joeyr
released this
2026-10-02 12:40:57 -05:00
| 5 commits to main since this release
Security
undici 8.10.0 → 8.11.2, and the range floor raised from ^8.5.0 to
^8.11.2 so it can no longer resolve to an affected version. Eleven HIGH
advisories landed against 8.0.0–8.10.1 (WebSocket and decompression DoS,
retry-interceptor response splitting, shared-cache cookie disclosure and
cache poisoning, a BalancedPool TLS-validation bypass, and others). The
app's one call site is a plain request() on the default dispatcher, which
uses none of the WebSocket, retry, cache, dump or BalancedPool paths they
name, but the CI gate's npm audit --omit=dev --audit-level=high step
failed on them, so CI had been red since 4.8.1. 4.8.1 and 4.8.2 shipped
with the affected version.
Downloads