From 6ecbb799638ab5d902b3a73f3fc623358ad2f5be Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 26 Aug 2026 00:38:28 +0000 Subject: [PATCH] net - chore: upgrade undici to 8.9.0 for CVE fixes Bump @cacheable/net's undici range from ^8.7.0 to ^8.9.0 and lock 8.10.0. This resolves CVE-2026-13697, CVE-2026-14643, CVE-2026-16728, CVE-2026-16729, and CVE-2026-15157 (8.7.0 => 8.9.0). undici remains type-only in @cacheable/net; fetch still uses Node's global fetch. Transitive undici copies from wrangler/miniflare/docula are unchanged. Co-authored-by: Jared Wray --- packages/net/package.json | 2 +- pnpm-lock.yaml | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/packages/net/package.json b/packages/net/package.json index 1a9300c2..e7c233e0 100644 --- a/packages/net/package.json +++ b/packages/net/package.json @@ -44,7 +44,7 @@ "cacheable": "workspace:^", "hookified": "^3.0.1", "http-cache-semantics": "^4.2.0", - "undici": "^8.7.0" + "undici": "^8.9.0" }, "keywords": [ "cacheable", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ca5d79f0..341628f8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -266,8 +266,8 @@ importers: specifier: ^4.2.0 version: 4.2.0 undici: - specifier: ^8.7.0 - version: 8.7.0 + specifier: ^8.9.0 + version: 8.10.0 devDependencies: '@types/http-cache-semantics': specifier: ^4.2.0 @@ -3659,12 +3659,12 @@ packages: resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} engines: {node: '>=20.18.1'} - undici@8.4.1: - resolution: {integrity: sha512-RNHlB4fxZK0IrkhBsxhlbx7s8kFWwr7rzzOqj5nvZugw3ig3RsB7KW3zVlV0eu8POl+rx5d1hmL7rRg0z1owow==} + undici@8.10.0: + resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} engines: {node: '>=22.19.0'} - undici@8.7.0: - resolution: {integrity: sha512-N7iQtfyLhIMOFgQubvmLV26svHpO0bqKnAiWotTQCVKCmWrcGbBotPuW1x+xwYZ2VHdSTVUfPQQnlEt1/LouTQ==} + undici@8.4.1: + resolution: {integrity: sha512-RNHlB4fxZK0IrkhBsxhlbx7s8kFWwr7rzzOqj5nvZugw3ig3RsB7KW3zVlV0eu8POl+rx5d1hmL7rRg0z1owow==} engines: {node: '>=22.19.0'} unenv@2.0.0-rc.24: @@ -7416,9 +7416,9 @@ snapshots: undici@7.28.0: {} - undici@8.4.1: {} + undici@8.10.0: {} - undici@8.7.0: {} + undici@8.4.1: {} unenv@2.0.0-rc.24: dependencies: