @​Ethan-Arrowood in #​2361

Full Changelog: nodejs/undici@v5.26.4...v5.26.5

v5.26.4

Compare Source

What's Changed

• use esbuild define/hooks by @​KhafraDev in #​2342
• fix request's arrayBuffer returning uint8 instead of arraybuffer by @​KhafraDev in #​2344
• fix: skip readMore call if parser is null or undefined by @​iiAku in #​2346
• test: first attempt for flaky fix by @​metcoder95 in #​2337
• test: only include WebSocket in WPT Report where it's landed by @​panva in #​2351
• Update DispatchInterceptor.md by @​Uzlopak in #​2354
• fix: Avoid error for stream() being aborted by @​BobNobrain in #​2355
• fix names with esbuild by @​KhafraDev in #​2359

New Contributors

• @​iiAku made their first contribution in #​2346
• @​Uzlopak made their first contribution in #​2354
• @​BobNobrain made their first contribution in #​2355

Full Changelog: nodejs/undici@v5.26.3...v5.26.4

v5.26.3

Compare Source

v5.26.2

Compare Source

Security Release, CVE-2023-45143.

v5.26.1

Compare Source

What's Changed

• Fix publish undici-types once and for all! by @​Ethan-Arrowood in #​2338
• Fix node detection omfg by @​KhafraDev in #​2341

Full Changelog: nodejs/undici@v5.26.0...v5.26.1

v5.26.0

Compare Source

What's Changed

• use npm install instead of npm ci by @​Ethan-Arrowood in #​2309
• change default header to node by @​Ethan-Arrowood in #​2310
• chore: change order of the pseudo-headers by @​kyrylodolynskyi in #​2308
• fix: Agent.Options.factory should accept URL object or string as parameter by @​nicole0707 in #​2295
• build(deps-dev): bump sinon from 15.2.0 to 16.1.0 by @​dependabot in #​2312
• test: handle npm ignore-scripts settings by @​panva in #​2313
• feat: respect --max-http-header-size Node.js flag by @​balazsorban44 in #​2234
• fix(#​2311): End stream after body sent by @​metcoder95 in #​2314
• disallow setting host header in fetch by @​KhafraDev in #​2322
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in #​2325
• fix fetch with coverage enabled by @​KhafraDev in #​2330
• Fix stuck when using http2 POST Buffer by @​binsee in #​2336
• fix: 🏷️ add allowH2 to BuildOptions by @​binsee in #​2334
• fix: 🐛 fix process http2 header by @​binsee in #​2332

New Contributors

• @​kyrylodolynskyi made their first contribution in #​2308
• @​nicole0707 made their first contribution in #​2295
• @​balazsorban44 made their first contribution in #​2234
• @​binsee made their first contribution in #​2336

Full Changelog: nodejs/undici@v5.23.4...v5.26.0

v5.25.4

Compare Source

v5.25.3

Compare Source

What's Changed

• perf: improve parse-url implementation by @​anonrig in #​2286
• test: enable websockets inclusion in WPTReport by @​panva in #​2284
• remove npm run test from pre-commit hook by @​dancastillo in #​2296
• perf: use @​fastify/busboy by @​gurgunday in #​2211
• Disable finalizationregistry if node code cov by @​mcollina in #​2298

New Contributors

• @​gurgunday made their first contribution in #​2211

Full Changelog: nodejs/undici@v5.25.2...v5.25.3

v5.25.2

Compare Source

What's Changed

• Add Khaf to releasers by @​mcollina in #​2276
• fix: fix request with readable mode is object by @​killagu in #​2279
• fix loading websockets when node is built w/ --without-ssl by @​KhafraDev in #​2282

New Contributors

• @​killagu made their first contribution in #​2279

Full Changelog: nodejs/undici@v5.25.1...v5.25.2

v5.25.1

Compare Source

What's Changed

• Add publish types script by @​Ethan-Arrowood in #​2273

Full Changelog: nodejs/undici@v5.25.0...v5.25.1

v5.25.0

Compare Source

What's Changed

• fix: h2 without body by @​metcoder95 in #​2258
• ci: remove duplicated runs by @​metcoder95 in #​2265
• improve documentation of timeouts by making the units clear in all places by @​mcfedr in #​2266
• expose websocket in node bundle by @​KhafraDev in #​2217
• test: fix Fetch/HTTP2 tests by @​metcoder95 in #​2263
• fix undici when node is built with --without-ssl by @​KhafraDev in #​2272
• fix: Fix type definition for Client Interceptors by @​ComradeCow in #​2269
• Fix http2 agent by @​mcollina in #​2275

New Contributors

• @​ComradeCow made their first contribution in #​2269

Full Changelog: nodejs/undici@v5.24.0...v5.25.0

v5.24.0

Compare Source

Notable Changes

• feat: Add H2 support by @​metcoder95 in #​2061

What's Changed

• build(deps): bump step-security/harden-runner from 2.4.1 to 2.5.0 by @​dependabot in #​2203
• better stack trace for body.json by @​KhafraDev in #​2215
• allow http & https websocket urls by @​KhafraDev in #​2218
• build(deps-dev): bump @​sinonjs/fake-timers from 10.3.0 to 11.1.0 by @​dependabot in #​2221
• fix: pass ProxyAgent proxy status code error by @​NBNGaming in #​2162
• fix failing test by @​KhafraDev in #​2223
• docs: update MockPool.md intercept method description by [@​capaj](https://redirect.github.com/capa

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.