← all branches

dependabot/npm_and_yarn/undici-6.27.0

safe
442a707 · fullPR #347reviewed 2026-07-24 20:16 UTC0H · 0M · 4L · 14I
The branch
Purpose
Dependabot security update — bumps undici HTTP client in CFE scraping services to address 4 CVEs in undici <6.27.0.
Goal
Patch undici from 6.25.0→6.27.0 in bills/cfe and 6.21.0→6.27.0 in tariffs/cfe; regenerate lockfile.
Sub-goals
  • SG-1: Bump undici specifier in services/utility/bills/cfe/package.json
  • SG-2: Bump undici specifier in services/utility/tariffs/cfe/package.json
  • SG-3: Regenerate pnpm-lock.yaml to resolve new versions
The changes (whole branch)
What
Two package.json files updated (1 line each); lockfile regenerated with undici@6.27.0 and minor peer-dep notation normalization.
Why
GitHub security advisory — 4 CVEs including High-severity WebSocket DoS (CVE-2026-12151, CVSS 7.5) and Moderate HTTP header injection (CVE-2026-9679, CVSS 5.9).
Areas
pnpm-lock.yaml+128−88services/utility/bills/cfe+1−1services/utility/tariffs/cfe+1−1
Blast
3 files, +130/-90; services/utility area only; no source code or tests modified.
➖ci· Check rollup not accessible via current token➖coderabbit· No .coderabbit.yaml in repo

Findings · 4

correctness1

low

Verify no deprecated undici 6.26/6.27 API call sites

services/utility/bills/cfe/package.json

undici 6.26 deprecated legacy fetch shimming and changed ProxyAgent options. Quick grep for 'new ProxyAgent' or 'undici.fetch' in both services recommended.

security1

info

Resolves 4 CVEs — High WebSocket DoS + Moderate HTTP header injection most relevant to CFE scraping

services/utility/bills/cfe/package.json

CVE-2026-12151 (High 7.5): WebSocket DoS. CVE-2026-9679 (Moderate 5.9): HTTP header injection via Set-Cookie. Both patched in 6.27.0.

improvement2

info

Consider Node.js built-in fetch vs explicit undici dependency (follow-up)

services/utility/bills/cfe/package.json

Node 18+ ships built-in fetch backed by undici. If services don't use undici-specific APIs, direct dep could be dropped.

info

Periodic dep-sync pass recommended to prevent sibling-service version drift

services/utility/tariffs/cfe/package.json

tariffs/cfe was 4 minor versions behind bills/cfe. Catchable earlier with quarterly pnpm outdated --recursive.

History · 2 commits

  1. 442a707safefull0H · 0M · 4L2026-07-24 20:16current
  2. 12fc4ddsafefull0H · 1M · 4L2026-07-24 19:56