chore(js-sdk): bump undici to ^7.29.0 and optional undici8 to 8.10.0 - #1645
chore(js-sdk): bump undici to ^7.29.0 and optional undici8 to 8.10.0#1645mishushakov wants to merge 2 commits into
undici to ^7.29.0 and optional undici8 to 8.10.0#1645Conversation
🦋 Changeset detectedLatest commit: 60cd07f The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
PR SummaryLow Risk Overview Reviewed by Cursor Bugbot for commit 60cd07f. Bugbot is set up for automated code reviews on this repo. Configure here. |
Package ArtifactsBuilt from 0b4c328. Download artifacts from this workflow run. JS SDK ( npm install ./e2b-2.38.1-update-undici8-8-10-0.0.tgzCLI ( npm install ./e2b-cli-2.16.2-update-undici8-8-10-0.0.tgzPython SDK ( pip install ./e2b-2.37.0+update.undici8.8.10.0-py3-none-any.whl |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward optional dependency bump with no code changes.
What was reviewed: Confirmed the change is limited to the undici8 optional dependency pin (8.8.0 → 8.10.0) in package.json and the matching pnpm-lock.yaml entries, with no changes to src/undici.ts or the version-gating logic. Verified the new version's engines.node >= 22.19.0 still matches the existing UNDICI_8_MIN_NODE gate, so package selection behavior is unchanged across Node versions. A patch changeset is included as required.
Extended reasoning...
Overview
This PR bumps the optional undici8 dependency (aliased via npm:undici@...) from 8.8.0 to 8.10.0 in packages/js-sdk/package.json, with the corresponding lockfile entries updated in pnpm-lock.yaml, and adds a patch changeset. No source files in the SDK were touched.
Security risks
None introduced by this PR itself — it is a dependency version bump, and the described intent is actually to pick up upstream security fixes in undici (per the PR description: a High-severity cache-control parsing advisory and several Medium CRLF/cache/retry advisories). There is no new attack surface added by this change.
Level of scrutiny
Low. This is a mechanical, exact-pin dependency bump with no application logic changes. The critical invariant — that UNDICI_8_MIN_NODE in src/undici.ts still matches the new package's engines.node floor (both >=22.19.0) — holds, so getUndiciPackageCandidates() behavior is unchanged. The diff is fully mechanical (package.json + lockfile + changeset).
Other factors
A changeset is present as required by CLAUDE.md for js-sdk changes. The PR description notes local test runs passed (tests/undici.test.ts, format/lint/typecheck) with the remaining vitest projects deferred to CI due to missing E2B_API_KEY, which is reasonable for this type of change. No outstanding reviewer comments require action.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cc675b2aba
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| }, | ||
| "optionalDependencies": { | ||
| "undici8": "npm:undici@8.8.0" | ||
| "undici8": "npm:undici@8.10.0" |
There was a problem hiding this comment.
Because getUndiciPackageCandidates() uses only undici on supported Node versions below 22.19.0, this security bump still leaves Node 20 and Node 22.0–22.18 callers on the unchanged undici range/lock (^7.28.0 / 7.28.0). The same advisory this change is picking up affects undici >=7.0.0 <7.29.0 as well as 8.x (GHSA-4cwx-7wf7-3272), so apps with an existing lockfile at 7.28.0 can upgrade the SDK and still exercise the vulnerable fetch path; raise the 7.x minimum and lockfile to 7.29.0 too.
Useful? React with 👍 / 👎.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
cc675b2 to
390f1ba
Compare
|
closes #1641 as well |
Covers GHSA-4cwx-7wf7-3272 (High) and four Medium advisories, all patched in 7.29.0. Also overrides the copy miniflare pins exactly at 7.28.0 so the lockfile no longer carries a vulnerable undici 7. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mishushakov
changed the title
undici8 dependency to 8.10.0undici to ^7.29.0 and optional undici8 to 8.10.0
1 participant
Bumps both undici dependencies in the js-sdk past the 2026-07-24 security advisories: the required
undicifrom^7.28.0to^7.29.0, and the optionalundici8(npm:undici@…) from 8.8.0 to 8.10.0. Both releases patch one High (GHSA-4cwx-7wf7-3272, cache-control parsing / cross-user disclosure) and four Medium advisories, clearing the open Dependabot alerts for undici; 8.10.0 additionally fixes HTTP/2 request settling, refused-stream retries and GOAWAY handling, which we exercise because every dispatcher the SDK builds setsallowH2: true.A root
pnpm.overridesentry (undici@>=7.0.0 <7.29.0) is included because miniflare pins undici at exactly 7.28.0, which would otherwise keep a vulnerable copy in the lockfile; with it, the lockfile carries only 7.29.0 and 8.10.0. No code change was needed and there is no user-facing API change — 7.29.0 still requires Node>=20.18.1and 8.10.0 still requires>=22.19.0, matching theUNDICI_8_MIN_NODEgate inpackages/js-sdk/src/undici.ts, sogetUndiciPackageCandidates()picks the same package on the same Node versions.format,lintandtypecheckpass,tests/undici.test.tsis 9/9, andtest:cfwas run to confirm miniflare still boots on the overridden undici. The remaining vitest projects needE2B_API_KEY, which isn't available locally, so they're left to CI. A patch changeset fore2bis included.Linear: SDK-317