chore: bump undici from 5.24.0 to 5.28.3 #1022

dependabot · 2024-02-16T17:48:56Z

Bumps undici from 5.24.0 to 5.28.3.

Release notes

v5.28.3

⚠️ Security Release ⚠️

Fixes:

CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

fix: remove optional chainning for compatible with Nodejs12 and below by @bugb in nodejs/undici#2470

fix: remove node: prefix by @tsctx in nodejs/undici#2471

perf: avoid Headers initialization by @tsctx in nodejs/undici#2468

fix: handle SharedArrayBuffer correctly by @tsctx in nodejs/undici#2466

fix: Add null type to signal in RequestInit by @gebsh in nodejs/undici#2455

fix: correctly handle data URL with hashes. by @tsctx in nodejs/undici#2475

fix: check response for timinginfo allow flag by @ToshB in nodejs/undici#2477

Make call to onBodySent conditional in RetryHandler by @MzUgM in nodejs/undici#2478

refactor: better integrity check by @tsctx in nodejs/undici#2462

fix: Added support for inline URL username:password proxy auth by @matt-way in nodejs/undici#2473

build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @dependabot in nodejs/undici#2472

build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @dependabot in nodejs/undici#2405

build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @dependabot in nodejs/undici#2396

build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in nodejs/undici#2395

build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @dependabot in nodejs/undici#2392

build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @dependabot in nodejs/undici#2389

build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in nodejs/undici#2302

New Contributors

@bugb made their first contribution in nodejs/undici#2470

@gebsh made their first contribution in nodejs/undici#2455

@ToshB made their first contribution in nodejs/undici#2477

@MzUgM made their first contribution in nodejs/undici#2478

@matt-way made their first contribution in nodejs/undici#2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

What's Changed

perf: Improve normalizeMethod by @tsctx in nodejs/undici#2456

fix: dispatch error handling by @ronag in nodejs/undici#2459

perf(request): optimize if headers are given by @tsctx in nodejs/undici#2454

Full Changelog: nodejs/undici@v5.28.0...v5.28.1

v5.28.0

What's Changed

fix(parseHeaders): util.parseHeaders handle correctly array of buffer… by @mdoria12 in nodejs/undici#2398

... (truncated)

Commits

e71cb4c Bumped v5.28.3
20c65b8 Fix tests for Node.js v20.11.0 (#2618)
8ec52cd Fix tests for Node.js v21 (#2609)
d3aa574 Merge pull request from GHSA-3787-6prv-h9w3
9a14e5f Bumped v5.28.2
fcdfe87 build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 (#2302)
169c157 build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 (#2389)
9788177 build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 (#2392)
1f6d159 build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 (#2395)
a393a86 build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 (#2396)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
no qa required

Bumps [undici](https://github.com/nodejs/undici) from 5.24.0 to 5.28.3. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.24.0...v5.28.3) --- updated-dependencies: - dependency-name: undici dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | [`4.8.5` -> `4.9.0`](https://renovatebot.com/diffs/npm/@axe-core%2fplaywright/4.8.5/4.9.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/@axe-core%2fplaywright/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@axe-core%2fplaywright/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@axe-core%2fplaywright/4.8.5/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@axe-core%2fplaywright/4.8.5/4.9.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>dequelabs/axe-core-npm (@axe-core/playwright)</summary> ### [`v4.9.0`](https://github.com/dequelabs/axe-core-npm/releases/tag/v4.9.0): Release 4.9.0 [Compare Source](https://github.com/dequelabs/axe-core-npm/compare/v4.8.5...v4.9.0) #### What's Changed - docs(react): Update React support information by [@ballendq](https://github.com/ballendq) in [dequelabs/axe-core-npm#1004 - chore: merge master into develop by [@github-actions](https://github.com/github-actions) in [dequelabs/axe-core-npm#1016 - chore: bump husky from 8.0.3 to 9.0.10 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1006 - chore: remove circleci badge by [@michael-siek](https://github.com/michael-siek) in [dequelabs/axe-core-npm#1020 - chore: update `@wdio` dep and chromedriver by [@michael-siek](https://github.com/michael-siek) in [dequelabs/axe-core-npm#1029 - chore: bump express from 4.18.2 to 4.19.2 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1033 - chore: bump undici from 5.24.0 to 5.28.3 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1022 - chore: bump follow-redirects from 1.15.5 to 1.15.6 by [@dependabot](https://github.com/dependabot) in [dequelabs/axe-core-npm#1026 - ci: use `PAT` instead of GitHub Token when updating axe-core by [@michael-siek](https://github.com/michael-siek) in [dequelabs/axe-core-npm#1030 - feat: Update axe-core to v4.9.0 by [@github-actions](https://github.com/github-actions) in [dequelabs/axe-core-npm#1028 - fix: get correct new window handle with Selenium 3 workaround by [@scottmries](https://github.com/scottmries) in [dequelabs/axe-core-npm#1031 - chore: RC v4.9.0 by [@github-actions](https://github.com/github-actions) in [dequelabs/axe-core-npm#1036 - Release v4.9.0 by [@dequejenn](https://github.com/dequejenn) in [dequelabs/axe-core-npm#1040 #### New Contributors - [@ballendq](https://github.com/ballendq) made their first contribution in [dequelabs/axe-core-npm#1004 - [@scottmries](https://github.com/scottmries) made their first contribution in [dequelabs/axe-core-npm#1031 **Full Changelog**: dequelabs/axe-core-npm@v4.8.5...v4.9.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 10pm every weekday,before 6am every weekday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/camunda/zeebe).

dependabot bot requested a review from a team as a code owner February 16, 2024 17:48

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Feb 16, 2024

Merge branch 'develop' into dependabot/npm_and_yarn/undici-5.28.3

f9be2f3

michael-siek approved these changes Mar 30, 2024

View reviewed changes

michael-siek enabled auto-merge (squash) March 30, 2024 14:40

michael-siek merged commit 1308368 into develop Mar 30, 2024
31 of 32 checks passed

michael-siek deleted the dependabot/npm_and_yarn/undici-5.28.3 branch March 30, 2024 14:45

data-sync-user mentioned this pull request Jun 3, 2024

Bump @axe-core/react from 4.8.5 to 4.9.0 MozillaFoundation/foundation.mozilla.org#12152

Merged

gurudeep9 mentioned this pull request Jun 23, 2024

[Snyk] Upgrade @axe-core/playwright from 4.9.0 to 4.9.1 gurudeep9/mattermost-test#3

Open

aravindb26 mentioned this pull request Jul 16, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.8.2 to 4.9.1 aravindb26/spark#1

Open

Iir00d mentioned this pull request Jul 17, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 Iir00d/spark#1

Open

n1ghtmar3-6251 mentioned this pull request Jul 17, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 n1ghtmar3-6251/spark#1

Open

cbirdaha mentioned this pull request Jul 20, 2024

[Snyk] Upgrade @axe-core/playwright from 4.7.3 to 4.9.1 cbirdaha/PRfail82930#5

Open

aravindb26 mentioned this pull request Jul 22, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.8.2 to 4.9.1 aravindb26/spark#4

Open

Iir00d mentioned this pull request Jul 23, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 Iir00d/spark#5

Open

n1ghtmar3-6251 mentioned this pull request Jul 23, 2024

[Snyk] Upgrade @axe-core/webdriverjs from 4.7.3 to 4.9.1 n1ghtmar3-6251/spark#5

Open

This was referenced Sep 8, 2024

[Snyk] Upgrade: , hackme252/spark#2

Open

[Snyk] Upgrade: , hackme252/spark#3

Open

[Snyk] Upgrade: , hackme252/spark#4

Open

[Snyk] Upgrade: , hackme252/spark#5

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump undici from 5.24.0 to 5.28.3 #1022

chore: bump undici from 5.24.0 to 5.28.3 #1022

dependabot bot commented on behalf of github Feb 16, 2024 •

edited by michael-siek

Loading

chore: bump undici from 5.24.0 to 5.28.3 #1022

chore: bump undici from 5.24.0 to 5.28.3 #1022

Conversation

dependabot bot commented on behalf of github Feb 16, 2024 • edited by michael-siek Loading

v5.28.3

⚠️ Security Release ⚠️

v5.28.2

What's Changed

New Contributors

v5.28.1

What's Changed

v5.28.0

What's Changed

dependabot bot commented on behalf of github Feb 16, 2024 •

edited by michael-siek

Loading