chore(deps): update dependency undici to v7.24.0 [security] by renovate[bot] · Pull Request #4040 · liam-hq/liam

renovate · 2026-01-14T22:14:34Z

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	`7.16.0` → `7.24.0`

GitHub Vulnerability Alerts

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

CVE-2026-1528

Impact

A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

There are no workarounds.

CVE-2026-1525

Impact

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
Applications that accept user-controlled header names without case-normalization

Potential consequences:

Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

If upgrading is not immediately possible:

Validate header names: Ensure no duplicate Content-Length headers (case-insensitive) are present before passing headers to undici
Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key
Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates

Release Notes

nodejs/undici (undici)

What's Changed

docs: fix syntax highlighting in WebSocket.md by @styfle in #4814
fix: use OR operator in includesCredentials per WHATWG URL Standard by @jackhax in #4816
feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk by @SuperOleg39 in #4676
fix: route WebSocket upgrades through onRequestUpgrade by @mcollina in #4787
build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by @dependabot[bot] in #4821
fix(deduplicate): do not deduplicate non-safe methods by default by @mcollina in #4818
feat: Support async cache stores in revalidation by @marcopiraccini in #4826

New Contributors

@jackhax made their first contribution in #4816
@marcopiraccini made their first contribution in #4826

Full Changelog: nodejs/undici@v7.21.0...v7.22.0

`v7.21.0`

Compare Source

What's Changed

build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by @dependabot[bot] in #4796
test: restore global dispatcher after fetch tests by @mcollina in #4790
Add missing close method to WebSocketStream interface by @piotr-cz in #4802
fix: error stream instead of canceling by @KhafraDev in #4804
Fix clientTtl cleanup race in Agent by @mcollina in #4807
feat(#4230): Implement pingInterval for dispatching PING frames by @metcoder95 in #4296
fix: handle undefined __filename in bundled environments by @mcollina in #4812
fix: set finalizer only for fetch responses by @tsctx in #4803

New Contributors

@piotr-cz made their first contribution in #4802

Full Changelog: nodejs/undici@v7.20.0...v7.21.0

`v7.20.0`

Compare Source

What's Changed

fix: preserve fetch stack traces by @mcollina in #4778
Fix error handling in MockPool example by @dave-kennedy in #4781
feat: expose statusText in request() ResponseData by @domenic in #4784
test: reduce retry-after invalid date flake by @mcollina in #4788
extractBody fixes by @KhafraDev in #4791
fix: MockAgent delayed response with AbortSignal (#4693) by @mcollina in #4772
fix: onParserTimeout potentially accessing undefined by @vbfox in #4758

New Contributors

@dave-kennedy made their first contribution in #4781
@vbfox made their first contribution in #4758

Full Changelog: nodejs/undici@v7.19.2...v7.20.0

`v7.19.2`

Compare Source

What's Changed

Minor code cleanups to decompress interceptor by @domenic in #4754
fix(h2): fix flaky stream end handling on macOS by @mcollina in #4762
return response when receiving 401 instead of network error by @KhafraDev in #4769
fix: properly close idle connections in test server cleanup by @mcollina in #4764
fix: decode HTTP headers as latin1 instead of utf8 by @mcollina in #4768
fix: submodule update by @Uzlopak in #4648
build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 by @dependabot[bot] in #4720

New Contributors

@domenic made their first contribution in #4754

Full Changelog: nodejs/undici@v7.19.1...v7.19.2

`v7.19.1`

Compare Source

What's Changed

fix: use commit hash when generating release (#4757) by @fenichelar in #4759
fix fetch 401 loop by @KhafraDev in #4761

New Contributors

@fenichelar made their first contribution in #4759

Full Changelog: nodejs/undici@v7.19.0...v7.19.1

`v7.19.0`

Compare Source

What's Changed

fix: Handle FormData body type correctly in RetryAgent retried requests by @eliotschu in #4692
feat(client): expose HTTP/2 flow-control options by @pabloelisseo in #4706
Implement origin normalization in MockAgent for case-insensitivity and URL handling by @SksOp in #4731
fix websocket basic auth by @KhafraDev in #4747
fix(cache): regenerate stream from source when cache.match is called after GC by @mcollina in #4713
chore: use testcontext for test:cache by @Uzlopak in #4571
chore: use testcontext for subresource integrity tests by @Uzlopak in #4575
feat(cache): add origins option for whitelist filtering by @mcollina in #4739
ci: test shared-builtin only on Node.js 24 and 25 by @mcollina in #4746
fix websocketstream open error by @KhafraDev in #4748

New Contributors

@eliotschu made their first contribution in #4692
@pabloelisseo made their first contribution in #4706
@SksOp made their first contribution in #4731

Full Changelog: nodejs/undici@v7.18.2...v7.19.0

`v7.18.2`

Compare Source

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in #4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

`v7.18.1`

Compare Source

What's Changed

Test and Fix running without SSL by @mcollina in #4727
docs: add security warning for strictContentLength option by @mcollina in #4726
build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in #4718
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

`v7.18.0`

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

`v7.17.0`

Compare Source

What's Changed

chore: extract infra and encoding methods by @Uzlopak in #4523
ci: remove h2 by @Uzlopak in #4534
ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in #4535
ci: fix nightly shared library case by @Uzlopak in #4543
test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in #4528
docs: add Cache Interceptor example to README by @tawseefnabi in #4393
test: remove node20 version check by @Uzlopak in #4544
types: use MessagePort instance type in MessageEvent by @Renegade334 in #4546
ci: set write permissions on job level by @Uzlopak in #4537
lint: activate n/no-process-exit by @Uzlopak in #4548
ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in #4536
chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in #4547
feat(H2): correct CONNECT behaviour by @metcoder95 in #4541
test: fix plans by @Uzlopak in #4550
feat: add runtime feature "detection" by @Uzlopak in #4545
perf: use less promises in extractBody by @Uzlopak in #4458
fix(proxy-agent): add missing return after callback-call by @Uzlopak in #4553
fix: remove redundant line in retry-handler by @Uzlopak in #4554
ci: add no-wasm-simd option by @Uzlopak in #4533
fix: use lazyloaders for runtime feature detection by @Uzlopak in #4557
fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in #4556
http2: refactor and split tests of http2.js into multiple files by @Uzlopak in #4561
fix: dns-interceptor test should await plan to complete by @Uzlopak in #4560
chore: remove istanbul instructions by @Uzlopak in #4559
fix: keep promise chains intact by @Uzlopak in #4558
build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @dependabot[bot] in #4567
chore: remove tspl from eventsource by @Uzlopak in #4569
chore: remove tspl from fetch by @Uzlopak in #4570
feat: add getUpstream() method to BalancedPool by @mcollina in #4586
fetch: handle invalid priority values properly by @Uzlopak in #4522
ci: fix test coverage for codecov by @Uzlopak in #4520
types: optional status in Response.redirect by @gineika in #4591
docs: unix socket add-on by @FelixVaughan in #4587
build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #4601
build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @dependabot[bot] in #4600
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4603
build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @dependabot[bot] in #4604
build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #4602
build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #4598
build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @dependabot[bot] in #4599
build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #4597
fix: cacheStores types and usage in README by @lucalooz in #4605
Feat dns interceptor storage by @SuperOleg39 in #4589
docs: add crawling best practices by @Uzlopak in #4590
fix: 304 not modified reply upon revalidation did not update cache. by @daan944 in #4617
chore: use testcontext for test:infra by @Uzlopak in #4579
fetch: improve regexes in data-uri.js by @Uzlopak in #4483
perf: optimize validate http token by @PandaWorker in #4608
test: improve long-lived-abort-controller test by @Uzlopak in #4621
ci: add node.js 25 to test matrix by @shivarm in #4626
chore: use testcontext for test/utils tests by @Uzlopak in #4577
chore: remove tspl from websocket by @Uzlopak in #4568
fix(ws) onSocketClose being called multiple times by @KhafraDev in #4632
fix: prevent duplicate debug logs when multiple undici instances exist by @mcollina in #4630
chore: use testcontext for busboy tests by @Uzlopak in #4572
test: fix flaky http2-dispatcher test by @mcollina in #4633
build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @dependabot[bot] in #4635
Run the gc() in long-lived-abort-controller test by @mcollina in #4638
Do not destroy the HTTP2 stream twice in tests by @mcollina in #4637
Fix http2-dispatcher test by @mcollina in #4640
fix: fetch blob with range off-by-one error by @platypii in #4643
fix: ensure HTTP/2 sends Content-Length for empty POST requests by @mcollina in #4613
build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @dependabot[bot] in #4645
feat(#2458): WebSocket through HTTP/2 by @metcoder95 in #4540
docs(README): correct the example code for the consumption of respons… by @tenkirin in #4658
build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #4653
build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @dependabot[bot] in #4655
build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #4652
build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #4651
build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @dependabot[bot] in #4654
don't freeze urlList for opaque filtered responses by @KhafraDev in #4656
fix fd parsing unquoted attribute values by @KhafraDev in #4662
build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @dependabot[bot] in #4665
feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @SuperOleg39 in #4659
Feat/round robin pool by @FelixVaughan in #4650
Formdata ignore epilogue preamble by @KhafraDev in #4672
build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #4682
fix: snapshot url exclusion by @FelixVaughan in #4670
feat: support h2c over unix domain sockets by @chrros95 in #4690
fix(docs): remove unused TypeScript example code block by @kerolloz in #4701
feat: add deduplicate interceptor for request deduplication by @mcollina in #4679
chore: use testcontext for mock tests by @Uzlopak in #4582
fix(test): remove hardcoded folder name in client-error-stack-trace test by @mcollina in #4707

New Contributors

@gineika made their first contribution in #4591
@lucalooz made their first contribution in #4605
@SuperOleg39 made their first contribution in #4589
@daan944 made their first contribution in #4617
@PandaWorker made their first contribution in #4608
@platypii made their first contribution in #4643
@tenkirin made their first contribution in #4658
@kerolloz made their first contribution in #4701

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-01-14T22:14:40Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
liam-app	Ready	Preview, Comment	Mar 14, 2026 9:05pm
liam-assets	Ready	Preview	Mar 14, 2026 9:05pm
liam-docs	Ready	Preview, Comment	Mar 14, 2026 9:05pm
liam-erd-sample	Ready	Preview	Mar 14, 2026 9:05pm
liam-storybook	Ready	Preview, Comment	Mar 14, 2026 9:05pm

giselles-ai · 2026-01-14T22:14:42Z

Finished running flow.

Step 1
🟢	On Pull Request Opened Status: Success Updated: Jan 14, 2026 10:14pm
Step 2
🟢	gpt-5 Status: Success Updated: Jan 14, 2026 10:16pm
Step 3
🟢	Create Pull Request Comment Status: Success Updated: Jan 14, 2026 10:16pm

coderabbitai · 2026-01-14T22:14:46Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

giselles-ai · 2026-01-14T22:16:34Z

Check changeset necessity

Status: NOT REQUIRED

Reason:

Only the root pnpm overrides and lockfile were updated to pin undici from 7.16.0 to 7.18.2; no package code or manifests for target packages (@liam-hq/cli, @liam-hq/erd-core, @liam-hq/schema, @liam-hq/ui) were changed.
This is a dependency bump for security hardening with no user-facing feature, API, or behavior changes in our published packages.
Lockfile and tooling/override adjustments do not affect consumers directly and are considered non-user-facing per the guide.

Changeset (copy & paste):

# No changeset required for this PR (dependency override/lockfile only).

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional flags.

renovate bot requested a review from a team as a code owner January 14, 2026 22:14

renovate bot requested review from NoritakaIkeda, junkisai and sasamuku and removed request for a team January 14, 2026 22:14

vercel bot deployed to Preview – liam-assets January 14, 2026 22:14 View deployment

vercel bot deployed to Preview – liam-erd-sample January 14, 2026 22:15 View deployment

vercel bot deployed to Preview – liam-storybook January 14, 2026 22:16 View deployment

vercel bot deployed to Preview – liam-docs January 14, 2026 22:16 View deployment

vercel bot deployed to Preview – liam-app January 14, 2026 22:19 View deployment

renovate bot force-pushed the renovate/npm-undici-vulnerability branch from dd15cf6 to 9edfb25 Compare January 19, 2026 17:41

vercel bot deployed to Preview – liam-assets January 19, 2026 17:41 View deployment

vercel bot deployed to Preview – liam-erd-sample January 19, 2026 17:41 View deployment

vercel bot deployed to Preview – liam-docs January 19, 2026 17:42 View deployment

vercel bot deployed to Preview – liam-storybook January 19, 2026 17:42 View deployment

vercel bot deployed to Preview – liam-app January 19, 2026 17:44 View deployment

renovate bot force-pushed the renovate/npm-undici-vulnerability branch from 9edfb25 to a75777d Compare January 23, 2026 17:43

vercel bot deployed to Preview – liam-assets January 23, 2026 17:43 View deployment

vercel bot deployed to Preview – liam-docs January 23, 2026 17:44 View deployment

devin-ai-integration bot reviewed Jan 23, 2026

View reviewed changes

vercel bot deployed to Preview – liam-storybook January 23, 2026 17:44 View deployment

vercel bot deployed to Preview – liam-erd-sample January 23, 2026 17:45 View deployment

vercel bot deployed to Preview – liam-app January 23, 2026 17:46 View deployment

renovate bot force-pushed the renovate/npm-undici-vulnerability branch from a75777d to 0236f47 Compare February 15, 2026 11:12

vercel bot deployed to Preview – liam-assets February 15, 2026 11:13 View deployment

vercel bot deployed to Preview – liam-erd-sample February 15, 2026 11:14 View deployment

vercel bot deployed to Preview – liam-storybook February 15, 2026 11:14 View deployment

vercel bot deployed to Preview – liam-docs February 15, 2026 11:14 View deployment

vercel bot deployed to Preview – liam-app February 15, 2026 11:18 View deployment

chore(deps): update dependency undici to v7.24.0 [security]

b3a24a6

renovate bot force-pushed the renovate/npm-undici-vulnerability branch from 0236f47 to b3a24a6 Compare March 14, 2026 21:01

renovate bot changed the title ~~chore(deps): update dependency undici to v7.18.2 [security]~~ chore(deps): update dependency undici to v7.24.0 [security] Mar 14, 2026

vercel bot deployed to Preview – liam-assets March 14, 2026 21:01 View deployment

vercel bot deployed to Preview – liam-erd-sample March 14, 2026 21:02 View deployment

vercel bot deployed to Preview – liam-storybook March 14, 2026 21:03 View deployment

vercel bot deployed to Preview – liam-docs March 14, 2026 21:03 View deployment

vercel bot deployed to Preview – liam-app March 14, 2026 21:05 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency undici to v7.24.0 [security]#4040

chore(deps): update dependency undici to v7.24.0 [security]#4040
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-undici-vulnerability

renovate bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

vercel bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

giselles-ai bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 14, 2026

Review skipped

Uh oh!

giselles-ai bot commented Jan 14, 2026

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

References

Impact

Patches

Workarounds

Impact

Patches

Workarounds

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

vercel bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giselles-ai bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Jan 14, 2026

Review skipped

Uh oh!

giselles-ai bot commented Jan 14, 2026

Check changeset necessity

Reason:

Changeset (copy & paste):

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 14, 2026 •

edited

Loading

vercel bot commented Jan 14, 2026 •

edited

Loading

giselles-ai bot commented Jan 14, 2026 •

edited

Loading