chore(deps): update dependency undici@<5.19.1 to v6 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici@<5.19.1 (source)	>=5.19.1 → >=6.23.0

GitHub Vulnerability Alerts

CVE-2023-45143

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

CVE-2024-24758

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

• https://fetch.spec.whatwg.org/#authentication-entries
• GHSA-wqq4-5wpv-mx2g

CVE-2024-30261

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in nodejs/undici@d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

CVE-2024-30260

Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

This has been patched in nodejs/undici@6805746.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

• https://hackerone.com/reports/2408074
• GHSA-3787-6prv-h9w3

CVE-2025-22150

Impact

Undici fetch() uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.

If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.

Patches

This is fixed in 5.28.5; 6.21.1; 7.2.3.

Workarounds

Do not issue multipart requests to attacker controlled servers.

References

• https://hackerone.com/reports/2913312
• https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f

CVE-2022-31150

Impact

It is possible to inject CRLF sequences into request headers in Undici.

const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})

The same applies to path and method

Patches

Update to v5.8.0

Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate \r\n.

References

https://hackerone.com/reports/409943
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

CVE-2022-31151

Impact

Authorization headers are already cleared on cross-origin redirect in
https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.

However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in v5.8.0.

Workarounds

By default, this vulnerability is not exploitable.
Do not enable redirections, i.e. maxRedirections: 0 (the default).

References

https://hackerone.com/reports/1635514
https://curl.se/docs/CVE-2018-1000007.html
https://curl.se/docs/CVE-2022-27776.html

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

CVE-2022-35949

Impact

undici is vulnerable to SSRF (Server-side Request Forgery) when an application takes in user input into the path/pathname option of undici.request.

If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1

const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})

Instead of processing the request as http://example.org//127.0.0.1 (or http://example.org/http://127.0.0.1 when http://127.0.0.1 is used), it actually processes the request as http://127.0.0.1/ and sends it to http://127.0.0.1.

If a developer passes in user input into path parameter of undici.request, it can result in an SSRF as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

Patches

This issue was fixed in undici@5.8.1.

Workarounds

The best workaround is to validate user input before passing it to the undici.request call.

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

CVE-2022-35948

Impact

=< undici@5.8.0 users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header.

Example:

import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})

The above snippet will perform two requests in a single request API call:

1. http://localhost:3000/
2. http://localhost:3000/foo2

Patches

This issue was patched in Undici v5.8.1

Workarounds

Sanitize input when sending content-type headers using user input.

For more information

If you have any questions or comments about this advisory:

• Open an issue in undici repository
• To make a report, follow the SECURITY document

CVE-2023-23936

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@​timon8) for reporting this vulnerability.

CVE-2023-24807

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

• https://hackerone.com/bugs?report_id=1784449

Credits

Carter Snook reported this vulnerability.

CVE-2025-47279

Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

Workarounds

If a webhook fails, avoid keep calling it repeatedly.

References

Reported as: https://github.com/nodejs/undici/issues/3895

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

• https://hackerone.com/reports/3456148
• GHSA-gm62-xv2j-4w53
• https://curl.se/docs/CVE-2022-32206.html

---

Release Notes

nodejs/undici (undici@<5.19.1)

v6.23.0

Compare Source

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

Compare Source

What's Changed

• fix: fix wrong stream canceled up after cloning (v6) by @​snyamathi in #​4414
• [Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @​github-actions[bot] in #​4432
• feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#​4180) by @​metcoder95 in #​4433
• feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#​4180) (#​4340) by @​metcoder95 in #​4445
• Backport 4472 to v6.x by @​Uzlopak in #​4480

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

v6.21.3

Compare Source

What's Changed

• [Backport v6.x] append crlf to formdata body by @​github-actions in #​4210

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

v6.21.2

Compare Source

What's Changed

• fix(types): add missing DNS interceptor by @​slagiewka in #​4024
• [v6.x] fix wpts on windows by @​mcollina in #​4093
• Removed clients with unrecoverable errors from the Pool #​4088

New Contributors

• @​slagiewka made their first contribution in #​4024

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

v6.21.1

Compare Source

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

• fix(#​3736): back-port 183f8e9 to v6.x by @​ggoodman in #​3855
• fix(#​3817): send servername for SNI on TLS (#​3821) [backport] by @​metcoder95 in #​3864
• fix: sending formdata bodies with http2 (#​3863) [backport] by @​metcoder95 in #​3866
• [Backport v6.x] fix: Fixed the issue that there is no running request when http2 goaway by @​github-actions in #​3877
• types: [backport] Update return type of RetryCallback (#​3851) by @​metcoder95 in #​3876

Full Changelog: nodejs/undici@v6.21.0...v6.21.1

v6.21.0

Compare Source

What's Changed

• [Backport v6.x] web: mark as uncloneable when possible (#​3709) by @​jazelly in #​3744
• [Backport v6.x] fetch: fix content-encoding order by @​github-actions in #​3764
• [Backport v6.x] fix: handle undefined deref() of WeakRef(socket) by @​github-actions in #​3822
• [Backport v6.x] fix: range end is zero-indexed by @​github-actions in #​3827

Full Changelog: nodejs/undici@v6.20.1...v6.21.0

v6.20.1

Compare Source

What's Changed

• [Backport v6.x] jsdoc: add jsdoc to lib/web/fetch/constants.js by @​github-actions in #​3710
• [Backport v6.x] feat: implement BodyReadable.bytes by @​github-actions in #​3711
• fix: add more expectsPayload methods by @​ronag in #​3715
• [Backport v6.x] chore(H2): onboard H2 into Undici queueing system (#​3707) by @​Uzlopak in #​3724
• [Backport v6.x] fix: PoolBase kClose and kDestroy should await and not return the Promise by @​github-actions in #​3723
• [Backport v6.x] fix: extract noop everywhere by @​Uzlopak in #​3727

Full Changelog: nodejs/undici@v6.20.0...v6.20.1

v6.20.0

Compare Source

What's Changed

• Remove patched dom types (v6.x branch) by @​eXhumer in #​3531
• docs(Backport v6.x): Fix signature of RetryHandler by @​github-actions in #​3594
• deps(dev): update @​types/node by @​metcoder95 in #​3618
• fix: throw on retry when payload is consume by downstream by @​github-actions in #​3596
• feat(Backport v6.x): move throwOnError to interceptor by @​github-actions in #​3595
• [Backport v6.x] fix: reduce memory usage in client-h1 by @​github-actions in #​3672
• [Backport v6.x] fix: refactor fast timers, fix UND_ERR_CONNECT_TIMEOUT on event loop blocking by @​github-actions in #​3673
• [Backport v6.x] fix: run asserts first if possible by @​github-actions in #​3674
• [Backport v6.x] fix: use fasttimers for all connection timeouts by @​github-actions in #​3675
• [Backport v6.x] ci: less flaky test/request-timeout.js test by @​github-actions in #​3678
• [Backport v6.x] test: less flaky timers acceptance test, rework fast timer tests to pass them faster by @​github-actions in #​3679
• [Backport v6.x] ignore leading and trailing crlfs in formdata body by @​github-actions in #​3681
• [Backport v6.x] mock: fix mocking of Uint8Array and ArrayBuffers as provided mock-responses by @​github-actions in #​3689
• [Backport v6.x] handle body errors by @​Uzlopak in #​3700

Full Changelog: nodejs/undici@v6.19.8...v6.20.0

v6.19.8

Compare Source

Full Changelog: nodejs/undici@v6.19.7...v6.19.8

v6.19.7

Compare Source

Full Changelog: nodejs/undici@v6.19.6...v6.19.7

v6.19.6

Compare Source

Full Changelog: nodejs/undici@v6.19.5...v6.19.6

v6.19.5

Compare Source

Full Changelog: nodejs/undici@v6.19.4...v6.19.5

v6.19.4

Compare Source

Full Changelog: nodejs/undici@v6.19.3...v6.19.4

v6.19.3

Compare Source

Full Changelog: nodejs/undici@v6.19.2...v6.19.3

v6.19.2

Compare Source

What's Changed

• fix #​3337 by @​KhafraDev in #​3338
• build: use husky as husky install is deprecated by @​jazelly in #​3340
• fix: interceptors.d.ts has no default export by @​Uzlopak in #​3332

