[Snyk] Upgrade undici from 7.28.0 to 8.5.0

[shafeeqd959]

Snyk has created this PR to upgrade undici from 7.28.0 to 8.5.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 10 versions ahead of your current version.

• The recommended version was released 22 days ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: undici

• 8.5.0 - 2026-06-15
• 8.4.1 - 2026-06-08
  

  What's Changed

  • test: avoid localhost lookup in fetch cookies tests by @ mcollina in #5363
  • fix: prevent race condition between onEnd and onTrailers in HTTP/2 client (#5216) by @ mcollina in #5343
  • fix(dns): skip requests without origin by @ marko1olo in #5376
  • docs: add Getting Started guide by @ AliMahmoudDev in #5371
  • docs: fix code examples that crash at runtime and other inaccuracies by @ AliMahmoudDev in #5386
  • fix: handle paused parser on socket end (issue #5360) by @ mcollina in #5389
  • fix(client): reject pipelined TLS altname errors by @ marko1olo in #5373
  • docs: fix multiple inaccuracies in API documentation by @ AliMahmoudDev in #5384
  • docs: fix remaining broken links in API documentation by @ AliMahmoudDev in #5342

  New Contributors

  • @ marko1olo made their first contribution in #5376

  Full Changelog: v8.4.0...v8.4.1

• 8.4.0 - 2026-06-06
  

  What's Changed

  • fix: register connect listener before initiating requests in close-and-destroy test by @ mcollina in #5272
  • test: stabilize tls-cert-leak regression by @ mcollina in #5306
  • fix: replace tspl with native test context in test/examples.js by @ mcollina in #5300
  • http2: remove redundant request stream binding by @ trivikr in #5302
  • test: limit cache-tests workers on Windows by @ mcollina in #5309
  • test: use test context cleanup hooks in parser issue tests by @ mcollina in #5282
  • Add redirect option to strip headers on redirect by @ mcollina in #5281
  • chore(test): fix lint failure by @ aduh95 in #5316
  • chore(ci): use npm ci instead of npm install by @ aduh95 in #5315
  • docs: clarify formData security considerations by @ mcollina in #5320
  • docs: add EventSource server example by @ Will-thom in #5321
  • fix(core): simplify addAbortListener util by @ aduh95 in #5317
  • build(deps-dev): bump ws from 8.20.0 to 8.21.0 by @ dependabot[bot] in #5325
  • build(deps-dev): bump jsondiffpatch from 0.7.3 to 0.7.6 by @ dependabot[bot] in #5313
  • docs: match undici EoL to node version it's bundled in by @ trivikr in #5330
  • fix: handle all HTTP/2 request stream sync errors by @ mcollina in #5311
  • fix: preserve timeout errors for HTTP/2 requests by @ mcollina in #5091
  • fix(core): normalize autoSelectFamily timeout AggregateError by @ youcefzemmar in #5329
  • chore(core): define kEnumerableProperty atomically by @ aduh95 in #5332
  • chore(core): use regex.exec instead of string.match by @ aduh95 in #5331
  • fix: reset invalid HTTP/2 sessions by @ mcollina in #5310
  • feat(connect): add preferH2 connector option to offer h2 first in ALPN by @ Antamansid in #5327
  • test: fix flaky http2 trailers test by @ mcollina in #5338
  • fix(mock): restore single-arg MockCallHistory.filterCallsByX by @ youcefzemmar in #5328
  • docs: document missing error types in Errors.md by @ cesarvspr in #5339
  • build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @ dependabot[bot] in #5346
  • build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @ dependabot[bot] in #5347
  • build(deps): bump uWebSockets.js from v20.67.0 to v20.68.0 in /benchmarks by @ dependabot[bot] in #5352
  • build(deps): bump concurrently from 9.2.1 to 10.0.3 in /benchmarks by @ dependabot[bot] in #5353
  • build(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @ dependabot[bot] in #5348
  • build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @ dependabot[bot] in #5351
  • build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @ dependabot[bot] in #5349
  • docs: improve connect option documentation in Client.md by @ AliMahmoudDev in #5344
  • fix(mock): do not persist snapshots on close in playback mode by @ GeoffreyBooth in #5359
  • fix(fetch): remove abort listener when request settles by @ ATOM00blue in #5318
  • test: add Node.js global fetch regression coverage by @ mcollina in #5361
  • fix(h2): make Client multiplex on h2 (#4143) by @ mcollina in #5362

  New Contributors

  • @ Will-thom made their first contribution in #5321
  • @ youcefzemmar made their first contribution in #5329
  • @ Antamansid made their first contribution in #5327
  • @ cesarvspr made their first contribution in #5339
  • @ AliMahmoudDev made their first contribution in #5344
  • @ ATOM00blue made their first contribution in #5318

