chore(deps): bump undici from 8.5.0 to 8.9.0 - #566
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [undici](https://github.com/nodejs/undici) from 8.5.0 to 8.9.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.5.0...v8.9.0) --- updated-dependencies: - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Test Coverage ReportOverall Coverage: 96.84%
|
Member
|
Superseded by #571, which applies all pending dependency updates in one pass. |
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
polaz
added a commit
that referenced
this pull request
Aug 8, 2026
* fix(logging): never write logs to stdout in stdio mode - LOG_JSON=true previously created a bare pino instance that wrote NDJSON log lines to stdout, corrupting the MCP JSON-RPC channel in stdio transport mode; logs are now forced to stderr whenever the server runs on stdio, for both plain and JSON formats - add LOG_DESTINATION=stdout|stderr override for HTTP mode; defaults keep the container convention (pretty to stderr, NDJSON to stdout) - fix LOG_FORMAT rendering: messageFormat crossed the worker-thread transport boundary, duplicating the prefix and printing 'undefined' for the level; format tokens now drive field visibility via ignore list only - document LOG_FORMAT and LOG_DESTINATION plus a destination matrix in the configuration guide Closes #563 * chore(deps): update all dependencies across workspaces Applies every pending Dependabot update in one pass: - @cloudflare/workers-types 4.20260623.1 -> 5.20260808.1 (major) - vitepress 2.0.0-alpha.17 -> 2.0.0-alpha.19 - undici ^8.5.0 -> ^8.10.0 - @modelcontextprotocol/sdk, @clack/prompts, eslint, prettier, @typescript-eslint/*, ts-jest, graphql, picomatch, xstate minor/patch - prisma + @prisma/client 7.8.0 -> 7.9.1 - nx 23.0.0 -> 23.1.1 - lockfile-only transitive bumps: hono 4.13.1, postcss 8.5.26, ip-address 10.4.0, brace-expansion 1.1.18, js-yaml 3.15.1, fast-uri 3.1.5, tar 7.5.22, body-parser 2.3.0 typescript 7 and @types/node 26 majors are intentionally skipped: @types/node major is on the Dependabot ignore list and the native tsc migration is a separate effort. Supersedes Dependabot PRs #543, #544, #545, #546, #551, #556, #557, #559, #560, #561, #566, #568, #569, #570 * chore(ci): bump actions/setup-node to v7 and pin codeql-action to v4.37.4 Supersedes Dependabot PRs #549 and #567 * test(runners): pass statuses as an array in list_jobs schema check The list_jobs statuses filter became an array of CiJobStatus in c1b37f9, but the integration schema test still passed a bare string and failed against the current schema. * style: reformat union types per prettier 3.9 prettier 3.9 collapses short union types onto one line; reformat the 9 affected files so lint passes on the updated toolchain. * docs(logging): describe LOG_FORMAT tokens as visibility switches - LOG_FORMAT tokens toggle field visibility; the line always renders in pino-pretty's fixed order, so stop advertising custom layouts in the docstring and configuration guide - add unit test for LOG_DESTINATION=stdout with the pretty transport in HTTP mode - drop issue references from code comments and test names; ticket numbers belong in commits and PRs, not in source * docs(troubleshooting): add JSONRPC parse error spam diagnosis Startup 'Failed to parse JSONRPC message' bursts mean an outdated build (stale npx cache) logging to stdout; document the symptom, cause, and cache-refresh fix with a quick-diagnosis row. * docs(logging): state that the log message is always rendered The %msg token cannot suppress the message: a log line without its message is useless, so only %time, %level, and %name act as visibility switches. Make the docstring and configuration guide say so explicitly instead of implying %msg is toggleable.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps undici from 8.5.0 to 8.9.0.
Release notes
Sourced from undici's releases.
... (truncated)
Commits
21a8e1eBumped v8.9.0 (#5589)7d3cf92fix: validate blob body content typec601ffffix(cache): harden cache directive parsing2b3f749test(retry): correct broken content-range fixtures in retry-handler.jse11a68efix(retry): reject partial content length mismatch9f09b49test: cover crash on mixed unqualified and qualified private cache directives4fe5bc5fix: handle empty qualified private cache directive10d93fcfix: harden cookie domain, path, and unparsed attribute validationa17e301Ignore auto-generated .npmrc on Windows (#5583)a0922b0fix: handle frozen globalThis in setGlobalDispatcher (#5574)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.