Skip to content

deps: update undici to latest v7.x release only#62739

Merged
aduh95 merged 1 commit intonodejs:v24.x-stagingfrom
mcollina:feat/undici-v7-filter
Apr 28, 2026
Merged

deps: update undici to latest v7.x release only#62739
aduh95 merged 1 commit intonodejs:v24.x-stagingfrom
mcollina:feat/undici-v7-filter

Conversation

@mcollina
Copy link
Copy Markdown
Member

Modify update-undici.sh to fetch all releases and filter to only v7.x releases, then select the latest one. This ensures we stay on the v7.x line and don't accidentally upgrade to v8 or later.

@mcollina mcollina requested a review from a team April 14, 2026 15:48
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added tools Issues and PRs related to the tools directory. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Apr 14, 2026
Comment thread tools/dep_updaters/update-undici.sh Outdated
Comment thread tools/dep_updaters/update-undici.sh Outdated
});
if (v7Releases.length === 0) throw new Error('No v7.x releases found');
// Sort by tag_name (prefixed with 'v') in descending order to get the latest first
v7Releases.sort((a, b) => b.tag_name.localeCompare(a.tag_name));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That will report e.g. v7.2.0 to be more recent than v7.10.0

@mcollina mcollina force-pushed the feat/undici-v7-filter branch 2 times, most recently from 6d90a9b to 1d8ad4e Compare April 14, 2026 16:12
@mcollina
Copy link
Copy Markdown
Member Author

@aduh95 good catch, fixed.

Comment thread tools/dep_updaters/update-undici.sh Outdated
Comment on lines +28 to +34
const v7Releases = releases.filter(r => {
const tag = r.tag_name.replace(/^v/, '');
return tag.startsWith('7.');
});
if (v7Releases.length === 0) throw new Error('No v7.x releases found');
// Sort by published_at (descending) to get the most recently published first
v7Releases.sort((a, b) => new Date(b.published_at) - new Date(a.published_at));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we switch to npm to get the last version number, from https://registry.npmjs.org/undici/seven? Would probably be less fragile

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It all comes from the same release pipeline. I didn't want to bring in semver as a dependency either.

Latest time on github seemed more final, given that the tag on npm can be changed at whim.

Copy link
Copy Markdown
Contributor

@aduh95 aduh95 Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not a dependency on semver, it's just an alternative source to get the version number.
It assumes the seven tag will be kept up-to-date on npm, but that seems like a reasonable assumption for a project we maintain ourselves. Worse that could happen is that the bot opens a PR for the wrong version, which should be easily catchable – especially given that we’ll have to run the workflow manually

@mcollina mcollina force-pushed the feat/undici-v7-filter branch from 1d8ad4e to e0c73eb Compare April 14, 2026 16:29
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 14, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.10%. Comparing base (c989497) to head (59326be).
⚠️ Report is 264 commits behind head on v24.x-staging.

Additional details and impacted files
@@                Coverage Diff                @@
##           v24.x-staging   #62739      +/-   ##
=================================================
+ Coverage          90.06%   90.10%   +0.03%     
=================================================
  Files                672      673       +1     
  Lines             201174   202277    +1103     
  Branches           39304    39569     +265     
=================================================
+ Hits              181197   182252    +1055     
+ Misses             12240    12226      -14     
- Partials            7737     7799      +62     

see 155 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mcollina mcollina force-pushed the feat/undici-v7-filter branch from 28f9225 to 59326be Compare April 28, 2026 09:05
@mcollina
Copy link
Copy Markdown
Member Author

@aduh95 PTAL

@mcollina mcollina added the commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. label Apr 28, 2026
@mcollina
Copy link
Copy Markdown
Member Author

mcollina commented Apr 28, 2026

I'm also preparing a new release of undici v7 to include here.

No biggie, this can land and ship.

Comment thread tools/dep_updaters/update-undici.sh Outdated
Signed-off-by: Matteo Collina <hello@matteocollina.com>
@aduh95 aduh95 force-pushed the feat/undici-v7-filter branch from 59326be to 212d24d Compare April 28, 2026 14:07
@aduh95 aduh95 merged commit cb67a92 into nodejs:v24.x-staging Apr 28, 2026
17 checks passed
@aduh95
Copy link
Copy Markdown
Contributor

aduh95 commented Apr 28, 2026

Landed in cb67a92

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

commit-queue-rebase Add this label to allow the Commit Queue to land a PR in several commits. tools Issues and PRs related to the tools directory. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants