Upgrades undici (npm) from 7.29.1, 8.11.2 to 8.12.2, which fixes these known vulnerabilities:
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-4qv8-2p9j-2685 | medium | 7.29.1 | 7.30.1 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| GHSA-f72v-6w45-q472 | medium | 7.29.1 | 7.30.1 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
| GHSA-xjj6-f33q-929c | high | 7.29.1 | 7.30.1 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| GHSA-4qv8-2p9j-2685 | medium | 8.11.2 | 8.12.2 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| GHSA-f72v-6w45-q472 | medium | 8.11.2 | 8.12.2 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
| GHSA-xjj6-f33q-929c | high | 8.11.2 | 8.12.2 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
Lockfiles changed: package-lock.json.
Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on a work item to make the change.
Opened by g1t's security updates. Turn them off for this project on its Security page.