[dependabot]

Bumps undici from 8.11.2 to 8.12.4.

Release notes

Sourced from undici's releases.

v8.12.4

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

A shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

A cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

fetch() could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

• docs: clarify that origin is optional only for origin-bound dispatchers by @​attilayener in nodejs/undici#5994
• fix(mock): ignore the trailing slash before a query string by @​lprnmns in nodejs/undici#6031
• build(deps-dev): bump eslint from 10.12.0 to 10.13.0 by @​dependabot[bot] in nodejs/undici#6059
• build(deps-dev): bump neostandard from 0.14.0 to 0.14.1 by @​dependabot[bot] in nodejs/undici#6058
• docs: add QUERY to the documented retry default methods by @​qodelicious in nodejs/undici#6062
• docs: fix a couple of typos by @​qodelicious in nodejs/undici#6057
• build(deps): bump cronometro from 6.0.3 to 7.0.1 in /benchmarks by @​dependabot[bot] in nodejs/undici#5969
• fix: let interim 1xx responses through DecoratorHandler by @​mrityunjay-pandey in nodejs/undici#6028
• fix(types): declare FormData prototype methods by @​RlxChap2 in nodejs/undici#6056
• fix(cache): ignore SQLITE_BUSY in the sqlite cache store by @​isHeSatoshi in nodejs/undici#6049
• fix(http2): keep persistent error sink on released streams by @​mcollina in nodejs/undici#5983
• fix(h2): replay requests whose HEADERS raced a GOAWAY by @​mohamed-rdr in nodejs/undici#6065
• build(deps-dev): bump @​fastify/busboy from 3.2.3 to 3.2.4 by @​dependabot[bot] in nodejs/undici#6102
• build(deps-dev): bump undici from 6.29.0 to 6.29.1 by @​dependabot[bot] in nodejs/undici#6103
• disable wasm SIMD on the RISC-V by @​hrw in nodejs/undici#6041
• fix(mock): expose aborted on the mock dispatch controller by @​santiago-su in nodejs/undici#5964
• fix(fetch): avoid eager reads from async iterable bodies by @​Kesavamoorthig06 in nodejs/undici#5990
• fix(h2): preserve accepted streams with deferred ids by @​EpicHigh in nodejs/undici#6090
• fix(fetch): preserve abort propagation after garbage collection by @​BridgeAR in nodejs/undici#6070

... (truncated)

Commits

• 779ee3e Bumped v8.12.4 (#6162)
• 10fa822 docs: remove security release notes
• 6228fc5 docs: add security release notes
• 1dd2657 test(cache): align redirect caching with hop policy
• 8ea1d61 fix(cache): detect an actual redirect, not a plain revalidation
• 4257261 test(cache): cover credentialed revalidation refresh
• aa7ccff fix(cache): treat proxy-authorization as a credential when caching redirects
• 8cf5ce1 test(cache): cover proxy-authorization credential on same-origin redirect
• 26c42c2 fix(cache): do not cache credential-bearing same-origin redirects under the a...
• e958661 test: cover decompress too-many-content-encodings throw on async cache replay
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

🟢 Approval recommended

No active review issues are identified, and the lockfile update cleanly applies the patched dependency version while removing obsolete transitive entries.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• docs/package-lock.json: Generated file

[github-actions]

🟢 Impact Analysis — PR #2395

Risk tier: 🟢 LOW

📊 Summary

Metric	Count
Files changed	1
Files added	0
Files modified	1
Files deleted	0
Modules touched	1

🎯 Risk Factors

• 1 files changed (≤5 → LOW)
• 1 module(s) touched (≤1 → LOW)

📦 Modules Affected

docs (1 file)

• docs/package-lock.json

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 43c21f3

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	3 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	4 check(s) still running

Files Changed (1 file, +3 −3)

File	+/−
docs/package-lock.json	+3 −3

Total: +3 −3

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.