Update dependency undici to v7.24.0#2830
Conversation
gardener-ci-robot
requested review from
grolu,
holgerkoser and
klocke-io
as code owners
gardener-prow
bot
added
cla: yes
📝 WalkthroughWalkthroughThe pull request updates the Undici library version from "npm:7.22.0" to "npm:7.24.0" within the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
gardener-ci-robot
force-pushed
the
renovate/undici-7.x-lockfile
branch
from
caf1750 to
950b2d1
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.pnp.cjs:
- Line 1729: The commit message claims "Update dependency undici to v7.23.0" but
the .pnp.cjs entry ["undici", "npm:7.24.0"] (and other occurrences of 7.24.0)
show the actual change; fix this by either updating the commit message to state
v7.24.0 or reverting the .pnp.cjs entries for "undici" (the ["undici",
"npm:7.24.0"] symbol) back to 7.23.0 so it matches the commit title and the
intended change; ensure the chosen version still satisfies the
backend/package.json ^7.22.0 constraint and keep commit and code consistent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0c245318-5987-416d-925a-ae7ff4127d66
⛔ Files ignored due to path filters (2)
.yarn/cache/undici-npm-7.24.0-2d70a36f84-ccb2f3407a.zipis excluded by!**/.yarn/**,!**/*.zipyarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
.pnp.cjs
| ["socket.io-client", "npm:4.8.3"],\ | ||
| ["supertest", "npm:7.1.4"],\ | ||
| ["undici", "npm:7.22.0"],\ | ||
| ["undici", "npm:7.24.0"],\ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify undici v7.24.0 exists on npm and check the version in package.json
# Check if the version exists on npm
echo "Checking if undici@7.24.0 exists on npm..."
curl -s "https://registry.npmjs.org/undici/7.24.0" | jq -r '.version // "Version not found"'
# Check the semver range in backend/package.json
echo -e "\nChecking undici version constraint in backend/package.json..."
cat backend/package.json | jq -r '.dependencies.undici // "Not found"'Repository: gardener/dashboard
Length of output: 182
🏁 Script executed:
#!/bin/bash
# Search for PR-related metadata or any references to the version in commit messages/PRs
# Check git log for recent commits mentioning undici versions
echo "Recent commits mentioning undici..."
git log --oneline --all -20 | grep -i undici || echo "No recent commits found with 'undici'"
# Look for any PR/pull request related files
echo -e "\nSearching for PR-related files..."
find . -maxdepth 2 -type f \( -name "*PR*" -o -name "*pull*" -o -name ".github*" \) 2>/dev/null | head -20
# Check if there's a CHANGELOG or similar that might mention this change
echo -e "\nSearching for CHANGELOG or version-related documentation..."
find . -maxdepth 2 -type f \( -name "CHANGELOG*" -o -name "HISTORY*" -o -name "RELEASES*" \) 2>/dev/null
# Check git diff or git status to understand context
echo -e "\nChecking recent git history..."
git log --oneline -10Repository: gardener/dashboard
Length of output: 350
Update commit message to match actual version change.
The commit message states "Update dependency undici to v7.23.0", but the actual changes in .pnp.cjs show v7.24.0 at lines 1729 and 15332-15335. Either update the commit message to reflect v7.24.0, or correct the code to use v7.23.0. The version 7.24.0 is compatible with the ^7.22.0 constraint in backend/package.json, but the commit message must match the actual changes to avoid confusion during review and maintenance.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.pnp.cjs at line 1729, The commit message claims "Update dependency undici
to v7.23.0" but the .pnp.cjs entry ["undici", "npm:7.24.0"] (and other
occurrences of 7.24.0) show the actual change; fix this by either updating the
commit message to state v7.24.0 or reverting the .pnp.cjs entries for "undici"
(the ["undici", "npm:7.24.0"] symbol) back to 7.23.0 so it matches the commit
title and the intended change; ensure the chosen version still satisfies the
backend/package.json ^7.22.0 constraint and keep commit and code consistent.
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: grolu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
gardener-prow
bot
added
approved
|
LGTM label has been added. DetailsGit tree hash: aa2736d955bcc63c581971f2bc289ef5b8388350 |
2 participants
This PR contains the following updates:
7.22.0→7.24.0Release Notes
nodejs/undici (undici)
v7.24.0Compare Source
Undici v7.24.0 Security Release Notes
This release addresses multiple security vulnerabilities in Undici.
Upgrade guidance
All users on v7 should upgrade to v7.24.0 or later.
Fixed advisories
GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).
GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.
GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).
GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
CRLF injection via the
upgradeoption.GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
Unhandled exception from invalid
server_max_window_bitsin WebSocket permessage-deflate negotiation.GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
Unbounded memory consumption in WebSocket permessage-deflate decompression.
Affected and patched ranges
7.0.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.0>= 7.17.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.07.0.0 < 7.24.0, patched7.24.0References
v7.23.0Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v7.22.0...v7.23.0
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.