[dependabot]

Bumps undici from 8.11.2 to 8.12.3.

Release notes

Sourced from undici's releases.

v8.12.3

What's Changed

• ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in nodejs/undici#6029
• build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in nodejs/undici#6006
• build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in nodejs/undici#5967
• docs: document the options of interceptors.cache() by @​qodelicious in nodejs/undici#6050
• fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in nodejs/undici#6052
• fix(pool): keep caller async context for queued requests by @​mcollina in nodejs/undici#5982

New Contributors

• @​qodelicious made their first contribution in nodejs/undici#6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

... (truncated)

Commits

• ff9cc5e Bumped v8.12.3 (#6053)
• 0bbf614 fix(pool): keep caller async context for queued requests (#5982)
• aa1eef1 fix(h2): replace a connection that stops responding after a stream timeout (#...
• e34b872 docs: document the options of interceptors.cache() (#6050)
• e8f3423 build(deps-dev): bump eslint from 9.39.4 to 10.12.0 (#5967)
• b777e40 build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 (#6006)
• 43700ff ci: use Python 3.14 for the WPT server on macOS (#6029)
• bb6cc0a Bumped v8.12.2 (#6021)
• b217373 fix(websocket): bound automatic PONG writes under backpressure
• 789ef26 fix(eventsource): bound retained SSE parser state
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[labro-bot]

Labro picking up. Assigning to claude-code:claude-sonnet-5.

[labro-bot]

Dependency review: undici 8.11.2 → 8.12.3 (dashboard)

Semver risk: minor (8.11.2 → 8.12.3). Minor-version bump within the same major; standard scrutiny applies, not the deeper review a major bump would need.

Changes in this release:

• 8.12.3 is a maintenance release: fix(h2) replaces a connection that stops responding after a stream timeout, fix(pool) preserves caller async context for queued requests, plus docs/CI/dev-tooling changes. No behavioural risk for this project's usage.
• 8.12.2 (included in the range) carries five security advisories, four high severity: TLS 1.2 renegotiation DoS (CVE-2026-87018), TLS cert-validation bypass via dropped Agent options (CVE-2026-109383), cache poisoning/cross-user disclosure via cross-origin redirects when composing redirect() + cache() (CVE-2026-109829), and DoS via excessive Content-Encoding values (CVE-2026-109869); plus one medium-severity DoS via the decompress interceptor (CVE-2026-87029).
• Context: undici here is a transitive devDependency of jsdom (used by vitest's DOM environment) — dev: true in the lock file, not part of the production dashboard bundle served by the SPA. None of these advisories involve code reachable from the published site, so the practical exposure is limited to local/CI test runs rather than production traffic. Still worth taking given it's a no-cost bump.

Lock file: clean. The diff touches exactly one entry in dashboard/package-lock.json (3 lines changed) — undici's version, resolved URL, and integrity hash. No other packages, transitive or direct, were added/removed/changed.

Prior pins: none found. undici isn't listed directly in dashboard/package.json; it's pulled in transitively by jsdom with range ^8.9.0, which 8.12.3 satisfies. Git history shows a consistent pattern of promptly accepting undici security bumps (7.27.2→7.28.0 for CVE-2026-9678/9697, 8.9.0→8.11.2 in #71) with no recent manual pin that this PR would be overriding.

Conflict check: not independently re-run locally in this session (sandboxed/no-network execution here couldn't fetch/checkout the branch or run npm ci). Relying instead on the CI run against this exact commit (b44d754), whose build check performs npm ci + vitest + tsc -b && vite build — see CI below. Combined with the manual semver-range check above (jsdom's ^8.9.0 is satisfied by 8.12.3), the lock file resolves cleanly.

CI: passing. The build check (ci-dashboard.yml) succeeded on b44d754 (23s), including npm ci, vitest, and the production build. The only annotation is a benign GitHub-hosted notice about the ubuntu-latest runner image migrating to Ubuntu 26, unrelated to this change.

Recommendation: ✅ Safe to merge.