chore(deps): bump undici from 5.29.0 to 8.3.0 in the npm_and_yarn group across 1 directory#69
Conversation
Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 5.29.0 to 8.3.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v8.3.0) --- updated-dependencies: - dependency-name: undici dependency-version: 8.3.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict
looks good to me
Primary Goal
Bump undici dependency from version 5.29.0 to 8.3.0
Overview
This PR updates the undici dependency from version 5.2 0.3 in package. file.
Changes:
- package.json: Updated
undicifrom^5.0.0to^8.3.0.
As a Dependabot-generated PR, the lockfile (package-lock.json) is expected to be updated accordingly. However, due to cost-aware rules, lockfile changes are not visible in this diff.
No other changes are present in the diff.
Note: This is a major version bump which may contain breaking changes. The Dependabot description also warns of a change to the prepare install script. While automated dependency updates are generally safe, the project's test suite should validate compatibility.
Scope Assessment
The change is in scope: only updating the undici dependency as indicated by the PR title.
Risk Assessment
Major version bump (≥5.0.0 to ≥8.3.0) may introduce breaking changes; the project's test suite should validate compatibility. Additionally, the Dependabot note warns of a change to the prepare install script.
1 participant
Bumps the npm_and_yarn group with 1 update in the / directory: undici.
Updates
undicifrom 5.29.0 to 8.3.0Release notes
Sourced from undici's releases.
... (truncated)
Commits
aa33b19Bumped v8.3.0 (#5305)f33a6cbtest: fix flaky http2-dispatcher WebSocket upgrade tests (#5304)ca0cb16build(deps): bump uWebSockets.js in /benchmarks (#5299)e1f9035build(deps-dev): bump jest from 30.3.0 to 30.4.2 (#5297)314ba6aperf(client-h2): reuse request upgrade stream handlers (#5293)be9a544Add Node 26 to the matrix (#5271)45f7bd3test: retry crashed cache-test workers once (#5294)08cf765build(deps-dev): bump fast-check from 4.7.0 to 4.8.0 (#5298)df5ded9cache formdata boundary (#5292)e101dcbtest: include after in parser-issues (#5284)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.