Update dependency undici to v5.29.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	5.23.0 -> 5.29.0

---

Release Notes

nodejs/undici (undici)

v5.29.0

Compare Source

What's Changed

• Fix tests in v5.x for Node 20 by @​mcollina in #​4104
• Removed clients with unrecoverable errors from the Pool #​4088

Full Changelog: nodejs/undici@v5.28.5...v5.29.0

v5.28.5

Compare Source

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

Full Changelog: nodejs/undici@v5.28.4...v5.28.5

v5.28.4

Compare Source

⚠️ Security Release ⚠️

• Fixes GHSA-m4v8-wqvr-p9f7 CVE-2024-30260
• Fixes GHSA-9qxr-qj54-h672 CVE-2024-30261

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

Compare Source

⚠️ Security Release ⚠️

Fixes:

• CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

Compare Source

What's Changed

• fix: remove optional chainning for compatible with Nodejs12 and below by @​bugb in #​2470
• fix: remove node: prefix by @​tsctx in #​2471
• perf: avoid Headers initialization by @​tsctx in #​2468
• fix: handle SharedArrayBuffer correctly by @​tsctx in #​2466
• fix: Add null type to signal in RequestInit by @​gebsh in #​2455
• fix: correctly handle data URL with hashes. by @​tsctx in #​2475
• fix: check response for timinginfo allow flag by @​ToshB in #​2477
• Make call to onBodySent conditional in RetryHandler by @​MzUgM in #​2478
• refactor: better integrity check by @​tsctx in #​2462
• fix: Added support for inline URL username:password proxy auth by @​matt-way in #​2473
• build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @​dependabot in #​2472
• build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @​dependabot in #​2405
• build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @​dependabot in #​2396
• build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @​dependabot in #​2395
• build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @​dependabot in #​2392
• build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @​dependabot in #​2389
• build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @​dependabot in #​2302

New Contributors

• @​bugb made their first contribution in #​2470
• @​gebsh made their first contribution in #​2455
• @​ToshB made their first contribution in #​2477
• @​MzUgM made their first contribution in #​2478
• @​matt-way made their first contribution in #​2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

Compare Source

What's Changed

• perf: Improve normalizeMethod by @​tsctx in #​2456
• fix: dispatch error handling by @​ronag in #​2459
• perf(request): optimize if headers are given by @​tsctx in #​2454

Full Changelog: nodejs/undici@v5.28.0...v5.28.1

v5.28.0

Compare Source

What's Changed

• fix(parseHeaders): util.parseHeaders handle correctly array of buffer… by @​mdoria12 in #​2398
• docs: add license to undici-types by @​dancastillo in #​2401
• perf: optimize Readable.dump by @​ronag in #​2402
• perf(headers): Improve Headers by @​tsctx in #​2397
• test: re-enable conditional WPT Report for websockets by @​panva in #​2407
• fix: delay abort on 'close' by @​ronag in #​2408
• refactor: use substring instead of substr by @​tsctx in #​2411
• add additional http2 test with fetch by @​KhafraDev in #​2419
• fix: HTTPToken check by @​tsctx in #​2410
• perf: optimize HeadersList.get by @​tsctx in #​2420
• properly handle pseudo-headers in fetch by @​KhafraDev in #​2422
• perf(headers): if the guard is immutable by @​tsctx in #​2424
• fix(mock-agent): send stream body by @​tsctx in #​2425
• build(deps): bump github/codeql-action from 2.21.5 to 2.22.5 by @​dependabot in #​2394
• feat(#​2264): Expose Retry Handler by @​metcoder95 in #​2281
• fix: implement Headers#set correctly by @​tsctx in #​2432
• fix: implement Headers#delete correctly by @​tsctx in #​2430
• test: update websocket wpt availability by @​panva in #​2437
• fix: type comment position by @​tsctx in #​2443
• fix: onHeaders type declaration by @​tsctx in #​2444
• remove http2 status pseudo header from headers by @​KhafraDev in #​2438
• docs: Clarify path matching in intercept() by @​oliversalzburg in #​2426
• fix: set-cookie clone by @​tsctx in #​2446
• docs: fix typo in maxConcurrentStreams by @​tniessen in #​2450
• refactor: remove leftovers by @​metcoder95 in #​2451
• refactor: add missing new operator by @​tsctx in #​2452

New Contributors

• @​mdoria12 made their first contribution in #​2398
• @​tsctx made their first contribution in #​2397
• @​oliversalzburg made their first contribution in #​2426

Full Changelog: nodejs/undici@v5.27.2...v5.28.0

v5.27.2

Compare Source

Full Changelog: nodejs/undici@v5.27.1...v5.27.2

v5.27.1

Compare Source

What's Changed

• add regression test by @​KhafraDev in #​2376
• fix: define conditions when content-length should be sent by @​pxue in #​2305
• refactor: removed unnecessary default by @​nikelborm in #​2381
• fix: stream body handling by @​ronag in #​2391

New Contributors

• @​pxue made their first contribution in #​2305
• @​nikelborm made their first contribution in #​2381

Full Changelog: nodejs/undici@v5.27.0...v5.27.1

v5.27.0

Compare Source

What's Changed

• Use sets and reusable TextEncoder/TextDecoder instances by @​kibertoad in #​2368
• feat: forward onRequestSent to handler by @​ronag in #​2375
• skip bundle test on node 16 by @​KhafraDev in #​2377
• fix windows CI by @​KhafraDev in #​2379

Full Changelog: nodejs/undici@v5.26.5...v5.27.0

v5.26.5

Compare Source

What's Changed

• Drop race condition in connect-timeout test by @​mcollina in #​2360
• Remove a couple of unnecessary async functions by @​kibertoad in #​2367
• Update namespace type with Fetch exports by @​Ethan-Arrowood in #​2361

Full Changelog: nodejs/undici@v5.26.4...v5.26.5

v5.26.4

Compare Source

What's Changed

• use esbuild define/hooks by @​KhafraDev in #​2342
• fix request's arrayBuffer returning uint8 instead of arraybuffer by @​KhafraDev in #​2344
• fix: skip readMore call if parser is null or undefined by @​iiAku in #​2346
• test: first attempt for flaky fix by @​metcoder95 in #​2337
• test: only include WebSocket in WPT Report where it's landed by @​panva in #​2351
• Update DispatchInterceptor.md by @​Uzlopak in #​2354
• fix: Avoid error for stream() being aborted by @​BobNobrain in #​2355
• fix names with esbuild by @​KhafraDev in #​2359

New Contributors

• @​iiAku made their first contribution in #​2346
• @​Uzlopak made their first contribution in #​2354
• @​BobNobrain made their first contribution in #​2355

Full Changelog: nodejs/undici@v5.26.3...v5.26.4

v5.26.3

Compare Source

v5.26.2

Compare Source

Security Release, CVE-2023-45143.

v5.26.1

Compare Source

What's Changed

• Fix publish undici-types once and for all! by @​Ethan-Arrowood in #​2338
• Fix node detection omfg by @​KhafraDev in #​2341

Full Changelog: nodejs/undici@v5.26.0...v5.26.1

v5.26.0

Compare Source

What's Changed

• use npm install instead of npm ci by @​Ethan-Arrowood in #​2309
• change default header to node by @​Ethan-Arrowood in #​2310
• chore: change order of the pseudo-headers by @​kyrylodolynskyi in #​2308
• fix: Agent.Options.factory should accept URL object or string as parameter by @​nicole0707 in #​2295
• build(deps-dev): bump sinon from 15.2.0 to 16.1.0 by @​dependabot in #​2312
• test: handle npm ignore-scripts settings by @​panva in #​2313
• feat: respect --max-http-header-size Node.js flag by @​balazsorban44 in #​2234
• fix(#​2311): End stream after body sent by @​metcoder95 in #​2314
• disallow setting host header in fetch by @​KhafraDev in #​2322
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in #​2325
• fix fetch with coverage enabled by @​KhafraDev in #​2330
• Fix stuck when using http2 POST Buffer by @​binsee in #​2336
• fix: 🏷️ add allowH2 to BuildOptions by @​binsee in #​2334
• fix: 🐛 fix process http2 header by @​binsee in #​2332

New Contributors

• @​kyrylodolynskyi made their first contribution in #​2308
• @​nicole0707 made their first contribution in #​2295
• @​balazsorban44 made their first contribution in #​2234
• @​binsee made their first contribution in #​2336

Full Changelog: nodejs/undici@v5.23.4...v5.26.0

v5.25.4

Compare Source

v5.25.3

Compare Source

What's Changed

• perf: improve parse-url implementation by @​anonrig in #​2286
• test: enable websockets inclusion in WPTReport by @​panva in #​2284
• remove npm run test from pre-commit hook by @​dancastillo in #​2296
• perf: use @​fastify/busboy by @​gurgunday in #​2211
• Disable finalizationregistry if node code cov by @​mcollina in #​2298

New Contributors

• @​gurgunday made their first contribution in #​2211

Full Changelog: nodejs/undici@v5.25.2...v5.25.3

v5.25.2

Compare Source

What's Changed

• Add Khaf to releasers by @​mcollina in #​2276
• fix: fix request with readable mode is object by @​killagu in #​2279
• fix loading websockets when node is built w/ --without-ssl by @​KhafraDev in #​2282

New Contributors

• @​killagu made their first contribution in #​2279

Full Changelog: nodejs/undici@v5.25.1...v5.25.2

v5.25.1

Compare Source

What's Changed

• Add publish types script by @​Ethan-Arrowood in #​2273

Full Changelog: nodejs/undici@v5.25.0...v5.25.1

v5.25.0

Compare Source

What's Changed

• fix: h2 without body by @​metcoder95 in #​2258
• ci: remove duplicated runs by @​metcoder95 in #​2265
• improve documentation of timeouts by making the units clear in all places by @​mcfedr in #​2266
• expose websocket in node bundle by @​KhafraDev in #​2217
• test: fix Fetch/HTTP2 tests by @​metcoder95 in #​2263
• fix undici when node is built with --without-ssl by @​KhafraDev in #​2272
• fix: Fix type definition for Client Interceptors by @​ComradeCow in #​2269
• Fix http2 agent by @​mcollina in #​2275

New Contributors

• @​ComradeCow made their first contribution in #​2269

Full Changelog: nodejs/undici@v5.24.0...v5.25.0

v5.24.0

Compare Source

Notable Changes

• feat: Add H2 support by @​metcoder95 in #​2061

What's Changed

• build(deps): bump step-security/harden-runner from 2.4.1 to 2.5.0 by @​dependabot in #​2203
• better stack trace for body.json by @​KhafraDev in #​2215
• allow http & https websocket urls by @​KhafraDev in #​2218
• build(deps-dev): bump @​sinonjs/fake-timers from 10.3.0 to 11.1.0 by @​dependabot in #​2221
• fix: pass ProxyAgent proxy status code error by @​NBNGaming in #​2162
• fix failing test by @​KhafraDev in #​2223
• docs: update MockPool.md intercept method description by @​capaj in #​2220
• Update wpts by @​KhafraDev in #​2226
• build(deps): bump github/codeql-action from 2.21.2 to 2.21.5 by @​dependabot in #​2240
• build(deps): bump actions/setup-node from 3.6.0 to 3.8.1 by @​dependabot in #​2237
• build(deps): bump fastify/github-action-merge-dependabot from 3.9.0 to 3.9.1 by @​dependabot in #​2236
• build(deps): bump actions/checkout from 3.5.3 to 3.6.0 by @​dependabot in #​2241
• build(deps): bump actions/dependency-review-action from 3.0.6 to 3.0.8 by @​dependabot in #​2238
• fix: aborting request with non-object error by @​KhafraDev in #​2243
• fix: preserve file path when parsing formdata by @​jimmywarting in #​2245
• build(deps-dev): bump tsd from 0.28.1 to 0.29.0 by @​dependabot in #​2246
• Updated benchmarks by @​mcollina in #​2250
• Fix fetch in node v20.6.0 by @​mcollina in #​2251
• Maybe fix v20 by @​mcollina in #​2252
• feat: Add H2 support by @​metcoder95 in #​2061
• docs: fix tables in README by @​regseb in #​2254
• Fix http2 fetch test by @​mcollina in #​2253

New Contributors

• @​NBNGaming made their first contribution in #​2162
• @​capaj made their first contribution in #​2220
• @​regseb made their first contribution in #​2254

Full Changelog: nodejs/undici@v5.23.0...v5.24.0

---

Configuration

📅 Schedule: Branch creation - Monday through Friday ( * * * * 1-5 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.