Full Changelog: nodejs/undici@v6.19.1...v6.19.2

v6.19.1

Compare Source

What's Changed

• don't append empty origin by @​KhafraDev in #​3335

Full Changelog: nodejs/undici@v6.19.0...v6.19.1

v6.19.0

Compare Source

What's Changed

• build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @​dependabot in #​3305
• build(deps): bump codecov/codecov-action from 4.3.1 to 4.4.1 by @​dependabot in #​3303
• build(deps): bump step-security/harden-runner from 2.7.1 to 2.8.0 by @​dependabot in #​3304
• build(deps): bump github/codeql-action from 3.25.3 to 3.25.7 by @​dependabot in #​3306
• build(deps): bump node from 9e8f45f to dd7e693 in /build by @​dependabot in #​3309
• build(deps): bump node from dd7e693 to e6d4495 in /build by @​dependabot in #​3313
• remove websocket experimental warning by @​KhafraDev in #​3311
• perf: optimization of request instantiation by @​tsctx in #​3107
• perf: convert object to params by @​DarkGL in #​3302
• build(deps-dev): bump borp from 0.14.0 to 0.15.0 by @​dependabot in #​3320
• build(deps-dev): bump c8 from 9.1.0 to 10.0.0 by @​dependabot in #​3321
• fix: add missing error classes to types by @​maxbeatty in #​3316
• export interceptor to type def file by @​jakecastelli in #​3318
• build(deps): bump node from e6d4495 to 075a5cc in /build by @​dependabot in #​3326
• doc: clearify the behaviour of bodyTimeout in the request by @​jakecastelli in #​3324
• feature: support pre-shared sessions by @​tastypackets in #​3325

New Contributors

• @​maxbeatty made their first contribution in #​3316
• @​jakecastelli made their first contribution in #​3318

Full Changelog: nodejs/undici@v6.18.2...v6.19.0

v6.18.2

Compare Source

What's Changed

• don't use internal header state for cookies by @​KhafraDev in #​3295
• build(deps-dev): bump borp from 0.13.0 to 0.14.0 by @​dependabot in #​3298
• fix: retry on body support by @​metcoder95 in #​3294

Full Changelog: nodejs/undici@v6.18.1...v6.18.2

v6.18.1

Compare Source

What's Changed

• docs: Update references to dispatcher in docs by @​haikyuu in #​3281
• fix: compatibility for global headers by @​tsctx in #​3286
• websocket: pre-calculated length by @​tsctx in #​3284
• ci: fix autobahn workflow by @​Uzlopak in #​3291
• revert: "websocket: pre-calculated length" by @​KhafraDev in #​3290
• websocket: use FixedQueue instead of Set by @​tsctx in #​3283

New Contributors

• @​haikyuu made their first contribution in #​3281

Full Changelog: nodejs/undici@v6.18.0...v6.18.1

v6.18.0

Compare Source

What's Changed

• permessage-deflate decompression support in websocket by @​KhafraDev in #​3263
• fix: Fix server closing in tests. by @​ShogunPanda in #​3279

Full Changelog: nodejs/undici@v6.17.0...v6.18.0

v6.17.0

Compare Source

What's Changed

• fetch: fix captureStackTrace by @​Uzlopak in #​3227
• fetch: fix wpt test request-upload.any.js by @​Uzlopak in #​3234
• websocket: don't clone buffer by @​tsctx in #​3240
• Remove unecessary async from writeBuffer by @​DarkGL in #​3245
• refactor websocket control frame handling by @​KhafraDev in #​3241
• fix parsing continuation frames in websocket by @​KhafraDev in #​3247
• ci: node nightly test should use node 23 by @​Uzlopak in #​3248
• Add test to verify if the connection is correctly aborted on cancel by @​mcollina in #​3219
• Autobahn suite by @​KhafraDev in #​3251
• websocket: fix 6 autobahn tests by @​KhafraDev in #​3254
• websocket: checkout correct commit in autobahn workflow by @​Uzlopak in #​3258
• Cleanup websocket by @​KhafraDev in #​3257
• websocket: autobahn workflow should fail on error by @​Uzlopak in #​3259
• add bodymixin bytes by @​KhafraDev in #​3262
• perf: avoid buffer cloning by @​tsctx in #​3264
• feat: dump interceptor by @​metcoder95 in #​3118
• use private properties in Headers by @​KhafraDev in #​3269
• Revert "websocket: autobahn workflow should fail on error" by @​Uzlopak in #​3270
• build(deps): bump node from 487dc5d to 9e8f45f in /build by @​dependabot in #​3271

New Contributors

• @​DarkGL made their first contribution in #​3245

Full Changelog: nodejs/undici@v6.16.1...v6.17.0

v6.16.1

Compare Source

What's Changed

• fix some typos by @​Uzlopak in #​3217
• websocket: move codeblock in parseCloseBody by @​Uzlopak in #​3215
• fetch: enable wpt test request-referrer.any.js by @​Uzlopak in #​3223
• fetch: wpt add /fetch/api/resources/cache.py to server.mjs by @​Uzlopak in #​3225
• add pipe support for wpt server by @​KhafraDev in #​3228
• test: reduce the number of requests in fire-and-forget.js by @​tsctx in #​3229
• ci: add node 22 in ci test matrix, use 22 for coverage by @​Uzlopak in #​3226
• fetch: don't set an invalid origin header by @​KhafraDev in #​3235
• fail wpt runner if expected failures does not match actual by @​KhafraDev in #​3236
• fix: ignore content-length when dumping HEAD by @​ronag in #​3222

Full Changelog: nodejs/undici@v6.16.0...v6.16.1

v6.16.0

Compare Source

What's Changed

• add index to sequence converter errors by @​KhafraDev in #​3178
• build(deps-dev): bump borp from 0.12.0 to 0.13.0 by @​dependabot in #​3179
• build(deps): bump node from 21-alpine3.19 to 22-alpine3.19 in /build by @​dependabot in #​3180
• build(deps): bump superagent from 8.1.2 to 9.0.2 in /benchmarks by @​dependabot in #​3181
• fix: keep raw header name by @​tsctx in #​3183
• fix(fetch): improve Headers and Request type-compatibility by @​kettanaito in #​1964
• fix 3 mimesniff tests by @​KhafraDev in #​3185
• build(deps): bump hendrikmuhs/ccache-action from 1.2.12 to 1.2.13 by @​dependabot in #​3187
• build(deps): bump codecov/codecov-action from 4.1.1 to 4.3.1 by @​dependabot in #​3191
• build(deps): bump github/codeql-action from 3.24.9 to 3.25.3 by @​dependabot in #​3192
• build(deps): bump actions/dependency-review-action from 4.2.5 to 4.3.2 by @​dependabot in #​3189
• build(deps): bump step-security/harden-runner from 2.7.0 to 2.7.1 by @​dependabot in #​3188
• build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.3 by @​dependabot in #​3190
• build(deps): bump node from 9459e24 to 487dc5d in /build by @​dependabot in #​3195
• perf: avoid spread in makeRequest() by @​gunjam in #​3193
• refactor: code cleanup by @​tsctx in #​3194
• fix parsing when receiving empty body websocket by @​KhafraDev in #​3205
• fix: MockResponseCallbackOptions type by @​merojosa in #​2951
• docs(proxy): fix typo by @​kanadgupta in #​3207
• fix websocket receiving an invalid utf-8 in close frame by @​KhafraDev in #​3206
• perf: avoid setImmediate if body is reading by @​ronag in #​3210
• fix: request abort signal by @​ronag in #​3209
• fix: remove abort handler on close by @​ronag in #​3211
• fix: pass abort function by @​tsctx in #​3212
• websocket: 200x faster generate mask by @​tsctx in #​3204
• use FinalizationRegistry to cancel the body if response is collected by @​mcollina in #​3199
• websocket: don't clone buffer if it's not needed. by @​tsctx in #​3214
• websocket: use FastBuffer by @​tsctx in #​3213

New Contributors

• @​kettanaito made their first contribution in #​1964
• @​gunjam made their first contribution in #​3193
• @​merojosa made their first contribution in #​2951
• @​kanadgupta made their first contribution in #​3207

Full Changelog: nodejs/undici@v6.15.0...v6.16.0

v6.15.0

Compare Source

What's Changed

• Expose EnvHttpProxyAgent to Node.js core bundle, so it can be turned … by @​mcollina in #​3148
• test: add headerslist copy check by @​tsctx in #​3156
• chore: ensure automated v6 release compared to v6 by @​mweberxyz in #​3149
• fetch: do not leak signal listeners by @​mcollina in #​3158
• fix: request cache mode is not the same as request mode by @​tsibley in #​3151
• fetch: don't re-lowercase HeadersList by @​tsctx in #​3159
• fix casing issue when cloning Headers object by @​KhafraDev in #​3160
• build(deps): bump node from 6d0f18a to db8772d in /build by @​dependabot in #​3163
• fix header cloning bug by @​tsctx in #​3162
• chore: change bench naming for h2 by @​metcoder95 in #​3165
• expose WebSocket related events in node bundle by @​KhafraDev in #​3167
• feat: add support for if-match on retry handler by @​metcoder95 in #​3144
• fix: correct firing order of abort events by @​tsctx in #​3169
• create fast MessageEvent by @​KhafraDev in #​3170
• chore: add explicitly @​fastify/busboy by @​Uzlopak in #​3172
• chore: remove sinon as dev dependency by @​Uzlopak in #​3171
• webidl changes by @​KhafraDev in #​3175
• preserve dictionary key name in webidl errors by @​KhafraDev in #​3176

New Contributors

• @​tsibley made their first contribution in #​3151

Full Changelog: nodejs/undici@v6.14.1...v6.15.0

v6.14.1

Compare Source

What's Changed

• fix: tweak keep-alive timeout implementation by @​mweberxyz in #​3145
• build(deps-dev): bump borp from 0.11.0 to 0.12.0 by @​dependabot in #​3153
• build(deps): bump node from ad255c6 to 6d0f18a in /build by @​dependabot in #​3154
• fix(EnvHttpProxyAgent): prefer lowercase env vars by @​10xLaCroixDrinker in #​3152

Full Changelog: nodejs/undici@v6.14.0...v6.14.1

v6.14.0

Compare Source

What's Changed

• bench: enable benchmarks for h2 by @​metcoder95 in #​3100
• perf: improve performance of isomorphicEncode by @​tsctx in #​3101
• util: remove isReadableAborted by @​Uzlopak in #​3104
• fix(types): The second parameter of EventSource is optional by @​zbinlin in #​3106
• fix: onConnect types by @​ronag in #​3116
• add dispatcher option to EventSource by @​KhafraDev in #​3119
• core: improve parseURL by @​Uzlopak in #​3102
• test: increase coverage by @​Uzlopak in #​3121
• docs: add directions to run docs and benchmarks by @​FatumaA in #​3092
• perf: avoid unnecessary clone by @​tsctx in #​3117
• build(deps-dev): bump borp from 0.10.0 to 0.11.0 by @​dependabot in #​3126
• drop node support for < v18.17.0 by @​KhafraDev in #​3125
• test: improve test and ci performance by @​Uzlopak in #​3135
• Added EnvHttpProxyAgent to support HTTP_PROXY by @​10xLaCroixDrinker in #​2994
• fetch: Change wording of "Body is unusable" error by @​nzakas in #​3105
• perf: use class instead of object literals with getters by @​tsctx in #​3138
• fix: unhandled exception or failing error body by @​ronag in #​3137
• reuse realm for Request/Response by @​KhafraDev in #​3142
• fix(H2-#​3140): abort requets upon GOAWAY by @​metcoder95 in #​3143
• don't store realm on Request/Response by @​KhafraDev in #​3146
• improve: wasm build by @​Uzlopak in #​3074

New Contributors

• @​10xLaCroixDrinker made their first contribution in #​2994
• @​nzakas made their first contribution in #​3105

Full Changelog: nodejs/undici@v6.13.0...v6.14.0

v6.13.0

Compare Source

What's Changed

• build(deps): bump node from 9696b26 to ad255c6 in /build by @​dependabot in #​3073
• test: remove only by @​metcoder95 in #​3077
• fix: defer errors with setImmediate by @​ronag in #​3081
• improve DecoratorHandler by @​Uzlopak in #​3079
• chore: removed unused escapeFormDataName by @​mcollina in #​3084
• Mention option to pass streams into FormData by @​JaoodxD in #​3086
• fetch: improve performance of isValidEncodedURL by @​Uzlopak in #​3090
• optimize utf8Decode by @​Uzlopak in #​3085
• refactor: h2 refactoring by @​metcoder95 in #​3082
• Skip the creation of a transform stream in fetch by @​mcollina in #​3093
• fetch: improve performance of urlHasHttpsScheme by @​Uzlopak in #​3094
• fetch: avoid creation of an intermediary ReadableStream by @​KhafraDev in #​3095
• test: duplicate jest unspecific tests to native runner by @​Uzlopak in #​3075
• build(deps): bump node from ad255c6 to 6d0f18a in /build by @​dependabot in #​3096
• fetch: improve performance of isValidHeaderValue by @​Uzlopak in #​3098
• chore: automate releases with pr by @​mweberxyz in #​3089

New Contributors

• @​github-actions made their first contribution in #​3099

Full Changelog: nodejs/undici@v6.12.0...v6.13.0

v6.12.0

Compare Source

What's Changed

• fix: broken test by @​tsctx in #​3045
• fix: http2 header parsing by @​climba03003 in #​3047
• types: fix Request.refererPolicy and RequestInit.refererPolicy are incompatible by @​zbinlin in #​3039
• fix(types): onHeaders always takes headers as an array of buffer by @​ronag in #​3050
• fix: ProxyAgent causes request.headers.host to be forcibly reset by @​1zilc in [#​3026](https://redirect.github.com/nodejs/undi

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sentry]

Bug: The new pnpm override for undici conflicts with existing overrides, creating undefined dependency resolution behavior for overlapping version ranges.
_{Severity: MEDIUM}

Suggested Fix

Remove the conflicting pnpm override rules. The new override on line 53 ("undici@<5.19.1": ">=6.23.0") should be reconciled with the existing rules on lines 54-56 that force undici v5. Consolidate the overrides to have a single, clear rule for each version range to ensure deterministic dependency resolution.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L53-L56

Potential issue: The `package.json` file contains conflicting pnpm overrides for the
`undici` package. The new rule on line 53 (`"undici@<5.19.1": ">=6.23.0"`) forces
`undici` v6 for versions below 5.19.1. However, an existing rule on line 54
(`"undici@>=2.0.0 <5.19.1": ">=5.19.1"`) forces `undici` v5 for an overlapping range.
According to pnpm documentation, when multiple version ranges overlap, the resolution
behavior is undefined. This can lead to non-deterministic dependency resolution when
regenerating the lockfile or updating dependencies, potentially causing unexpected
versions of `undici` to be installed.

_{Did we get this right? 👍 / 👎 to inform future reviews.}