the-guard-bot
the-guard-bot copied to clipboard
Bump undici from 4.16.0 to 5.8.0
Bumps undici from 4.16.0 to 5.8.0.
Release notes
Sourced from undici's releases.
v5.8.0
⚠️ Security Fixes ⚠️
- CRLF injection in request path, method, and headers https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc, CVE CVE-2022-31150, reported by
@Haxatron
- Cookies uncleared on cross-host / cross-origin redirect https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp, CVE CVE-2022-31150, reported by
@Haxatron
What's Changed
- Drop PR title validation by
@mcollina
in nodejs/undici#1543- chore: exclude windows node 16 by
@mcollina
in nodejs/undici#1542- feat: use weighted round robin in balancedPool by
@jodevsa
in nodejs/undici#1069- Fix up
exclude
in CI by@dominykas
in nodejs/undici#1544- fix(mock utils): set Readable.abort by
@KhafraDev
in nodejs/undici#1549- fix(body mixin): only allow Uint8Array chunks by
@KhafraDev
in nodejs/undici#1550- docs: updated proxy docs - renamed already used const proxy to proxyServer by
@dancastillo
in nodejs/undici#1552New Contributors
@jodevsa
made their first contribution in nodejs/undici#1069@dancastillo
made their first contribution in nodejs/undici#1552Full Changelog: https://github.com/nodejs/undici/compare/v5.7.0...v5.7.1
v5.7.0
What's Changed
- fix(fetch): re-add support for node v16.8.0+ by
@KhafraDev
in nodejs/undici#1534- fix(Headers): lowercase name in
Headers.prototype.set
by@KhafraDev
in nodejs/undici#1535- fix: allow optional body for mock reply by
@JustinBeckwith
in nodejs/undici#1536- fix: faster direct read approach by
@jimmywarting
in nodejs/undici#1537- feat: update to llhttp v6.0.7 by
@mcollina
in nodejs/undici#1539New Contributors
@jimmywarting
made their first contribution in nodejs/undici#1537Full Changelog: https://github.com/nodejs/undici/compare/v5.6.1...v5.7.0
v5.6.1
What's Changed
- docs: add example with
HEAD
method to garbage collection section by@mrkldshv
in nodejs/undici#1522- fix: improper handling of relative location header by
@PrincessRavy
in nodejs/undici#1523- build(deps-dev): bump tsd from 0.21.0 to 0.22.0 by
@dependabot
in nodejs/undici#1530- fix(fetch): do not assign default value to
RequestInit.method
by@KhafraDev
in nodejs/undici#1529New Contributors
@mrkldshv
made their first contribution in nodejs/undici#1522@PrincessRavy
made their first contribution in nodejs/undici#1523Full Changelog: https://github.com/nodejs/undici/compare/v5.6.0...v5.6.1
v5.6.0
What's Changed
- build(deps-dev): bump tsd from 0.20.0 to 0.21.0 by
@dependabot
in nodejs/undici#1493
... (truncated)
Commits
26f60b7
Bumped v5.8.00a5bee9
Merge pull request from GHSA-q768-x9m6-m9qpa29a151
Merge pull request from GHSA-3cvr-822r-rqcc722976c
docs: updated proxy docs - renamed already used const proxy to proxyServer (#...b6af4e6
fix(body mixin): only allow Uint8Array chunks (#1550)6c9e634
fix(mock utils): set Readable.abort (#1549)22e2f39
ci: fix upexclude
(#1544)99205ec
feat: use weighted round robin in balancedPool (#1069)5b57e8c
chore: exclude windows node 16 (#1542)93e31a2
Drop PR title validation (#1543)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot ignore this major version
will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this minor version
will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this dependency
will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) -
@dependabot use these labels
will set the current labels as the default for future PRs for this repo and language -
@dependabot use these reviewers
will set the current reviewers as the default for future PRs for this repo and language -
@dependabot use these assignees
will set the current assignees as the default for future PRs for this repo and language -
@dependabot use this milestone
will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the Security Alerts page.