[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	8.12.2 → 8.12.4

---

Release Notes

nodejs/undici (undici)

v8.12.4

Compare Source

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

A shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

A cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

fetch() could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

• docs: clarify that origin is optional only for origin-bound dispatchers by @​attilayener in #​5994
• fix(mock): ignore the trailing slash before a query string by @​lprnmns in #​6031
• build(deps-dev): bump eslint from 10.12.0 to 10.13.0 by @​dependabot[bot] in #​6059
• build(deps-dev): bump neostandard from 0.14.0 to 0.14.1 by @​dependabot[bot] in #​6058
• docs: add QUERY to the documented retry default methods by @​qodelicious in #​6062
• docs: fix a couple of typos by @​qodelicious in #​6057
• build(deps): bump cronometro from 6.0.3 to 7.0.1 in /benchmarks by @​dependabot[bot] in #​5969
• fix: let interim 1xx responses through DecoratorHandler by @​mrityunjay-pandey in #​6028
• fix(types): declare FormData prototype methods by @​RlxChap2 in #​6056
• fix(cache): ignore SQLITE_BUSY in the sqlite cache store by @​isHeSatoshi in #​6049
• fix(http2): keep persistent error sink on released streams by @​mcollina in #​5983
• fix(h2): replay requests whose HEADERS raced a GOAWAY by @​mohamed-rdr in #​6065
• build(deps-dev): bump @​fastify/busboy from 3.2.3 to 3.2.4 by @​dependabot[bot] in #​6102
• build(deps-dev): bump undici from 6.29.0 to 6.29.1 by @​dependabot[bot] in #​6103
• disable wasm SIMD on the RISC-V by @​hrw in #​6041
• fix(mock): expose aborted on the mock dispatch controller by @​santiago-su in #​5964
• fix(fetch): avoid eager reads from async iterable bodies by @​Kesavamoorthig06 in #​5990
• fix(h2): preserve accepted streams with deferred ids by @​EpicHigh in #​6090
• fix(fetch): preserve abort propagation after garbage collection by @​BridgeAR in #​6070
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in #​6125
• build(deps): bump step-security/harden-runner from 2.21.1 to 2.22.3 by @​dependabot[bot] in #​6127
• build(deps-dev): bump node-forge from 1.4.0 to 1.4.2 by @​dependabot[bot] in #​6134
• build(deps-dev): bump jsondiffpatch from 0.7.6 to 0.7.7 by @​dependabot[bot] in #​6140

New Contributors

• @​attilayener made their first contribution in #​5994
• @​lprnmns made their first contribution in #​6031
• @​RlxChap2 made their first contribution in #​6056
• @​isHeSatoshi made their first contribution in #​6049
• @​mohamed-rdr made their first contribution in #​6065
• @​hrw made their first contribution in #​6041
• @​santiago-su made their first contribution in #​5964
• @​EpicHigh made their first contribution in #​6090

Full Changelog: nodejs/undici@v8.12.3...v8.12.4

v8.12.3

Compare Source

What's Changed

• ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in #​6029
• build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in #​6006
• build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in #​5967
• docs: document the options of interceptors.cache() by @​qodelicious in #​6050
• fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in #​6052
• fix(pool): keep caller async context for queued requests by @​mcollina in #​5982

New Contributors

• @​qodelicious made their first contribution in #​6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 300a716a-6574-42f8-bf9d-47d1650d3e20

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	undici@​8.12.2 ⏵ 8.12.4			+1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.77%. Comparing base (b7625ff) to head (1b5fe24).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #958   +/-   ##
=======================================
  Coverage   94.77%   94.77%           
=======================================
  Files          10       10           
  Lines         746      746           
  Branches      235      235           
=======================================
  Hits          707      707           
  Misses         36       36           
  Partials        3        3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/node-modules/urllib@958

commit: 1b5fe24

[fengmk2]

@copilot fix ci fail

[Copilot]

@copilot fix ci fail

The macOS and Windows jobs failed on an unhandled read ECONNRESET. It came from the server-side TLS socket in should timeout on h2, and all the tests themselves passed. I added a no-op error handler on the server's secureConnection socket in test/options.timeout.test.ts. I couldn't run the tests in this sandbox because dependencies aren't installed, so the fix is untested until CI runs.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[fengmk2]

@copilot ci still fail

[Copilot]

@copilot ci still fail

My first fix was wrong, so CI still failed. The unhandled read ECONNRESET in should timeout on h2 is probably coming from the client socket, not the server one. undici 8.12.3+ now replaces an unresponsive h2 connection after a stream timeout. I now attach a no-op error listener to client sockets through the undici:client:connected diagnostics channel in test/options.timeout.test.ts. The test passes and vp check is clean on Linux. I can't reproduce the ECONNRESET on Linux, so this is untested on macOS and Windows until CI runs; if it still fails, the cause is elsewhere.

The check job also fails, but for an unrelated reason. The zizmor step reports hash-pin version comment mismatches on voidzero-dev/setup-vp ... # main in the workflow files. I left that alone because it isn't caused by this PR.