Skip to content

chore(deps): bump undici from 6.22.0 to 6.23.0 in /packages/backend - #8

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/backend/undici-6.23.0
Closed

chore(deps): bump undici from 6.22.0 to 6.23.0 in /packages/backend#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/backend/undici-6.23.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jan 15, 2026

Copy link
Copy Markdown

Bumps undici from 6.22.0 to 6.23.0.

Release notes

Sourced from undici's releases.

v6.23.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

Commits
  • fbc31e2 Bumped v6.23.0
  • 3477c94 chore: release flow using provenance
  • d3aafea fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
  • See full diff in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/backend/undici-6.23.0 branch from e271355 to 03d2463 Compare January 21, 2026 09:53
Bumps [undici](https://github.com/nodejs/undici) from 6.22.0 to 6.23.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.22.0...v6.23.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.23.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/backend/undici-6.23.0 branch from 03d2463 to 6b912a4 Compare January 27, 2026 12:51
@github-actions

github-actions Bot commented Feb 5, 2026

Copy link
Copy Markdown

This PR is stale because it has been open 7 days with no activity. Remove stale label or comment or this will be closed in 21 days.

@github-actions github-actions Bot added the Stale label Feb 5, 2026
@github-actions github-actions Bot removed the Stale label Feb 25, 2026
@github-actions

github-actions Bot commented Mar 5, 2026

Copy link
Copy Markdown

This PR is stale because it has been open 7 days with no activity. Remove stale label or comment or this will be closed in 21 days.

@github-actions github-actions Bot added the Stale label Mar 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Mar 14, 2026

Copy link
Copy Markdown
Author

Superseded by #49.

@dependabot dependabot Bot closed this Mar 14, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/packages/backend/undici-6.23.0 branch March 14, 2026 05:57
alizard0 pushed a commit that referenced this pull request Jul 23, 2026
…oper#5044)

* docs(e2e): add E2E layer migration matrix (RHIDP-15076)

Phase-1 deliverable of RHIDP-15076 (E2E Test Optimization epic
RHIDP-13501): classifies all 30 e2e specs by target layer (L1-L4b),
maps which are supplementable by Layer 3 component tests or the
cluster-free L4a harness, and includes the companion analysis of the
rhdh-plugin-export-overlays test system. Referenced from the Jira
story's closing comment; updated 2026-07-02 with the L4a harness
validation results from PR redhat-developer#5005 (4 tests green cluster-free).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(e2e): address review — reconcile counts, durable references, README link

- Fix the Tally L3 count (10, not 9) so the column totals sum to the
  30-spec heading; reconcile the heading itself (29 on main + #19 pending
  in PR redhat-developer#4967).
- "runs 4 tests" -> "runs 2 specs (4 test cases)" — the doc's accounting
  unit is the spec; note that spec numbers refer to the matrix below.
- Soften "fully covers the 12 pure-backend workspaces" to load + API
  surface: scaffolder-backend-module-kubernetes also has a UI e2e that
  needs the render harness, so "fully" overstated the native-smoke scope.
- Replace short commit hashes and the fork-only
  RHIDP-13235-layer3-component-tests branch name with the durable PR
  reference (rhdh#4864, closed) — hashes on a mutable branch dangle after
  a rebase or branch deletion.
- Give DRAFT a promotion condition (groomed into RHIDP-13528/13529).
- Link the matrix from docs/e2e-tests/README.md ("Adding a Test") so the
  doc is discoverable outside the Jira comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(e2e): correct licensed-users-info blocker — internal backend plugin, not OCI

* docs(e2e): address review — fix spec count, dangling reference, dated wording

- 2026-07-07 update: 10 specs (not 9) — the list itself names ten files.
- Drop the positional "queue above" reference (the queue list no longer
  precedes it) and past-tense the 2026-07-02 "now runs" so the two dated
  updates stop contradicting each other.
- Self-date the PR redhat-developer#4967 "open" claim and add PR redhat-developer#5057 to References.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(e2e): record the merged overlays native smoke harness (redhat-developer#2714/redhat-developer#2731)

The companion analysis recommended rebuilding PR redhat-developer#2231's in-process idea on
the published CLI — that landed in the overlay repo on 2026-07-06/07 as
smoke-tests-native (overlays#2714, ~20x vs the Docker smoke) plus workspace
mode (overlays#2731), running as a dedicated native-smoke.yaml workflow
alongside the Docker one. Mark recommendation 1 as landed and add both PRs
to References.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(e2e): address review — reconcile landed-vs-target claims and stale count

- "Every remaining candidate landed" contradicted the #2 bullet in the same
  section — now "every candidate except #2".
- The native-harness recommendation read as if the full Docker-smoke
  replacement had shipped; scope it to what overlays#2714 landed (backend
  boots), with catalog-extending modules and the frontend bundle probe
  still pending (same qualifier in the bucket table).
- ROI paragraph still said 9 L3 candidates after the tally fix made it 10.
- Date-mark the pre-redhat-developer#2714 two-tier takeaway so it points at the update.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(e2e): correct redhat-developer#4864 status and refresh matrix against main

Re-verified the document against origin/main (2026-07-20):

- rhdh#4864 was **merged** on 2026-06-01, not "closed, not merged". The six
  Layer 3 tests are on main under packages/app/src — replace the prose
  descriptions with the actual file paths so the reference stays durable.
- Batch 1 no longer asks to "close out" #5/#6/#8/#9; that work landed.
- #18 github-happy-path is no longer a showcase `.fixme`; redhat-developer#5022 parked it at
  e2e-tests/playwright/blocked/github-happy-path.blocked.ts.
- Spell out how the "29 specs on main" count is composed (28 *.spec.ts + the
  blocked one) so it can be re-checked mechanically.
- Refresh dates; redhat-developer#4967 is still open as of 2026-07-20.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code Stale

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants