Skip to content

Upgrade npm-undici to secure version in Ketch-React-Native#77

Open
smalexan wants to merge 4 commits intomainfrom
cursor/upgrade-npm-undici-to-secure-version-in-ketch-react-native-1ff3
Open

Upgrade npm-undici to secure version in Ketch-React-Native#77
smalexan wants to merge 4 commits intomainfrom
cursor/upgrade-npm-undici-to-secure-version-in-ketch-react-native-1ff3

Conversation

@smalexan
Copy link

@smalexan smalexan commented Jul 25, 2025 •
edited
Loading

https://ketch-com.atlassian.net/browse/KD-15837```
Fix: Upgrade @types/node to resolve npm-undici vulnerability

Description of this change

Upgrades @types/node to version ^24.1.0. This addresses a security vulnerability in npm-undici (specifically undici-types) by ensuring undici-types is at version >= 6.21.2.

Why is this change being made?

  • Chore (non-functional changes)
  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

How was this tested? How can the reviewer verify your testing?

The change was verified by successfully running yarn install after the @types/node upgrade, confirming no immediate dependency resolution issues or breaking changes during installation.

Related issues

https://ketch-com.atlassian.net/browse/KD-15837

Checklist

  • I have added tests to cover my changes.
  • All new and existing tests passed.
  • I have evaluated the security impact of this change, and OWASP Secure Coding Practices have been observed.
  • I have informed stakeholders of my changes.

---

[Open in Web](https://cursor.com/agents?id=bc-db8fd39a-2356-471e-870c-80a7533933ce) • [Open in Cursor](https://cursor.com/background-agent?bcId=bc-db8fd39a-2356-471e-870c-80a7533933ce)

Learn more about [Background Agents](https://docs.cursor.com/background-agent/web-and-mobile)

@cursoragent
fix: upgrade @types/node to resolve npm-undici vulnerability - KD-15845
80820ad 
- Upgraded @types/node from ^20.11.30 to ^24.1.0
- This resolves the npm-undici vulnerability by ensuring undici-types >= 6.21.2
- @types/node@24.1.0 uses undici-types@~7.8.0 which is well above the required version
- No breaking changes expected as this is a dev dependency upgrade
@smalexan smalexan marked this pull request as ready for review July 25, 2025 20:03
@smalexan smalexan requested review from a team as code owners July 25, 2025 20:03
@socket-security
Copy link

socket-security bot commented Jul 25, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​types/​node@​20.11.30 ⏵ 24.1.0100 +110080 +196100

View full report

jboileau99
jboileau99 previously approved these changes Jul 30, 2025
View reviewed changes
@smalexan smalexan enabled auto-merge (squash) July 30, 2025 23:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jboileau99 jboileau99 jboileau99 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@smalexan @jboileau99 @cursoragent