Use of Insufficiently Random Values in undici

[kientrant1]

Operating System

Window 11

Environment (if applicable)

Chrome

Firebase SDK Version

10.14.1

Firebase SDK Product(s)

Auth

Project Tooling

React

Detailed Problem Description

Use of Insufficiently Random Values in undici. See detail issue in GHSA-c76h-2ccp-4975

Steps and code to reproduce issue

See GHSA-c76h-2ccp-4975 for details.

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[dlarocque]

Hi @kientrant1, all usage of undici was removed in #8492, which was released in v11. The SDK now uses native fetch.

[kientrant1]

Hi @dlarocque Upgrading to version 11.x.x, it contains the main changes. Do we have any chances to fix it in version 10.x.x? Thanks!

[coderpradp]

@dlarocque Any chances to have 10.x.x use patched undici@6.21.1?

[dlarocque]

Hi @dlarocque Upgrading to version 11.x.x, it contains the main changes

Hey @kientrant1, what do you mean by 'it contains the main changes'? Is there something blocking you from upgrading to v11?

[dlarocque]

@dlarocque Any chances to have 10.x.x use patched undici@6.21.1?

@coderpradp Is there anything blocking you from upgrading to v11?

[coderpradp]

@dlarocque We use @angular/fire@18, which depends on firebase@10, in our Angular 18 project. Upgrading to firebase@11 requires @angular/fire@19, which in turn depends on Angular 19—an upgrade that hasn’t been approved for our project yet.