Skip to content

chore(deps): bump the npm-minor-and-patch group across 1 directory with 3 updates - #730

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-3e251f8c9b
Open

chore(deps): bump the npm-minor-and-patch group across 1 directory with 3 updates#730
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-3e251f8c9b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 3 updates in the / directory: undici, eslint-plugin-security and typescript-eslint.

Updates undici from 7.30.1 to 7.30.2

Release notes

Sourced from undici's releases.

v7.30.2

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 7.30.1 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

In Undici 7.x, a shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

In Undici 7.x, a cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

In Undici 7.x, the redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

In Undici 7.x, a downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

Undici 7.15.0 through 7.30.1 could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

Full Changelog: nodejs/undici@v7.30.1...v7.30.2

Commits
  • 6be5720 Bumped v7.30.2 (#6163)
  • 4bca0ab test: support Node.js 20 in cache replay tests
  • 520d95b docs: add v7.30.2 security release notes
  • bcba54b fix(redirect): normalize tuple headers on v7
  • faba415 fix(cache): adapt security fixes to v7 lifecycle
  • 3df9ff5 test(cache): align redirect caching with hop policy
  • 4d54152 fix(cache): detect an actual redirect, not a plain revalidation
  • c363766 test(cache): cover credentialed revalidation refresh
  • b790905 fix(cache): treat proxy-authorization as a credential when caching redirects
  • 95a17aa test(cache): cover proxy-authorization credential on same-origin redirect
  • Additional commits viewable in compare view

Updates eslint-plugin-security from 4.2.0 to 4.2.1

Release notes

Sourced from eslint-plugin-security's releases.

eslint-plugin-security: v4.2.1

4.2.1 (2026-10-18)

Bug Fixes

  • check RegExp() called without new in the regexp rules (#232) (affbfc0)
Changelog

Sourced from eslint-plugin-security's changelog.

4.2.1 (2026-10-18)

Bug Fixes

  • check RegExp() called without new in the regexp rules (#232) (affbfc0)
Commits

Updates typescript-eslint from 8.72.0 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
  • eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
  • typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
undici [>= 8.a, < 9]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-minor-and-patch group across 1 directory wi…
48a58a1 
…th 3 updates

Bumps the npm-minor-and-patch group with 3 updates in the / directory: [undici](https://github.com/nodejs/undici), [eslint-plugin-security](https://github.com/eslint-community/eslint-plugin-security) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint).


Updates `undici` from 7.30.1 to 7.30.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.30.1...v7.30.2)

Updates `eslint-plugin-security` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/eslint-community/eslint-plugin-security/releases)
- [Changelog](https://github.com/eslint-community/eslint-plugin-security/blob/main/CHANGELOG.md)
- [Commits](eslint-community/eslint-plugin-security@eslint-plugin-security-v4.2.0...eslint-plugin-security-v4.2.1)

Updates `typescript-eslint` from 8.72.0 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.30.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: eslint-plugin-security
  dependency-version: 4.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates (used by dependabot.yml) label Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown

Test Coverage Report

Metric Coverage
Lines 92.35%
Statements 90.21%
Functions 83.85%
Branches 85.32%

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zeshi-du zeshi-du Awaiting requested review from zeshi-du zeshi-du is a code owner
@ruili-testsprite ruili-testsprite Awaiting requested review from ruili-testsprite ruili-testsprite is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Dependency updates (used by dependabot.yml)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants