Skip to content

Conversation

@roggervalf
Copy link

There is a vulnerability detected in undici v5, recommendation is to migrate at least to v6.23.0 https://osv.dev/vulnerability/GHSA-g9mf-h72j-4rw9

Copilot AI review requested due to automatic review settings January 15, 2026 06:10
@roggervalf roggervalf requested a review from a team as a code owner January 15, 2026 06:10
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR upgrades the undici dependency from v5.28.5 to v6.23.0 to address a security vulnerability (GHSA-g9mf-h72j-4rw9). The upgrade includes updating the ProxyAgent configuration to use the new v6 API for handling SSL certificate rejection.

Changes:

  • Updated undici dependency from ^5.28.5 to ^6.23.0 in package.json
  • Refactored SSL error handling to use the new requestTls configuration option in ProxyAgent constructor
  • Removed the @fastify/busboy dependency (no longer required by undici v6)

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File Description
packages/http-client/package.json Updated undici dependency version to ^6.23.0
packages/http-client/package-lock.json Updated lock file with undici v6.23.0 and removed @fastify/busboy dependency
packages/http-client/src/index.ts Refactored ProxyAgent SSL error handling to use requestTls configuration instead of post-construction property assignment
Files not reviewed (1)
  • packages/http-client/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

},
"engines": {
"node": ">=14.0"
"node": ">=18.17"
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Undici v6 requires Node.js >=18.17, but the CI/CD tests run on Node.js 20.x and 24.x. While these versions satisfy the requirement, older GitHub Actions runners may use Node.js 16.x. Consider documenting this breaking change as it increases the minimum Node.js version requirement from v14 (undici v5) to v18.17 (undici v6).

Copilot uses AI. Check for mistakes.
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it should be confirmes by maintainers as if node versiones below 18 are not listed in unit tests, it could be expected to not support them

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant