Repository navigation
fix(core): bump undici to ^7.29.1 to resolve security advisories - #37569
AgentEnder wants to merge 1 commit into
Conversation
undici 7.29.0 is affected by ten advisories, all patched in 7.29.1. Raising the floor keeps lockfiles that already hold 7.29.0 from satisfying the range. Fixes #37331
✅ Deploy Preview for nx-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for nx-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
View your CI Pipeline Execution ↗ for commit 9b97972
☁️ Nx Cloud last updated this comment at |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
There was a problem hiding this comment.
Nx Cloud has identified a possible root cause for your failed CI:
We looked into the failed populate-e2e-base-workspace task. Our yarn base workspaces failed with "Release not found: 1.22.22" during yarn set version 1.22.22, which is an external release lookup problem and not related to the undici bump in this PR. We aren't suggesting any code changes.
No code changes were suggested for this issue.
Trigger a rerun:
🎓 Learn more about Self-Healing CI on nx.dev
Current Behavior
nxdepends onundici@^7.29.0. Lockfiles that resolved 7.29.0 makenpm auditreport ten advisories (one high), including GHSA-3wwx-pv8p-q78v and GHSA-w293-vg96-wgc3.Expected Behavior
The range is now
^7.29.1, which is the first 7.x release that patches all ten. Because 7.29.0 no longer satisfies the range, a lockfile that still holds it gets refreshed. The repo lockfile resolves 7.30.1.This PR keeps Nx on undici 7. undici 8 requires Node >=22.19.0, so moving to it would change the supported Node floor and should go in a separate PR.
Related Issue(s)
Fixes #37331
View Polygraph session ↗