chore(deps): update dependency undici to v6.11.1 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
undici (source)	6.10.1 -> 6.11.1

GitHub Vulnerability Alerts

CVE-2024-30260

Impact

Undici cleared Authorization and Proxy-Authorization headers for fetch(), but did not clear them for undici.request().

Patches

This has been patched in nodejs/undici@6805746.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

use fetch() or disable maxRedirections.

References

Linzi Shang reported this.

• https://hackerone.com/reports/2408074
• GHSA-3787-6prv-h9w3

CVE-2024-30261

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in nodejs/undici@d542b8c.
Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

---

Release Notes

nodejs/undici (undici)

v6.11.1

Compare Source

v6.11.0

Compare Source

v6.10.2

Compare Source

What's Changed

• Do not fail test if streams support typed arrays by @​mcollina in https://github.com/nodejs/undici/pull/2978
• fix(fetch): properly redirect non-ascii location header url by @​Xvezda in https://github.com/nodejs/undici/pull/2971
• perf: Remove double-stringify in setCookie by @​peterver in https://github.com/nodejs/undici/pull/2980
• [fix #​2982] use DispatcherInterceptor type for Dispatcher#Compose by @​clovis-guillemot in https://github.com/nodejs/undici/pull/2983
• fix: make EventSource properties enumerable by @​MattBidewell in https://github.com/nodejs/undici/pull/2987
• docs: ✏️ fixed benchmark links by @​benhalverson in https://github.com/nodejs/undici/pull/2991
• fix(#​2986): bad start check by @​metcoder95 in https://github.com/nodejs/undici/pull/2992
• fix(H2 Client): bind stream 'data' listener only after received 'response' event by @​St3ffGv4 in https://github.com/nodejs/undici/pull/2985
• feat: added search input by @​benhalverson in https://github.com/nodejs/undici/pull/2993
• chore: validate responses can be consumed without a Content-Length or… by @​jacob-ebey in https://github.com/nodejs/undici/pull/2995
• fix error message by @​KhafraDev in https://github.com/nodejs/undici/pull/2998
• Revert "perf: reuse TextDecoder instance (#​2863)" by @​panva in https://github.com/nodejs/undici/pull/2999
• test: remove only by @​metcoder95 in https://github.com/nodejs/undici/pull/3001

New Contributors

• @​Xvezda made their first contribution in https://github.com/nodejs/undici/pull/2971
• @​peterver made their first contribution in https://github.com/nodejs/undici/pull/2980
• @​clovis-guillemot made their first contribution in https://github.com/nodejs/undici/pull/2983
• @​MattBidewell made their first contribution in https://github.com/nodejs/undici/pull/2987
• @​benhalverson made their first contribution in https://github.com/nodejs/undici/pull/2991
• @​St3ffGv4 made their first contribution in https://github.com/nodejs/undici/pull/2985
• @​jacob-ebey made their first contribution in https://github.com/nodejs/undici/pull/2995

Full Changelog: nodejs/undici@v6.10.0...v6.10.2

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[codecov]

Codecov Report

Merging #2084 (d6546d5) into main (dfb2dff) will decrease coverage by 0.16%.
Report is 36 commits behind head on main.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2084      +/-   ##
==========================================
- Coverage   90.97%   90.82%   -0.16%     
==========================================
  Files         146      148       +2     
  Lines        7492     7672     +180     
  Branches     1502     1537      +35     
==========================================
+ Hits         6816     6968     +152     
- Misses        676      704      +28     

see 8 files with indirect coverage changes

[trentm]

This will be handled by #2085

[forking-renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (6.11.1). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.