Bump undici from 5.29.0 to 7.25.0

[dependabot]

Bumps undici from 5.29.0 to 7.25.0.

Release notes

Sourced from undici's releases.

v7.25.0

What's Changed

Full Changelog: nodejs/undici@v7.24.8...v7.25.0

v7.24.8

What's Changed

• fix: backport 401 stream-backed body fix to v7.x by @​mcollina in nodejs/undici#5006

Full Changelog: nodejs/undici@v7.24.7...v7.24.8

v7.24.7

What's Changed

• docs: update broken links in file "Dispatcher.md" by @​samuel871211 in nodejs/undici#4924
• doc: remove unused parameter redirectionLimitReached by @​samuel871211 in nodejs/undici#4933
• test: skip flaky macOS Node 20 cookie fetch cases by @​mcollina in nodejs/undici#4932
• fix(types): align Response with DOM fetch types by @​theamodhshetty in nodejs/undici#4867
• fix(types): Fix clone method type declaration to be an instance method rather than instance property by @​mistval in nodejs/undici#4925
• test: skip IPv6 tests when IPv6 is not available by @​mcollina in nodejs/undici#4939
• fix: correctly handle multi-value rawHeaders in fetch by @​mcollina in nodejs/undici#4938
• ignore AGENTS.md by @​mcollina in nodejs/undici#4942

New Contributors

• @​samuel871211 made their first contribution in nodejs/undici#4924
• @​mistval made their first contribution in nodejs/undici#4925

Full Changelog: nodejs/undici@v7.24.6...v7.24.7

v7.24.6

What's Changed

• fix(test): client wasm compatible with clang 22 by @​rozzilla in nodejs/undici#4909
• fix(mock): improve error message when intercepts are exhausted by @​travisbreaks in nodejs/undici#4912
• fix(websocket): support open diagnostics over h2 by @​mcollina in nodejs/undici#4921
• fix: assume http/https scheme for scheme-less proxy env vars by @​travisbreaks in nodejs/undici#4914
• fix(cache): check Authorization on request headers per RFC 9111 §3.5 by @​metalix2 in nodejs/undici#4911
• fix: wrap kConnector call in try/catch to prevent client hang by @​veeceey in nodejs/undici#4834
• docs: clarify fetch and FormData pairing by @​mcollina in nodejs/undici#4922
• fix: support Connection header with connection-specific header names per RFC 7230 by @​mcollina in nodejs/undici#4775
• fix: avoid prototype collisions in parseHeaders by @​mcollina in nodejs/undici#4923
• build(deps-dev): bump typescript from 5.9.3 to 6.0.2 by @​dependabot[bot] in nodejs/undici#4926
• test: auto-init WPT submodule by @​mcollina in nodejs/undici#4930

New Contributors

• @​rozzilla made their first contribution in nodejs/undici#4909
• @​veeceey made their first contribution in nodejs/undici#4834

Full Changelog: nodejs/undici@v7.24.5...v7.24.6

... (truncated)

Commits

• 12d9045 Bumped v7.25.0 (#5025)
• 7a6f7fe Bumped v7.24.8 (#5020)
• 1f85ae4 fix: avoid 401 failures for stream-backed request bodies (#4941) (#5006)
• c661067 chore: update v7.x maintenance release flow
• 84f23e2 Bumped v7.24.7 (#4947)
• a770b10 ignore AGENTS.md (#4942)
• 6acd19b fix: correctly handle multi-value rawHeaders in fetch (#4938)
• 1da1c74 test: skip IPv6 tests when IPv6 is not available (#4939)
• 04cb773 fix(types): Fix clone method type declaration to be an instance method rather...
• 5145a7c fix(types): align Response with DOM fetch types (#4867)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[cursor]

Stale comment

Findings

1. yarn.lock: this PR does not fully remove the older undici line the title implies. The actual diff only updates the jsdom-scoped undici@^7.21.0 entry from 7.24.4 to 7.25.0; the lockfile still contains undici@5.29.0 via jest-github-actions-reporter -> @actions/core -> @actions/http-client. yarn npm audit --recursive still reports the current undici advisories on that remaining 5.x copy, so the security benefit here is limited to the already-7.x path.

Security / compatibility notes

• I did not find any new advisories introduced by undici@7.25.0.
• The changed path was already on 7.24.4, which is already past the January/March 2026 undici fixes such as GHSA-g9mf-h72j-4rw9, GHSA-2mjp-6q6p-2qxm, and GHSA-vrm6-8vpv-qv8q.
• There are no direct undici imports in this repository, so the main possible impact area is the Jest jsdom environment rather than shipped application code.
• undici@7.25.0 requires Node >=20.18.1, but that is not a new regression here because the repository already uses jsdom@28.1.0, which itself requires Node 20+.

Test results

• yarn install --immutable ✅
• yarn lint ✅
• CI=true yarn test --runInBand ✅ (92 suites / 835 tests passed)
• Cypress: not runnable from this cloud environment. The dev server started successfully, but yarn exec cypress run failed because the Cypress desktop binary was not present, and cypress install could not download it from download.cypress.io (SSL_ERROR_SYSCALL).

Recommendation

Merge with caution.

Behaviorally this looks safe to merge: the diff is lockfile-only, there is no direct app/runtime use of undici, and the full lint + unit/Jest suite passed locally. The caution is that this should not be treated as a complete undici security remediation; if the alert behind this PR is expected to disappear, verify that after merge, or plan a follow-up update for the remaining @actions/http-client / jest-github-actions-reporter path.

  

_{Sent by Cursor Automation: Editor-UI - Tests Dependabot PRs}

[cursor]

This hunk only upgrades the jsdom copy of undici from 7.24.4 to 7.25.0. The lockfile still retains undici@5.29.0 a few lines above via jest-github-actions-reporter -> @actions/core -> @actions/http-client, and yarn npm audit --recursive still reports the 2026 undici advisories on that dev-only path. So the change is low-risk, but it is not a full 5.x -> 7.x remediation despite the PR title.

[cursor]

No blocking issues found.

Security

• This PR is a yarn.lock-only change. The effective change in this repo is the jsdom transitive copy of undici moving from 7.24.4 to 7.25.0; it does not remove the separate undici@5.29.0 entry that is still present via @actions/http-client.
• undici@7.24.4 was already on the patched side of the March 2026 undici advisories fixed in v7.24.0 and later, including request smuggling (GHSA-2mjp-6q6p-2qxm / CVE-2026-1525), WebSocket crash/DoS issues (GHSA-f269-vfmq-vjvj, GHSA-v9p9-hfj2-hcw8, GHSA-vrm6-8vpv-qv8q), deduplication-buffer DoS (GHSA-phc3-fgpg-7m6h / CVE-2026-2581), and CRLF injection (GHSA-4992-7rv2-5pvq / CVE-2026-1527). So this PR does not materially change the known security posture versus the current lockfile.
• The remaining undici@5.29.0 copy is unchanged by this PR. That version is already the patched release for GHSA-cxrh-j4jr-qwg3 / CVE-2025-47279.
• Dependabot flags maintainer/install-script changes when comparing 5.29.0 to 7.25.0, but for the actual version step this PR applies (7.24.4 -> 7.25.0), npm metadata is unchanged: same engines.node (>=20.18.1) and same prepare script.

Safety of merging

• I found no direct undici imports in this repository.
• The updated undici copy is pulled in by jsdom@28.1.0, so the practical impact is on the Jest/jsdom test environment rather than the shipped browser bundle.
• The 7.24.4 -> 7.25.0 delta is patch-level and consists mainly of bug fixes around fetch/header handling, cache/auth behavior, connection handling, and streamed request bodies. In this repo, that would only matter if tests were sensitive to jsdom/fetch behavior. The full Jest suite passed, which is a good signal that nothing observable regressed here.

Tests

• yarn install --immutable ✅
• yarn lint ✅
• CI=true yarn run test --coverage --maxWorkers=4 --workerThreads=true --reporters=default --reporters=jest-junit --reporters=jest-github-actions-reporter ✅ (92 suites, 835 tests)
• Local Cypress: could not complete in this cloud environment because the Cypress binary was not installed and repeated cypress install attempts did not leave a local binary. The PR's GitHub test-cypress check has passed remotely, so e2e coverage is still green in CI.

Recommendation

• Merge. This looks safe: no app code changes, no direct undici usage in the repo, no new advisory exposure introduced, and the relevant local + remote test signals are green.
• One nuance worth keeping in mind: the PR title/body overstates the effective change a bit. In this repo it is not a full 5.29.0 -> 7.25.0 replacement; it is a transitive jsdom lockfile refresh from 7.24.4 to 7.25.0, while the separate 5.29.0 tooling copy remains.

  

_{Sent by Cursor Automation: Editor-UI - Tests Dependabot PRs}