Repository navigation
fix(deps): patch the undici advisories under wrangler - #142
Merged
Merged
Conversation
miniflare 5.20261006.1-alpha (from wrangler 4.149.0) pins undici at exactly 7.29.1, so Dependabot can't update it. Override undici 7 to ^7.30.1, the same override toolbelt and ogcops use. The lockfile only changes the undici entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this change?
wrangler 4.149.0 brings in miniflare 5.20261006.1-alpha, which pins undici at exactly 7.29.1. That version is behind the five open Dependabot alerts (GHSA-xjj6-f33q-929c, GHSA-qrxm-fqhp-jwvm, GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26 and GHSA-9fm3-97px-rjf6), all fixed in 7.30.1. Dependabot can't move an exact pin, so this adds the same override toolbelt and ogcops already have,
"undici@7": "^7.30.1". The lockfile only changes the undici entry.undici is a dev dependency here (it comes in through wrangler's local dev server), so the deployed Worker doesn't include it.
How I tested this
npm cion Node 22, andnpm ls undicishows 7.30.1 (overridden).npm auditfinds 0 vulnerabilities, where develop has the undici ones.npm run typecheckis clean,npm testpasses all 414 tests,wrangler deploy --dry-runbuilds, andwrangler devserves/leaderboard/2026-11, its JSON and/funding.jsonwith 200.