chore(deps): bump undici from 7.25.0 to 7.29.0 in /examples/with-mtls

[dependabot]

Bumps undici from 7.25.0 to 7.29.0.

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	d0574cc4
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	ea8930cf

---

... (truncated)

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• f9eba0a Bumped v7.28.0 (#5430)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[semgrepcode-auth0]

Risk: Affected versions of next are vulnerable to Server-Side Request Forgery (SSRF). This Next.js config defines a rewrites()/redirects() rule whose destination builds an external hostname from a dynamic :param segment. Because the segment is not constrained to hostname-safe characters, an attacker can inject a value (e.g. containing a dot) that escapes the intended hostname suffix, causing Next.js to proxy the request server-side to an arbitrary host (SSRF) or redirect the client to an attacker-controlled destination (open redirect). Constrain each dynamic segment used in a destination hostname to hostname-safe characters (e.g. [a-z0-9-]+), or upgrade Next.js.

Manual Review Advice: A vulnerability from this advisory is reachable if you define a rewrites() or redirects() rule in next.config.js whose destination hostname is assembled from a dynamic :param segment

Fix: Upgrade this library to at least version 16.2.11 at nextjs-auth0/examples/with-mtls/pnpm-lock.yaml:311.

Reference(s): GHSA-p9j2-gv94-2wf4

🌟 Fixed in commit 5341d2f 🌟

[semgrepcode-auth0]

Risk: Affected versions of next are vulnerable to Excessive Iteration. Next.js App Router validates multi-page-application (MPA) form submissions by iterating over every $ACTION_REF_-prefixed form field without an upper bound, decoding a bound-argument descriptor for each one. An attacker can POST a form containing a large number of these fields, forcing excessive CPU usage that blocks processing of further requests in the same process, resulting in a denial of service. Declaring any Server Action ("use server") registers it in the server module map and arms this handler.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using the App Router with at least one Server Action

Fix: Upgrade this library to at least version 16.2.11 at nextjs-auth0/examples/with-mtls/pnpm-lock.yaml:311.

Reference(s): GHSA-m99w-x7hq-7vfj

🎈 Fixed in commit 5341d2f 🎈

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.98%. Comparing base (badf948) to head (c21439a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2792   +/-   ##
=======================================
  Coverage   87.98%   87.98%           
=======================================
  Files          80       80           
  Lines       11514    11514           
  Branches     2385     2385           
=======================================
  Hits        10131    10131           
  Misses       1338     1338           
  Partials       45       45           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.