  Full Changelog: v8.3.0...v8.4.0

• 8.3.0 - 2026-05-14
  

  What's Changed

  • fix: preserve pool capacity after removing stale client by @ trivikr in #5151
  • build(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @ dependabot[bot] in #5157
  • build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.1 by @ dependabot[bot] in #5162
  • build(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by @ dependabot[bot] in #5156
  • chore(http2): collapse duplicate request stream setup by @ trivikr in #5140
  • perf(client): cache HTTP/2 authority by @ trivikr in #5141
  • build(deps-dev): bump borp from 0.20.2 to 1.0.0 by @ dependabot[bot] in #4819
  • types: add TOpaque to client connect options by @ samuel871211 in #4928
  • build(deps): bump tinybench from 5.1.0 to 6.0.1 in /benchmarks by @ dependabot[bot] in #4688
  • build(deps): bump codecov/codecov-action from 5.5.1 to 6.0.0 by @ dependabot[bot] in #4950
  • build(deps): bump actions/dependency-review-action from 4.8.1 to 4.9.0 by @ dependabot[bot] in #4951
  • test(fetch): add userinfo coverage for issue-4897 URLs by @ mcollina in #4901
  • perf: avoid duplicate pool dispatcher selection on backpressure by @ trivikr in #5149
  • build(deps): bump actions/setup-node from 6.2.0 to 6.4.0 by @ dependabot[bot] in #5163
  • build(deps): bump step-security/harden-runner from 2.14.1 to 2.19.1 by @ dependabot[bot] in #5160
  • build(deps): bump cronometro from 5.3.0 to 6.0.3 in /benchmarks by @ dependabot[bot] in #4687
  • build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @ dependabot[bot] in #5161
  • build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @ dependabot[bot] in #4853
  • build(deps): bump hendrikmuhs/ccache-action from 1.2.22 to 1.2.23 by @ dependabot[bot] in #5158
  • build(deps): bump fastify/github-action-merge-dependabot from 3.11.2 to 3.12.0 by @ dependabot[bot] in #5159
  • build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @ dependabot[bot] in #4854
  • build(deps): bump uWebSockets.js from v20.64.0 to v20.66.0 in /benchmarks by @ dependabot[bot] in #5130
  • docs: mention install() also installs WebSocket globals by @ mcollina in #5174
  • types: stop interfering with @ types/node by @ Renegade334 in #5173
  • fix: align h2 empty body content-length methods with h1 by @ trivikr in #5172
  • build(deps-dev): bump fast-check from 4.6.0 to 4.7.0 by @ dependabot[bot] in #5192
  • build(deps-dev): bump typescript from 6.0.2 to 6.0.3 by @ dependabot[bot] in #5191
  • test: move cleanup from finally to after hooks by @ trivikr in #5194
  • test: resolve flaky timeout in issue-3356 by @ trivikr in #5188
  • SnapshotAgent: Add normalizeBody and normalizeQuery by @ GeoffreyBooth in #5121
  • fix(socks5): use configured connector in Socks5ProxyAgent by @ trivikr in #5168
  • perf(http2): avoid isArray checks for common headers by @ trivikr in #5170
  • fix(test): make deduplicate body-streaming test non-flaky by @ mcollina in #5196
  • test(retry): add regression test for RetryAgent + HTTP/2 stream timeout (#5137) by @ mcollina in #5176
  • fix(socks5): preserve dispatch backpressure return value by @ trivikr in #5166
  • perf(http2): end zero-length request bodies with headers by @ trivikr in #5169
  • fix(test): make issue-2898-comment.js assertion robust against flakiness by @ mcollina in #5208
  • test: disable timeouts in h2 high concurrency regression by @ trivikr in #5205
  • test: deflake stream compat coverage by @ mcollina in #5209
  • fix(dispatcher): remove unreachable assert in writeBlob by

[shafeeqd959]

This is a major version upgrade from v7 to v8 with significant breaking changes that require developer action.

Key Breaking Changes:

• Node.js Version Requirement: undici v8 requires Node.js version 22.19.0 or higher. Applications running on older Node.js versions must be upgraded. [1]
• HTTP/2 Enabled by Default: undici v8 now enables HTTP/2 by default if the server supports it. Applications that rely on HTTP/1.1-specific behavior may break. [1, 7]
• Custom Dispatcher API: The legacy dispatcher handler API has been removed. Callbacks like onConnect, onHeaders, and onComplete must be migrated to the new v2 API. [1, 7]

Recommendation:

• Verify that your environment meets the new Node.js version requirement.
• If your application depends on HTTP/1.1 behavior, you must explicitly disable HTTP/2 by setting allowH2: false in your client configuration. [1]
• If you use custom dispatchers or interceptors, you must refactor your code to use the new v2 dispatcher API.

Source: Migrating from Undici 7 to 8

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed