From f41605efbaf10782cd2001e77811fcc44c496a6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Mon, 3 Aug 2026 22:10:15 +0200 Subject: [PATCH] Close two high advisories on the outbound path `undici` moves to 8.10.0 and the `fast-uri` override rises to 3.1.5. Both were published as high after the last run on the trunk, so this is new information rather than neglect, and both matter here: undici is what backs `safeFetch`, which is the one documented egress boundary and the place the connect-time DNS-rebinding pin lives. The undici advisory is a cross-user information disclosure and a parse-time crash through degenerate private cache directives. `fast-uri` arrives four ways through transitive dependencies and the existing override was pinned one patch short of the fix. The safe-fetch dispatcher suite passes against the new client, which is the part that had to be checked rather than assumed: the pin reaches into undici's connect hook and a client bump is exactly where that could quietly stop being enforced. --- package.json | 2 +- pnpm-lock.yaml | 30 ++++++++++++++++++------------ pnpm-workspace.yaml | 3 ++- 3 files changed, 21 insertions(+), 14 deletions(-) diff --git a/package.json b/package.json index f5e418b02..9d72598ef 100644 --- a/package.json +++ b/package.json @@ -98,7 +98,7 @@ "sonner": "^2.0.7", "tailwind-merge": "^3.6.0", "tesseract.js": "^7.0.0", - "undici": "^8.5.0", + "undici": "^8.10.0", "web-push": "^3.6.7", "yaml": "^2.8.4", "zod": "^4.4.3", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b775affd4..53610029d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,7 +11,7 @@ overrides: hono@<4.12.25: ^4.12.25 picomatch@<4.0.4: ^4.0.4 body-parser@<2.3.0: ^2.3.0 - fast-uri@<3.1.3: ^3.1.3 + fast-uri@<3.1.5: ^3.1.5 sharp@<0.35.0: ^0.35.3 importers: @@ -154,8 +154,8 @@ importers: specifier: ^7.0.0 version: 7.0.0 undici: - specifier: ^8.5.0 - version: 8.5.0 + specifier: ^8.10.0 + version: 8.10.0 web-push: specifier: ^3.6.7 version: 3.6.7(supports-color@7.2.0) @@ -4595,8 +4595,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -6926,8 +6926,12 @@ packages: resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} - undici@8.5.0: - resolution: {integrity: sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==} + undici@8.10.0: + resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} + engines: {node: '>=22.19.0'} + + undici@8.9.0: + resolution: {integrity: sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA==} engines: {node: '>=22.19.0'} unicorn-magic@0.3.0: @@ -8702,7 +8706,7 @@ snapshots: '@openai/codex-sdk': 0.144.6 ajv: 8.20.0 extract-zip: 2.0.1(supports-color@7.2.0) - fast-uri: 3.1.4 + fast-uri: 3.1.5 fflate: 0.8.2 incur: 0.4.13 papaparse: 5.5.3 @@ -10553,7 +10557,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -11805,7 +11809,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fast-wrap-ansi@0.2.2: dependencies: @@ -14121,7 +14125,7 @@ snapshots: ssh-remote-port-forward: 1.0.4 tar-fs: 3.1.2 tmp: 0.2.7 - undici: 8.5.0 + undici: 8.9.0 transitivePeerDependencies: - bare-abort-controller - bare-buffer @@ -14293,7 +14297,9 @@ snapshots: undici@7.29.0: {} - undici@8.5.0: {} + undici@8.10.0: {} + + undici@8.9.0: {} unicorn-magic@0.3.0: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index d857da84d..787fdd102 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -5,7 +5,7 @@ overrides: "hono@<4.12.25": "^4.12.25" "picomatch@<4.0.4": "^4.0.4" "body-parser@<2.3.0": "^2.3.0" - "fast-uri@<3.1.3": "^3.1.3" + "fast-uri@<3.1.5": "^3.1.5" "sharp@<0.35.0": "^0.35.3" allowBuilds: @@ -26,3 +26,4 @@ minimumReleaseAgeExclude: - "@next/bundle-analyzer@16.2.12" - lucide-react@1.27.0 - "@openai/codex-security@0.1.1" + - undici@8.10.0