Skip to content

fix: resolve undici and fast-uri audit advisories - #276

Merged
jdevalk merged 1 commit into
mainfrom
fix-audit-undici-fast-uri
Oct 24, 2026
Merged

jdevalk merged 1 commit into
mainfrom
fix-audit-undici-fast-uri

Conversation

@jdevalk

@jdevalk jdevalk commented Oct 24, 2026

Copy link
Copy Markdown
Owner

Fixes the npm Audit and mcp failures that appeared on #275 (new advisories, not a code change):

  • Root: undici 8.11.2 -> 8.12.3 (high: EventSource DoS, SRI bypass, content-encoding DoS) and fast-uri 3.1.8 -> 3.1.9 (4 moderate URI issues).
  • mcp: no released miniflare bundles the fixed undici 7.30.1 yet (newest beta still pins 7.29.1), so the existing undici override in mcp/package.json goes 7.29.1 -> 7.30.1, plus the installed lockfile entry. Miniflare's own declared 7.29.1 dependency stays as declared; the override overrules it at install time.

Root: undici 8.11.2 -> 8.12.3 (GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472,
GHSA-xjj6-f33q-929c) and fast-uri 3.1.8 -> 3.1.9 (GHSA-w74x-v6f9-j3xg,
GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp).

mcp: no released miniflare bundles the fixed undici 7.30.1 yet (newest
beta still pins 7.29.1), so bump the existing undici override in
mcp/package.json 7.29.1 -> 7.30.1 and the installed lockfile entry.
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying specification-website with  Cloudflare Pages  Cloudflare Pages

Latest commit: 35fb969
Status: ✅  Deploy successful!
Preview URL: https://8d8a54d0.specification-website.pages.dev
Branch Preview URL: https://fix-audit-undici-fast-uri.specification-website.pages.dev

View logs

@jdevalk
jdevalk merged commit fea3e06 into main Oct 24, 2026
9 checks passed
@jdevalk
jdevalk deleted the fix-audit-undici-fast-uri branch October 24, 2026 13:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant