Skip to content

fix(deps): bump transitive undici to 6.29.0 and 7.30.0 - #26

Merged
maxgfr merged 1 commit into
mainfrom
fix-security-undici
Oct 5, 2026
Merged

maxgfr merged 1 commit into
mainfrom
fix-security-undici

Conversation

@maxgfr

@maxgfr maxgfr commented Oct 5, 2026

Copy link
Copy Markdown
Owner

Pourquoi

Le workflow Dependabot Updates échoue avec security_update_not_possible sur undici (alertes #16, #22, #23, #24). undici est une dépendance transitive de semantic-release, via @actions/http-client (6.x) et @semantic-release/github (7.x).

Changement

Le lockfile est mis à jour avec pnpm update undici --depth Infinity : undici passe de 6.28.0 à 6.29.0 et de 7.29.0 à 7.30.0, dans les plages déjà déclarées. @napi-rs/wasm-runtime passe aussi de 1.2.4 à 1.2.5 (patch). package.json n'est pas modifié.

Vérification

  • pnpm typecheck : OK
  • pnpm run check:build : OK, aucun diff sur les artefacts
  • pnpm test : 2088 tests OK. 2 échecs locaux (git-history, index-cache), identiques sur main non modifié en local : ils viennent de l'environnement, pas de ce changement.

Resolves Dependabot alerts #16, #22, #23, #24 (undici < 6.28.1 and
< 7.29.1), pulled in by semantic-release via @actions/http-client and
@semantic-release/github.
@maxgfr
maxgfr merged commit 74f1ad4 into main Oct 5, 2026
2 checks passed
@maxgfr
maxgfr deleted the fix-security-undici branch October 5, 2026 09:21
github-actions Bot pushed a commit that referenced this pull request Oct 5, 2026
## [2.31.3](v2.31.2...v2.31.3) (2026-10-05)

### Bug Fixes

* **deps:** bump transitive undici to 6.29.0 and 7.30.0 ([#26](#26)) ([74f1ad4](74f1ad4)), closes [#16](#16) [#22](#22) [#23](#23) [#24](#24)
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 2.31.3 🎉

The release is available on:

Your semantic-release bot 📦🚀

maxgfr added a commit that referenced this pull request Oct 12, 2026
Resolves Dependabot alerts #26, #27 and #28 (handlebars >= 4.0.0, <= 4.7.9), a dev-only transitive dependency of semantic-release.
github-actions Bot pushed a commit that referenced this pull request Oct 12, 2026
## [2.31.7](v2.31.6...v2.31.7) (2026-10-12)

### Bug Fixes

* **deps:** bump transitive handlebars to 4.7.10 ([#33](#33)) ([996a291](996a291)), closes [#26](#26) [#27](#27) [#28](#28)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant