Skip to content

Bump undici from 6.25.0 to 8.2.0#445

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/master/undici-8.1.0
Closed

Bump undici from 6.25.0 to 8.2.0#445
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/master/undici-8.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 29, 2026

Copy link
Copy Markdown
Contributor

Bumps undici from 6.25.0 to 8.2.0.

Release notes

Sourced from undici's releases.

v8.2.0

What's Changed

... (truncated)

Commits
  • bf684f7 Bumped v8.2.0 (#5152)
  • 0ca054a fix: replace stale pool clients under connection limit (#5145)
  • 7af90e9 perf: avoid redundant scans in BalancedPool dispatcher selection (#5146)
  • abb9d06 fix: validate H2CClient maxConcurrentStreams option (#5143)
  • 72a7591 perf(http2): avoid cloning headers when removing status (#5127)
  • 96fd5e9 fix(cache): allow streamed entries at maxEntrySize limit (#5129)
  • f41e53f perf: use byteLength property for binary body chunks (#5126)
  • bec4961 chore(deps): add lockfile (#5139)
  • 86f1242 perf(http2): reduce writeH2 per-request callback allocations (#5138)
  • cad3f70 perf(client): parse h1 content-length statelessly (#5124)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 29, 2026
@github-actions

github-actions Bot commented Apr 29, 2026

Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/undici 8.2.0 🟢 8.4
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing🟢 10project is fuzzed
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 77 contributing companies or organizations

Scanned Files

  • package-lock.json

Bumps [undici](https://github.com/nodejs/undici) from 6.25.0 to 8.2.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.25.0...v8.2.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump undici from 6.24.1 to 8.1.0 Bump undici from 6.25.0 to 8.2.0 May 13, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/master/undici-8.1.0 branch from 351d3a6 to 922193a Compare May 13, 2026 18:09
@dependabot @github

dependabot Bot commented on behalf of github May 14, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #450.

@dependabot dependabot Bot closed this May 14, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/master/undici-8.1.0 branch May 14, 2026 07:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants