Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 27, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
undici (source) ^6.11.1 -> ^7.0.0 age adoption passing confidence

Release Notes

nodejs/undici (undici)

v7.16.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.15.0...v7.16.0

v7.15.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.14.0...v7.15.0

v7.14.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.13.0...v7.14.0

v7.13.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.12.0...v7.13.0

v7.12.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.11.0...v7.12.0

v7.11.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.10.0...v7.11.0

v7.10.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.9.0...v7.10.0

v7.9.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.8.0...v7.9.0

v7.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.7.0...v7.8.0

v7.7.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.6.0...v7.7.0

v7.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.5.0...v7.6.0

v7.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.4.0...v7.5.0

v7.4.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.3.0...v7.4.0

v7.3.0

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.2.3...v7.3.0

v7.2.3

Compare Source

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

Full Changelog: nodejs/undici@v7.2.2...v7.2.3

v7.2.2

[Compare Source](https://redirect.github.


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot changed the title Update dependency undici to v7 Update dependency undici to v7 - autoclosed Jan 21, 2025
@renovate renovate bot closed this Jan 21, 2025
@renovate renovate bot deleted the renovate/undici-7.x branch January 21, 2025 22:07
@renovate renovate bot changed the title Update dependency undici to v7 - autoclosed Update dependency undici to v7 Jan 21, 2025
@renovate renovate bot reopened this Jan 21, 2025
@renovate renovate bot force-pushed the renovate/undici-7.x branch 2 times, most recently from 4c1bd2b to 219aab3 Compare January 21, 2025 22:21
@renovate renovate bot force-pushed the renovate/undici-7.x branch from 219aab3 to ffd3b44 Compare March 19, 2025 20:38
@renovate renovate bot force-pushed the renovate/undici-7.x branch from ffd3b44 to 2c39df4 Compare July 31, 2025 10:40
@renovate renovate bot force-pushed the renovate/undici-7.x branch 2 times, most recently from bc61a8f to 6903443 Compare August 22, 2025 17:58
@renovate renovate bot force-pushed the renovate/undici-7.x branch from 6903443 to 8be77fc Compare September 9, 2025 21:01
@renovate renovate bot force-pushed the renovate/undici-7.x branch from 8be77fc to 43e635a Compare November 11, 2025 01:57
@socket-security
Copy link

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Low
Potential code anomaly (AI signal): npm undici is 100.0% likely to have a medium risk anomaly

Notes: The fragment appears to be a legitimate HTTP interaction snapshot utility designed for recording and replaying requests/responses with configurable filters and disk-backed persistence. No malicious activity is evident. Primary concerns revolve around securing stored data (privacy and access control) and ensuring proper configuration of header/body filtering. Overall security posture remains moderate and manageable with correct usage.

Confidence: 1.00

Severity: 0.60

From: ?npm/[email protected]

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant