build(deps): bump undici from 6.8.0 to 6.11.1 #378

New Issue

MrUnknownDE · 2026-04-05T20:21:56+02:00

MrUnknownDE commented

2026-04-05 20:21:56 +02:00

Originally created by @dependabot[bot] on 4/4/2024

Bumps undici from 6.8.0 to 6.11.1.

Release notes

Sourced from undici's releases.

v6.11.1

⚠️ Security Release ⚠️

What's Changed

Fixes https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7 CVE-2024-30260

Fixes https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672 CVE-2024-30261

Revert "fix: don't leak internal class (#3024)" by @mcollina in nodejs/undici#3044

Full Changelog: https://github.com/nodejs/undici/compare/v6.11.0...v6.11.1

v6.11.0

What's Changed

refactor(#3023): Pass headers as array instead by @metcoder95 in nodejs/undici#3025

fix: don't leak internal class by @ronag in nodejs/undici#3024

build(deps): bump codecov/codecov-action from 4.1.0 to 4.1.1 by @dependabot in nodejs/undici#3034

build(deps-dev): bump tsd from 0.30.7 to 0.31.0 by @dependabot in nodejs/undici#3038

build(deps-dev): bump borp from 0.9.1 to 0.10.0 by @dependabot in nodejs/undici#2947

missing commits by @ronag in nodejs/undici#3040

build(deps): bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in nodejs/undici#3036

fix: regexp pattern by @tsctx in nodejs/undici#3041

Full Changelog: https://github.com/nodejs/undici/compare/v6.10.2...v6.11.0

v6.10.2

What's Changed

Do not fail test if streams support typed arrays by @mcollina in nodejs/undici#2978

fix(fetch): properly redirect non-ascii location header url by @Xvezda in nodejs/undici#2971

perf: Remove double-stringify in setCookie by @peterver in nodejs/undici#2980

[fix #2982] use DispatcherInterceptor type for Dispatcher#Compose by @clovis-guillemot in nodejs/undici#2983

fix: make EventSource properties enumerable by @MattBidewell in nodejs/undici#2987

docs: ✏️ fixed benchmark links by @benhalverson in nodejs/undici#2991

fix(#2986): bad start check by @metcoder95 in nodejs/undici#2992

fix(H2 Client): bind stream 'data' listener only after received 'response' event by @St3ffGv4 in nodejs/undici#2985

feat: added search input by @benhalverson in nodejs/undici#2993

chore: validate responses can be consumed without a Content-Length or… by @jacob-ebey in nodejs/undici#2995

fix error message by @KhafraDev in nodejs/undici#2998

Revert "perf: reuse TextDecoder instance (#2863)" by @panva in nodejs/undici#2999

test: remove only by @metcoder95 in nodejs/undici#3001

New Contributors

@Xvezda made their first contribution in nodejs/undici#2971

@peterver made their first contribution in nodejs/undici#2980

@clovis-guillemot made their first contribution in nodejs/undici#2983

@MattBidewell made their first contribution in nodejs/undici#2987

@benhalverson made their first contribution in nodejs/undici#2991

@St3ffGv4 made their first contribution in nodejs/undici#2985

@jacob-ebey made their first contribution in nodejs/undici#2995

... (truncated)

Commits

6df3c73 Bumped v6.11.1
c346b66 Revert "fix: don't leak internal class (#3024)"
d542b8c Merge pull request from GHSA-9qxr-qj54-h672
6805746 Merge pull request from GHSA-m4v8-wqvr-p9f7
ee5f892 Bumped v6.11.0
71a6d74 Merge branch 'main' of github.com:nodejs/undici
0f0f239 fix: regexp pattern (#3041)
31f9e67 build(deps): bump actions/checkout from 4.1.1 to 4.1.2 (#3036)
c8a43ae fixup
8b5e2c8 fixup
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

*Originally created by @dependabot[bot] on 4/4/2024* Bumps [undici](https://github.com/nodejs/undici) from 6.8.0 to 6.11.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v6.11.1</h2> <h1>:warning: Security Release ⚠️</h1> <h2>What's Changed</h2> <ul> <li>Fixes <a href="https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7">https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7</a> CVE-2024-30260</li> <li>Fixes <a href="https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672">https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672</a> CVE-2024-30261</li> <li>Revert "fix: don't leak internal class (<a href="https://redirect.github.com/nodejs/undici/issues/3024">#3024</a>)" by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3044">nodejs/undici#3044</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v6.11.0...v6.11.1">https://github.com/nodejs/undici/compare/v6.11.0...v6.11.1</a></p> <h2>v6.11.0</h2> <h2>What's Changed</h2> <ul> <li>refactor(<a href="https://redirect.github.com/nodejs/undici/issues/3023">#3023</a>): Pass headers as array instead by <a href="https://github.com/metcoder95"><code>@metcoder95</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3025">nodejs/undici#3025</a></li> <li>fix: don't leak internal class by <a href="https://github.com/ronag"><code>@ronag</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3024">nodejs/undici#3024</a></li> <li>build(deps): bump codecov/codecov-action from 4.1.0 to 4.1.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3034">nodejs/undici#3034</a></li> <li>build(deps-dev): bump tsd from 0.30.7 to 0.31.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3038">nodejs/undici#3038</a></li> <li>build(deps-dev): bump borp from 0.9.1 to 0.10.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2947">nodejs/undici#2947</a></li> <li>missing commits by <a href="https://github.com/ronag"><code>@ronag</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3040">nodejs/undici#3040</a></li> <li>build(deps): bump actions/checkout from 4.1.1 to 4.1.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3036">nodejs/undici#3036</a></li> <li>fix: regexp pattern by <a href="https://github.com/tsctx"><code>@tsctx</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3041">nodejs/undici#3041</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v6.10.2...v6.11.0">https://github.com/nodejs/undici/compare/v6.10.2...v6.11.0</a></p> <h2>v6.10.2</h2> <h2>What's Changed</h2> <ul> <li>Do not fail test if streams support typed arrays by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2978">nodejs/undici#2978</a></li> <li>fix(fetch): properly redirect non-ascii location header url by <a href="https://github.com/Xvezda"><code>@Xvezda</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2971">nodejs/undici#2971</a></li> <li>perf: Remove double-stringify in setCookie by <a href="https://github.com/peterver"><code>@peterver</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2980">nodejs/undici#2980</a></li> <li>[fix <a href="https://redirect.github.com/nodejs/undici/issues/2982">#2982</a>] use DispatcherInterceptor type for Dispatcher#Compose by <a href="https://github.com/clovis-guillemot"><code>@clovis-guillemot</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2983">nodejs/undici#2983</a></li> <li>fix: make EventSource properties enumerable by <a href="https://github.com/MattBidewell"><code>@MattBidewell</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2987">nodejs/undici#2987</a></li> <li>docs: ✏️ fixed benchmark links by <a href="https://github.com/benhalverson"><code>@benhalverson</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2991">nodejs/undici#2991</a></li> <li>fix(<a href="https://redirect.github.com/nodejs/undici/issues/2986">#2986</a>): bad start check by <a href="https://github.com/metcoder95"><code>@metcoder95</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2992">nodejs/undici#2992</a></li> <li>fix(H2 Client): bind stream 'data' listener only after received 'response' event by <a href="https://github.com/St3ffGv4"><code>@St3ffGv4</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2985">nodejs/undici#2985</a></li> <li>feat: added search input by <a href="https://github.com/benhalverson"><code>@benhalverson</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2993">nodejs/undici#2993</a></li> <li>chore: validate responses can be consumed without a Content-Length or… by <a href="https://github.com/jacob-ebey"><code>@jacob-ebey</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2995">nodejs/undici#2995</a></li> <li>fix