Skip to content

v1.0.2 — undici CVE patch

Choose a tag to compare

View all tags
@faraa2m faraa2m released this 12 May 04:25
· 61 commits to main since this release
v1.0.2
437a14f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

Patches 5 CVEs in the bundled GitHub Action runtime by upgrading bundled undici from 5.29.0 → 6.25.0 via root-level overrides field.

Severity GHSA Description
HIGH 7.5 GHSA-vrm6-8vpv-qv8q WebSocket memory exhaustion
HIGH 7.5 GHSA-v9p9-hfj2-hcw8 WebSocket unhandled exception
MODERATE GHSA-g9mf-h72j-4rw9 Fetch decompression chain
MODERATE GHSA-2mjp-6q6p-2qxm HTTP request/response smuggling
MODERATE GHSA-4992-7rv2-5pvq CRLF injection

`undici` is transitive via `@actions/github@6.0.1` → `@actions/http-client@2.2.3`. The 5.x line has no fix release; only path is the 6.x upgrade via `overrides`.

Affected surface

The vulnerable bundle was distributed via the GitHub Action Marketplace at `v1` and `v1.0.1` tags. Both tags previously pointed at commit `54f9f90` which bundled `undici@5.29.0`.

Action required for consumers

Marketplace consumers using `uses: faraa2m/tokenometer@v1` automatically receive the patch — the `v1` major tag has been force-moved to commit `6b23bd1` (the v1.1.0 release commit) which bundles `undici@6.25.0`.

Consumers who want the surgical CVE-only patch (no new features from v1.1.0) can pin to `uses: faraa2m/tokenometer@v1.0.2`.

Verification

229/229 workspace tests pass post-upgrade. `npm audit` clean for undici in the action workspace. Bundle smoke test: `dist/index.cjs` parses + loads + initializes undici 6.x cleanly.

Companion versions

  • `tokenometer@1.1.0` on npm (CLI + library, already published with the same patch + new features)
  • `@tokenometer/core@1.1.0` on npm (already published)
Assets 2
Loading