-
Notifications
You must be signed in to change notification settings - Fork 1.7k
fix(deps): upgrade undici dependency to v6.23.0 #2241
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR upgrades the undici dependency from v5.28.5 to v6.23.0 to address a security vulnerability (GHSA-g9mf-h72j-4rw9). The upgrade includes updating the ProxyAgent configuration to use the new v6 API for handling SSL certificate rejection.
Changes:
- Updated undici dependency from ^5.28.5 to ^6.23.0 in package.json
- Refactored SSL error handling to use the new
requestTlsconfiguration option in ProxyAgent constructor - Removed the @fastify/busboy dependency (no longer required by undici v6)
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| packages/http-client/package.json | Updated undici dependency version to ^6.23.0 |
| packages/http-client/package-lock.json | Updated lock file with undici v6.23.0 and removed @fastify/busboy dependency |
| packages/http-client/src/index.ts | Refactored ProxyAgent SSL error handling to use requestTls configuration instead of post-construction property assignment |
Files not reviewed (1)
- packages/http-client/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| }, | ||
| "engines": { | ||
| "node": ">=14.0" | ||
| "node": ">=18.17" |
Copilot
AI
Jan 15, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Undici v6 requires Node.js >=18.17, but the CI/CD tests run on Node.js 20.x and 24.x. While these versions satisfy the requirement, older GitHub Actions runners may use Node.js 16.x. Consider documenting this breaking change as it increases the minimum Node.js version requirement from v14 (undici v5) to v18.17 (undici v6).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
it should be confirmes by maintainers as if node versiones below 18 are not listed in unit tests, it could be expected to not support them
There is a vulnerability detected in undici v5, recommendation is to migrate at least to v6.23.0 https://osv.dev/vulnerability/GHSA-g9mf-h72j-4rw9