error message by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2998">nodejs/undici#2998</a></li> <li>Revert "perf: reuse TextDecoder instance (<a href="https://redirect.github.com/nodejs/undici/issues/2863">#2863</a>)" by <a href="https://github.com/panva"><code>@panva</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/2999">nodejs/undici#2999</a></li> <li>test: remove only by <a href="https://github.com/metcoder95"><code>@metcoder95</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/3001">nodejs/undici#3001</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Xvezda"><code>@Xvezda</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/2971">nodejs/undici#2971</a></li> <li><a href="https://github.com/peterver"><code>@peterver</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/2980">nodejs/undici#2980</a></li> <li><a href="https://github.com/clovis-guillemot"><code>@clovis-guillemot</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/2983">nodejs/undici#2983</a></li> <li><a href="https://github.com/MattBidewell"><code>@MattBidewell</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/2987">nodejs/undici#2987</a></li> <li><a href="https://github.com/benhalverson"><code>@benhalverson</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/2991">nodejs/undici#2991</a></li> <li><a href="https://github.com/St3ffGv4"><code>@St3ffGv4</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/2985">nodejs/undici#2985</a></li> <li><a href="https://github.com/jacob-ebey"><code>@jacob-ebey</code></a> made their first contribution in <a href="https://redirect.github.com/nodejs/undici/pull/2995">nodejs/undici#2995</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/6df3c738d03dc4014a26640316bf699950d62024"><code>6df3c73</code></a> Bumped v6.11.1</li> <li><a href="https://github.com/nodejs/undici/commit/c346b66287c873f3c81a71b3cedd2bb222c4bb8b"><code>c346b66</code></a> Revert "fix: don't leak internal class (<a href="https://redirect.github.com/nodejs/undici/issues/3024">#3024</a>)"</li> <li><a href="https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3"><code>d542b8c</code></a> Merge pull request from GHSA-9qxr-qj54-h672</li> <li><a href="https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75"><code>6805746</code></a> Merge pull request from GHSA-m4v8-wqvr-p9f7</li> <li><a href="https://github.com/nodejs/undici/commit/ee5f892f3955eaca37730ed30349153ba203e9cd"><code>ee5f892</code></a> Bumped v6.11.0</li> <li><a href="https://github.com/nodejs/undici/commit/71a6d749b200e25359fdb0142dd398bfa52dc46d"><code>71a6d74</code></a> Merge branch 'main' of github.com:nodejs/undici</li> <li><a href="https://github.com/nodejs/undici/commit/0f0f239d939ec617ac4f4278c6f64fccc8928283"><code>0f0f239</code></a> fix: regexp pattern (<a href="https://redirect.github.com/nodejs/undici/issues/3041">#3041</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/31f9e67368bf98464c7d99eac08a63894ddc05f9"><code>31f9e67</code></a> build(deps): bump actions/checkout from 4.1.1 to 4.1.2 (<a href="https://redirect.github.com/nodejs/undici/issues/3036">#3036</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/c8a43aed8e08e278471eb7dee27b5d782098a7bc"><code>c8a43ae</code></a> fixup</li> <li><a href="https://github.com/nodejs/undici/commit/8b5e2c8f3667c2fdfbcf956b20bcaa159ab8082f"><code>8b5e2c8</code></a> fixup</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v6.8.0...v6.11.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=undici&package-manager=npm_and_yarn&previous-version=6.8.0&new-version=6.11.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/pyrohost/panel/network/alerts). </details>

MrUnknownDE closed this issue

2026-04-05 20:21:56 +02:00

Sign in to join this conversation.

Branches Tags

main

redesign-amy

dependabot/composer/composer-a63f04cb24

transfer-queue

releases/v4.5.1

dependabot/npm_and_yarn/eslint-9.38.0

dependabot/npm_and_yarn/hcaptcha/react-hcaptcha-1.14.0

releases/v4.5.0

dependabot/npm_and_yarn/vitejs/plugin-react-swc-4.2.0

dependabot/npm_and_yarn/vite-7.1.12

dependabot/npm_and_yarn/browserslist-4.27.0

releases/v4.4.1

releases/v4.4.0

releases/v4.3.0

releases/v4.2.2

releases/v4.2.1

releases/v4.2.0

async-backups

releases/v4.1.0

releases/v4.0.0

multi-language

dependabot/npm_and_yarn/npm_and_yarn-34180670f1

subdomains

dev-old

dependabot/npm_and_yarn/eslint-plugin-prettier-5.5.4

elytra

startup-command

overhead-memory

amy/pyro-143-ui-redesign

naterfute/fix_unit_tests

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pyrodactyl#378