Skip to content

fix(deps): update bundled undici to 6.29.1 - #1915

Merged
mldangelo-oai merged 2 commits into
mainfrom
dependabot/npm_and_yarn/github-action/undici-6.29.1
Oct 24, 2026
Merged

fix(deps): update bundled undici to 6.29.1#1915
mldangelo-oai merged 2 commits into
mainfrom
dependabot/npm_and_yarn/github-action/undici-6.29.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •
edited by mldangelo-oai
Loading

Copy link
Copy Markdown
Contributor

Summary

Update the GitHub Action’s bundled HTTP client to pick up the undici 6.29.1 security fixes. Upstream release

Changes

Update undici from 6.28.1 to 6.29.1 in the Action lockfile. Rebuild the checked-in dist/index.cjs that GitHub executes.

Testing

  • Ran the Action build, TypeScript check, metadata check, documentation check, and bundle reproducibility check. All passed.
  • Ran the Action tests on macOS. 174 passed. The runtime installation test requires Linux x64 and runs in Action CI.
  • Verified that a response with six content encodings rejects cleanly without terminating the process.

Risk and rollout

The update satisfies the existing transitive dependency ranges and keeps the Action on Node 24. It changes HTTP handling for response decoding, TLS, and streaming. The bundled update ships with the next Action release.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@dependabot
chore(deps): bump undici from 6.28.1 to 6.29.1 in /github-action
35ab226 
Bumps [undici](https://github.com/nodejs/undici) from 6.28.1 to 6.29.1.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.28.1...v6.29.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.29.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 24, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-24T07:02:59.467209Z 2da050c Manual request
🔒 Security Review ✅ Completed 2026-10-24T07:01:23.905976Z 2da050c New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@mldangelo-oai mldangelo-oai changed the title chore(deps): bump undici from 6.28.1 to 6.29.1 in /github-action fix(deps): update bundled undici to 6.29.1 Oct 24, 2026
@github-actions github-actions Bot added the bug Something isn't working label Oct 24, 2026
@mldangelo-oai

mldangelo-oai commented Oct 24, 2026

Copy link
Copy Markdown
Collaborator

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 24, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 2da050c89f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

mldangelo-oai
mldangelo-oai approved these changes Oct 24, 2026
View reviewed changes

@mldangelo-oai mldangelo-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified the npm integrity hash and rebuilt the Action from its lockfile. The checked-in bundle reproduces, the response-decoding regression probe passes, and hosted Linux validation, smoke tests, and dependency audits all pass.

@mldangelo-oai
mldangelo-oai merged commit 011fdb0 into main Oct 24, 2026
76 checks passed
@mldangelo-oai
mldangelo-oai deleted the dependabot/npm_and_yarn/github-action/undici-6.29.1 branch October 24, 2026 07:11
@github-actions github-actions Bot mentioned this pull request Oct 24, 2026
Merged
3 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mldangelo-oai mldangelo-oai mldangelo-oai approved these changes

Assignees

No one assigned

Labels

bug Something isn't working dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mldangelo-oai