dependabot/npm_and_yarn/undici-6.27.0
safeviewing older commit12fc4dd · fullpre-PRreviewed 2026-07-24 19:56 UTC0H · 1M · 4L · 5I- Purpose
- Security/maintenance dependency bump by dependabot for undici HTTP client library
- Goal
- Patch known CVEs in undici 6.x across the two CFE scraper services
- Sub-goals
- Bump services/utility/bills/cfe: undici ^6.25.0 → ^6.27.0
- Bump services/utility/tariffs/cfe: undici ^6.21.0 → ^6.27.0
- Update pnpm lockfile
- What
- undici version specifiers updated in two CFE service package.json files; pnpm-lock.yaml regenerated with updated resolution and incidental @vitest/ui peer-dep notation normalization
- Why
- CVE patches in undici 6.21–6.27 range (multipart boundary SSRF, auth header leak on redirect, unsafe Content-Type, proxy-auth header leak). dependabot automated bump.
- Areas
- services/utility+2−2pnpm-lock.yaml+128−88
- Blast
- 3 files, +130/-90 lines; only CFE outbound HTTP packages affected; no application logic changed
Findings · 9
correctness1
Semver range correct; lockfile peer-dep notation change is benign pnpm format normalization
pnpm-lock.yaml
security3
Pre-existing: rejectUnauthorized=false on all CFE outbound HTTP
services/utility/bills/cfe
Both CFE services disable TLS certificate validation (intentional workaround for CFE/Imperva cert chain issues from Lambda). Not introduced by this PR. Consider pinning CFE CA cert to re-enable validation.
Bump closes CVEs in range 6.21–6.27 including CVE-2025-22150 (SSRF), CVE-2024-30260 (auth header leak)
services/utility/tariffs/cfe/package.json
Net-positive security update; tariffs/cfe had the larger exposure window (6.21 → 6.27).
Supply chain: integrity-pinned in lockfile, official nodejs/undici, signed dependabot commit
pnpm-lock.yaml
conventions2
Version skew between sibling CFE packages incidentally fixed (6.21 vs 6.25 → both 6.27)
services/utility/tariffs/cfe/package.json
Lockfile @vitest/ui peer-dep notation change is mechanical pnpm normalization — not a dependency change
pnpm-lock.yaml
tests1
tariffs/cfe has no tests (pre-existing gap, not introduced by this bump)
services/utility/tariffs/cfe
improvement2
Consolidate undici to pnpm catalog to prevent future sibling version drift
services/utility/bills/cfe/package.json
Two sibling packages had different specifiers (^6.21 vs ^6.25). A catalog pin would make future CVE bumps a one-line change.
Consider tightening undici specifier to ~6.27.0 given its CVE history
services/utility/bills/cfe/package.json
^6.27.0 allows silent pulls of 6.28.x before security review. For an HTTP client with repeated CVEs making outbound requests to CFE, tighter pinning reduces exposure window.