Skip to content

chore(deps): bump undici and danger in /tools/danger - #57

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tools/danger/multi-616b17cf2c
Closed

chore(deps): bump undici and danger in /tools/danger#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tools/danger/multi-616b17cf2c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps undici to 8.10.0 and updates ancestor dependency danger. These dependencies need to be updated together.

Updates undici from 7.28.0 to 8.10.0

Release notes

Sourced from undici's releases.

v8.10.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

v8.9.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

... (truncated)

Commits
  • c8d80e6 Bumped v8.10.0 (#5644)
  • 66923b4 fix: preserve DNS origin hostname on sockets (#5577)
  • 3926499 fix: retry refused HTTP/2 streams (#5598)
  • 73d6e9e fix(h2): detach upgrade close handler after GOAWAY (#5641)
  • b111adb fix(mock): emit request body lifecycle hooks (#5367)
  • ae4a3e3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5636)
  • ec3fbf1 build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 (#5634)
  • 2151720 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5633)
  • b96a116 fix(interceptors): allow interceptors without opts.origin (#5628)
  • a18ef2d fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r...
  • Additional commits viewable in compare view

Updates danger from 13.0.10 to 14.0.4

Changelog

Sourced from danger's changelog.

Main

14.0.0

Danger now installs undici 7 by default. undici is what Danger uses to talk to GitHub, GitLab and Bitbucket, and version 7 requires node 20.18.1 or newer — so for most people that is Danger's new effective minimum. Node 18 has not been dropped: you can pin undici back to the 6.x line yourself and everything keeps working. - [@​orta]

The reason for the switch is that it puts you in control of your own undici version. Previously Danger pinned undici to the 6.x line, so if a security advisory landed you had to wait for a Danger release to pick up the fix. undici is now an optional peer dependency accepting ^6.28.0 || ^7, which means moving it in either direction is a supported thing to do rather than a workaround.

  • github.reviews now reports the review states GitHub actually sends, so checking for a review that requested changes works - fixes #1443 [@​Socialpranker]
  • GitHub: Fetch all pages of pull request reviews #1383 [@​LeonMAG]
  • Upgrade to undici 6.27.0 to resolve transitive CVEs - fixes #1517 [@​rjatkins]
  • Breaking Default to undici 7, which raises the effective node requirement to 20.18.1. If you are on node 18, add "resolutions": { "undici": "^6.28.0" } (yarn), "overrides": { "undici": "^6.28.0" } (npm), or the same overrides block nested under "pnpm" (pnpm) to your package.json. [@​orta]
  • undici is now an optional peer dependency (^6.28.0 || ^7), so you can move it forward yourself to pick up security fixes without waiting for a Danger release [@​orta]
  • Removed the undici entry from Danger's own resolutions, which had no effect on people installing Danger [@​orta]
  • Danger now runs on node 24 and newer. Signing in as a GitHub App relied on a dependency that used a part of node removed in 24, which crashed Danger on startup before it could do any work. That signing is now done with node's own crypto, so the dependency (and the eleven packages it brought with it) is gone [@​orta]

13.0.9

  • Switch to use the native node-js fetch unidici

13.0.6

... (truncated)

Commits
  • afbc4c7 Release 14.0.4
  • 33a3889 Fix crash on node 24+ by dropping jsonwebtoken
  • c0b55a4 CHANGELOG for deploy
  • b3a7acd Default to undici 7, make it an optional peer dependency (#1529)
  • d763cb8 Fix GitHubReview state values to match the GitHub API (#1525)
  • d701f15 fix(github): paginate pull request reviews (#1528)
  • 532ea4b Run CI on Node 22 (#1526)
  • 003808d Merge pull request #1524 from glensc/unpin-versions
  • 676d44d Merge pull request #1520 from Socialpranker/docs/document-github-reviewers-in...
  • 2c3b5a9 Merge pull request #1522 from clates/lock-ts-6.0.3
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump undici and danger in /tools/danger
b01471f 
Bumps [undici](https://github.com/nodejs/undici) to 8.10.0 and updates ancestor dependency [danger](https://github.com/danger/danger-js). These dependencies need to be updated together.


Updates `undici` from 7.28.0 to 8.10.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v8.10.0)

Updates `danger` from 13.0.10 to 14.0.4
- [Release notes](https://github.com/danger/danger-js/releases)
- [Changelog](https://github.com/danger/danger-js/blob/main/CHANGELOG.md)
- [Commits](danger/danger-js@13.0.10...14.0.4)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.10.0
  dependency-type: indirect
- dependency-name: danger
  dependency-version: 14.0.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates javascript Pull requests that update javascript code labels Aug 24, 2026
@dependabot
dependabot Bot requested a review from ulises-jeremias as a code owner August 24, 2026 05:14
@dependabot dependabot Bot added dependencies Dependency updates javascript Pull requests that update javascript code labels Aug 24, 2026
@vercel

vercel Bot commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
website-3g7t Ready Ready Preview Aug 24, 2026 5:15am

@github-actions

github-actions Bot commented Aug 24, 2026

Copy link
Copy Markdown

🦙 MegaLinter status: ❌ ERROR

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 5 0 0 0.07s
✅ BASH bash-exec 1 0 0 0.0s
✅ BASH shellcheck 1 0 0 0.35s
⚠️ BASH shfmt 1 1 0 0.02s
✅ COPYPASTE jscpd yes no no 4.61s
❌ EDITORCONFIG editorconfig-checker 176 1 0 1.22s
✅ JAVASCRIPT standard 1 0 0 1.92s
✅ JSON jsonlint 10 0 0 0.25s
✅ JSON npm-package-json-lint yes no no 0.95s
✅ JSON prettier 10 0 0 0.71s
✅ JSON v8r 10 0 0 14.3s
✅ MARKDOWN markdownlint 10 0 0 1.17s
⚠️ MARKDOWN markdown-table-formatter 10 1 0 0.54s
✅ REPOSITORY checkov yes no no 18.09s
✅ REPOSITORY gitleaks yes no no 1.18s
✅ REPOSITORY git_diff yes no no 0.02s
✅ REPOSITORY secretlint yes no no 1.63s
❌ REPOSITORY trivy yes 1 no 13.01s
✅ REPOSITORY trufflehog yes no no 3.99s
❌ SPELL cspell 177 46 0 7.45s
⚠️ YAML prettier 13 1 2 0.89s
✅ YAML yamllint 13 0 0 0.61s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by OX Security

@github-actions

github-actions Bot commented Aug 24, 2026

Copy link
Copy Markdown
Fails
🚫 📋 Missing Section - Please include the section: ## Description in your PR description.
🚫 📋 Missing Section - Please include the section: ## Type of Change in your PR description.
🚫 📋 Missing Section - Please include the section: ## How Has This Been Tested? in your PR description.
🚫 📋 Missing Section - Please include the section: ## Checklist in your PR description.
Warnings
⚠️ 📋 Unchecked Checklist Item - Please check the item: My code follows the style guidelines of this project in your PR description.
⚠️ 📋 Unchecked Checklist Item - Please check the item: I have performed a self-review of my code in your PR description.
⚠️ 📋 Unchecked Checklist Item - Please check the item: I have commented my code, particularly in hard-to-understand areas in your PR description.
⚠️ 📋 Unchecked Checklist Item - Please check the item: I have made corresponding changes to the documentation in your PR description.
⚠️ 📋 Unchecked Checklist Item - Please check the item: My changes generate no new warnings in your PR description.
⚠️ 📋 Unchecked Checklist Item - Please check the item: Any dependent changes have been merged and published in downstream modules in your PR description.
⚠️ 📋 Unchecked Checklist Item - Please check the item: I have checked my code and corrected any misspellings in your PR description.
Messages
📖 Thanks! We ❤️ removing more lines than added!
📖 Thanks! We ❤️ small PRs!

Generated by 🚫 dangerJS against b01471f

@ulises-jeremias

ulises-jeremias commented Aug 25, 2026

Copy link
Copy Markdown
Member

Triage 2026-08-25 (maintenance sweep): BLOCKED — not safe to merge.

All 8 open dependabot PRs fail the same MegaLinter gate as main (32756066890):

  • cspell 46 errors (vmodules/vweb/… Spanish i18n, pnpm-lock) — needs combined .cspell.json allowlist PR
  • trivy HIGH vuln on pnpm-lock.yaml (brace-expansion CVE-2026-14257/69152, sharp→libvips) + tools/danger/package-lock.json undici CVE-2026-13697 — needs lockfile bump (none of these 8 PRs fixes all 3)
  • editorconfig-checker on public/install.sh / non-blocking markdown-table-formatter & yaml prettier
  • Danger / pr-review also failing (ts.transpileModule in danger bundle)

test/type-check/Vercel are green, so this is not a code regression from the dep bump. Keep open; do not merge until a combined cspell+trivy+editorconfig fix lands on main, then rebase these dependabots. One-per-lockfile-dir rule applies — batch by / vs /tools/danger.

Post-merge gate on main: tests ✅, type-check ✅, todo ✅, dynamic dependabot updates ✅, MegaLinter ❌ (same 3 linters). No merge attempted.

@ulises-jeremias

ulises-jeremias commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Closing as superseded by #62. Main now uses Danger 14.0.5 with undici 7.29.0, which fixes CVE-2026-13697 while remaining inside Danger 14.0.5's declared ^6.28.0 || ^7 peer range. The proposed undici 8 update is no longer required for remediation.

@dependabot @github

dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/tools/danger/multi-616b17cf2c branch August 26, 2026 19:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ulises-jeremias ulises-jeremias Awaiting requested review from ulises-jeremias ulises-jeremias is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ulises-jeremias