Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nodejs/undici
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v7.28.0
Choose a base ref
...
head repository: nodejs/undici
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v7.29.0
Choose a head ref
  • 9 commits
  • 25 files changed
  • 4 contributors

Commits on Jul 23, 2026

  1. fix: harden cookie domain, path, and unparsed attribute validation 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    @KhafraDev @mcollina
    KhafraDev authored and mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    3bf91dd View commit details
    Browse the repository at this point in the history

  2. fix: handle empty qualified private cache directive 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    @mcollina
    mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    9f10f1e View commit details
    Browse the repository at this point in the history

  3. test: cover crash on mixed unqualified and qualified private cache di… 

    …rectives

Ref: GHSA-4cwx-7wf7-3272
Signed-off-by: Matteo Collina <hello@matteocollina.com>
    @UlisesGascon @mcollina
    UlisesGascon authored and mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    466e99d View commit details
    Browse the repository at this point in the history

  4. fix(retry): reject partial content length mismatch 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    @mcollina
    mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    1b5a531 View commit details
    Browse the repository at this point in the history

  5. test(retry): correct broken content-range fixtures in retry-handler.js 

    Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
    @UlisesGascon @mcollina
    UlisesGascon authored and mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    4a9dafb View commit details
    Browse the repository at this point in the history

  6. fix(cache): harden cache directive parsing 

    Signed-off-by: Matteo Collina <hello@matteocollina.com>
    @mcollina
    mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    98011a8 View commit details
    Browse the repository at this point in the history

  7. fix: validate blob body content type

    @mcollina
    mcollina committed Jul 23, 2026
    Configuration menu
    Copy the full SHA
    33928bc View commit details
    Browse the repository at this point in the history

Commits on Jul 24, 2026

  1. fix: validate coerced header values for CRLF (#5579) 

    Functions bypassed the object guard in processHeader() and were
coerced via template literals without isValidHeaderValue(), allowing
CRLF injection when toString/Symbol.toPrimitive returned embedded
newlines. Validate after coercion on both scalar and array paths.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit 354a151)
    @mcollina
    mcollina committed Jul 24, 2026
    Configuration menu
    Copy the full SHA
    d887e34 View commit details
    Browse the repository at this point in the history

  2. Bumped v7.29.0 (#5590) 

    Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
    @github-actions
    github-actions[bot] authored Jul 24, 2026
    Configuration menu
    Copy the full SHA
    9e38fc1 View commit details
    Browse the repository at this point in the history
Loading