Skip to content

fix: update undici to 7.30.1 - #177

Merged
jeremydixon22 merged 1 commit into
mainfrom
security/undici-7.30.1-20261026
Oct 26, 2026
Merged

jeremydixon22 merged 1 commit into
mainfrom
security/undici-7.30.1-20261026

Conversation

@jeremydixon22

@jeremydixon22 jeremydixon22 commented Oct 26, 2026 •

Copy link
Copy Markdown
Member

Summary

  • update the Worker R2 proof's explicit undici override from 7.29.1 to 7.30.1
  • refresh the lockfile tarball and integrity hash
  • resolve GHSA-xjj6-f33q-929c / CVE-2026-109869

Validation

  • npm ci --ignore-scripts
  • npm audit (0 vulnerabilities)
  • python3 scripts/verify-worker-r2-generation-projection.py
    • direct R2 and service-reader modes
    • lifecycle, parity, cache, missing-shard, and corrupt-shard proofs

@jeremydixon22

Copy link
Copy Markdown
Member Author

Maintainer merge note: this security patch is self-authored, so GitHub cannot supply the required independent approval from the same account. The complete protected check suite passed, and local npm audit plus the Worker R2 lifecycle/parity proof passed before using the configured maintainer bypass.

@jeremydixon22
jeremydixon22 merged commit 52bc569 into main Oct 26, 2026
14 checks passed
@jeremydixon22
jeremydixon22 deleted the security/undici-7.30.1-20261026 branch October 26, 2026 14:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant