chore(deps): Bump undici from 7.25.0 to 8.9.0

[dependabot]

Bumps undici from 7.25.0 to 8.9.0.

Release notes

Sourced from undici's releases.

v8.9.0

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in nodejs/undici#5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in nodejs/undici#5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in nodejs/undici#5534
• docs: clarify proxy threat model by @​mcollina in nodejs/undici#5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in nodejs/undici#5542
• docs: clarify parser timeout precision by @​vibhor-aggr in nodejs/undici#5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in nodejs/undici#5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in nodejs/undici#5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in nodejs/undici#5499
• docs: add custom interceptor example by @​vibhor-aggr in nodejs/undici#5548
• fix(h1): ignore type of service errors by @​mcollina in nodejs/undici#5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in nodejs/undici#5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in nodejs/undici#5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in nodejs/undici#5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in nodejs/undici#5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in nodejs/undici#5559
• fix(decompress): skip HEAD responses by @​Ram-blip in nodejs/undici#5564
• ci: build undici with node.js v26 by @​shivarm in nodejs/undici#5237
• docs: clarify top-level request option url fields by @​vibhor-aggr in nodejs/undici#5545
• test: add unexpected disconnect guards to http2 tests by @​Develop-KIM in nodejs/undici#5533
• fix: track origins by client map key in Agent teardown by @​emmayusufu in nodejs/undici#5537
• fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error by @​jeswr in nodejs/undici#5511
• fix(retry): handle Retry-After zero delay by @​Ram-blip in nodejs/undici#5519
• fix: honor stale-if-error on connection errors during revalidation by @​jeswr in nodejs/undici#5513
• fix: store revalidation-only responses so etag revalidation can engage by @​jeswr in nodejs/undici#5515
• fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefined kClient by @​mcollina in nodejs/undici#5546
• fix(h2): complete request stream on 'end' instead of waiting for 'close' by @​staylor in nodejs/undici#5560
• fix: invalidate Location and Content-Location URIs on unsafe methods by @​jeswr in nodejs/undici#5514
• test: deflake invalid websocket close status test by @​mcollina in nodejs/undici#5550
• refactor: replace tspl with node:test t.plan in connect-timeout tests by @​mcollina in nodejs/undici#5518
• fix(h2): release completed requests from queue by @​staylor in nodejs/undici#5569

New Contributors

• @​Develop-KIM made their first contribution in nodejs/undici#5534
• @​carlotestor made their first contribution in nodejs/undici#5499

... (truncated)

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pdpp	Ready	Preview	Jul 29, 2026 2:25am

[tnunamak]

Superseded by #50. Undici 8 requires a small public-dispatcher compatibility adaptation to retain SSRF address pinning.

Assisted-by: AI

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.