chore(deps): bump undici by dependabot[bot] · Pull Request #1838 · hyperledger-identus/cloud-agent

dependabot · 2026-07-24T20:36:48Z

Bumps and undici. These dependencies needed to be updated together.
Updates undici from 7.25.0 to 7.29.0

Release notes

v7.29.0

What's Changed

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

... (truncated)

Commits

9e38fc1 Bumped v7.29.0 (#5590)
d887e34 fix: validate coerced header values for CRLF (#5579)
33928bc fix: validate blob body content type
98011a8 fix(cache): harden cache directive parsing
4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
1b5a531 fix(retry): reject partial content length mismatch
466e99d test: cover crash on mixed unqualified and qualified private cache directives
9f10f1e fix: handle empty qualified private cache directive
3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
f9eba0a Bumped v7.28.0 (#5430)
Additional commits viewable in compare view

Updates undici from 6.25.0 to 6.28.0

Release notes

Sourced from undici's releases.

v7.29.0

What's Changed

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

... (truncated)

Commits

9e38fc1 Bumped v7.29.0 (#5590)
d887e34 fix: validate coerced header values for CRLF (#5579)
33928bc fix: validate blob body content type
98011a8 fix(cache): harden cache directive parsing
4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
1b5a531 fix(retry): reject partial content length mismatch
466e99d test: cover crash on mixed unqualified and qualified private cache directives
9f10f1e fix: handle empty qualified private cache directive
3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
f9eba0a Bumped v7.28.0 (#5430)
Additional commits viewable in compare view

github-actions · 2026-07-24T20:56:14Z

Unit Test Results

113 files ±0 113 suites ±0 1h 0m 31s ⏱️ + 1m 1s
927 tests ±0 919 ✅ ±0 8 💤 ±0 0 ❌ ±0
934 runs ±0 926 ✅ ±0 8 💤 ±0 0 ❌ ±0

Results for commit 5e6dc88. ± Comparison against base commit 7e12cb4.

♻️ This comment has been updated with latest results.

patextreme

dep-bump-merger auto-approval: diff judged to be a purely version-only dependency bump by the dep-bump-merger skill rubric.

patextreme · 2026-07-26T16:30:18Z

dep-bump-merger could not auto-merge this PR.

Reason: checks not green: check Run integration tests (neoprism): FAILURE

yshyn-iohk · 2026-07-28T16:43:16Z

undici is a transitive dependency of the root release / git-hook tooling (the root package.json is devDependencies only — semantic-release, husky, prettier, commitlint), so nothing ships with this. The red integration jobs are the pre-existing keycloak-image failure fixed on main (#1844 / #1845). Good to merge after a re-run.

_{Reviewed with Claude Code}

Bumps and [undici](https://github.com/nodejs/undici). These dependencies needed to be updated together. Updates `undici` from 7.25.0 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.25.0...v7.29.0) Updates `undici` from 6.25.0 to 6.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.25.0...v7.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 6.28.0 dependency-type: indirect - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-29T04:20:12Z

Integration Test Results (prism-node)

1 tests ±0 1 ✅ ±0 4s ⏱️ ±0s
1 suites ±0 0 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 5e6dc88. ± Comparison against base commit 7e12cb4.

♻️ This comment has been updated with latest results.

github-actions · 2026-07-29T04:23:45Z

Integration Test Results

23 files 23 suites 5s ⏱️
58 tests 58 ✅ 0 💤 0 ❌
106 runs 106 ✅ 0 💤 0 ❌

Results for commit 5e6dc88.

♻️ This comment has been updated with latest results.

sonarqubecloud · 2026-07-31T15:58:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026

dependabot Bot requested a review from a team as a code owner July 24, 2026 20:36

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026

dependabot Bot mentioned this pull request Jul 24, 2026

chore(deps): bump undici #1834

Closed

patextreme approved these changes Jul 26, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-5db45a0b5a branch from 50d53c6 to 236018d Compare July 29, 2026 04:08

Merge branch 'main' into dependabot/npm_and_yarn/multi-5db45a0b5a

c371ec5

patextreme enabled auto-merge (squash) July 29, 2026 10:14

Merge branch 'main' into dependabot/npm_and_yarn/multi-5db45a0b5a

5e6dc88

patextreme merged commit 78fba7e into main Jul 31, 2026
18 checks passed

patextreme deleted the dependabot/npm_and_yarn/multi-5db45a0b5a branch July 31, 2026 16:16

Navigation Menu

Uh oh!

chore(deps): bump undici - #1838

chore(deps): bump undici#1838
patextreme merged 3 commits into
mainfrom
dependabot/npm_and_yarn/multi-5db45a0b5a

dependabot Bot commented on behalf of github Jul 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

patextreme left a comment

Uh oh!

patextreme commented Jul 26, 2026

Uh oh!

yshyn-iohk commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Jul 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.29.0

What's Changed

v7.28.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

v7.29.0

What's Changed

v7.28.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unit Test Results

Uh oh!

patextreme left a comment

Choose a reason for hiding this comment

Uh oh!

patextreme commented Jul 26, 2026

Uh oh!

yshyn-iohk commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Integration Test Results (prism-node)

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Integration Test Results

Uh oh!

sonarqubecloud Bot commented Jul 31, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading