[Snyk] Upgrade undici from 5.22.1 to 5.28.0

[leonardoadame]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade undici from 5.22.1 to 5.28.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 24 versions ahead of your current version.
• The recommended version was released 23 days ago, on 2023-11-24.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Information Exposure SNYK-JS-UNDICI-5962466	409/1000 Why? Has a fix available, CVSS 3.9	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: undici

• 5.28.0 - 2023-11-24
  

  What's Changed

  • fix(parseHeaders): util.parseHeaders handle correctly array of buffer… by @ mdoria12 in #2398
  • docs: add license to undici-types by @ dancastillo in #2401
  • perf: optimize Readable.dump by @ ronag in #2402
  • perf(headers): Improve Headers by @ tsctx in #2397
  • test: re-enable conditional WPT Report for websockets by @ panva in #2407
  • fix: delay abort on 'close' by @ ronag in #2408
  • refactor: use substring instead of substr by @ tsctx in #2411
  • add additional http2 test with fetch by @ KhafraDev in #2419
  • fix: HTTPToken check by @ tsctx in #2410
  • perf: optimize HeadersList.get by @ tsctx in #2420
  • properly handle pseudo-headers in fetch by @ KhafraDev in #2422
  • perf(headers): if the guard is immutable by @ tsctx in #2424
  • fix(mock-agent): send stream body by @ tsctx in #2425
  • build(deps): bump github/codeql-action from 2.21.5 to 2.22.5 by @ dependabot in #2394
  • feat(#2264): Expose Retry Handler by @ metcoder95 in #2281
  • fix: implement Headers#set correctly by @ tsctx in #2432
  • fix: implement Headers#delete correctly by @ tsctx in #2430
  • test: update websocket wpt availability by @ panva in #2437
  • fix: type comment position by @ tsctx in #2443
  • fix: onHeaders type declaration by @ tsctx in #2444
  • remove http2 status pseudo header from headers by @ KhafraDev in #2438
  • docs: Clarify path matching in intercept() by @ oliversalzburg in #2426
  • fix: set-cookie clone by @ tsctx in #2446
  • docs: fix typo in maxConcurrentStreams by @ tniessen in #2450
  • refactor: remove leftovers by @ metcoder95 in #2451
  • refactor: add missing new operator by @ tsctx in #2452

  New Contributors

  • @ mdoria12 made their first contribution in #2398
  • @ tsctx made their first contribution in #2397
  • @ oliversalzburg made their first contribution in #2426

  Full Changelog: v5.27.2...v5.28.0

• 5.27.2 - 2023-11-03
  

  Full Changelog: v5.27.1...v5.27.2

• 5.27.1 - 2023-11-03
  

  What's Changed

  • add regression test by @ KhafraDev in #2376
  • fix: define conditions when content-length should be sent by @ pxue in #2305
  • refactor: removed unnecessary default by @ nikelborm in #2381
  • fix: stream body handling by @ ronag in #2391

  New Contributors

  • @ pxue made their first contribution in #2305
  • @ nikelborm made their first contribution in #2381

  Full Changelog: v5.27.0...v5.27.1

• 5.27.0 - 2023-10-26
  Read more
• 5.26.5 - 2023-10-23
  Read more
• 5.26.4 - 2023-10-19
  Read more
• 5.26.3 - 2023-10-11
  No content.
• 5.26.2 - 2023-10-11
  

  Security Release, CVE-2023-45143.

• 5.26.1 - 2023-10-11
  

  What's Changed

  • Fix publish undici-types once and for all! by @ Ethan-Arrowood in #2338
  • Fix node detection omfg by @ KhafraDev in #2341

  Full Changelog: v5.26.0...v5.26.1

• 5.26.0 - 2023-10-11
  Read more
• 5.25.4 - 2023-10-03
• 5.25.3 - 2023-10-01
• 5.25.2 - 2023-09-22
• 5.25.1 - 2023-09-20
• 5.25.0 - 2023-09-20
• 5.24.0 - 2023-09-08
• 5.24.0-test.6 - 2023-09-20
• 5.24.0-test.5 - 2023-09-19
• 5.24.0-test.4 - 2023-09-19
• 5.24.0-test.3 - 2023-09-19
• 5.24.0-test.2 - 2023-09-19
• 5.24.0-test.1 - 2023-09-19
• 5.24.0-test.0 - 2023-09-19
• 5.23.0 - 2023-08-03
• 5.22.1 - 2023-05-11

from undici GitHub release notes

Commit messages

Package name: undici

• 66029d1 Bumped v5.28.0
• 9e80fb1 refactor: add missing new operator (Move packaging support into a separate package? sveltejs/kit#2452)
• e495094 fix: bad error handling
• 039fa15 refactor: remove leftovers (Page with At sign (@) at the beginning of the file name ignored by routes sveltejs/kit#2451)
• 99c38c6 docs: fix typo in maxConcurrentStreams (svelte-kit package errors due to not removing lang="ts" sveltejs/kit#2450)
• 0cc7e87 fix: set-cookie clone ([docs] rename troubleshooting docs section and link more resources sveltejs/kit#2446)
• 5d77bf2 docs: Clarify `path` matching in `intercept()` (A way to provide info from platform request to application sveltejs/kit#2426)
• 90831ae remove http2 status pseudo header from headers (Version Packages (next) sveltejs/kit#2438)
• 6631655 fix: `onHeaders` type declaration ($page.query not available in production mode sveltejs/kit#2444)
• 42c05a8 fix: type comment position (Fixed a very minor grammatical error sveltejs/kit#2443)
• b37bbf7 test: update websocket wpt availability ([fix] provide valid value for letter-spacing CSS property in template sveltejs/kit#2437)
• ba4ca32 fix: implement `Headers#delete` correctly ([feat] prefer functions to globs sveltejs/kit#2430)
• 5555e5e fix: implement `Headers#set` correctly ([fix] update to TS 4.4.3 sveltejs/kit#2432)
• f996014 feat(Service worker breaks AMP validation sveltejs/kit#2264): Expose Retry Handler ([fix] service worker scope and registration sveltejs/kit#2281)
• 99932f1 build(deps): bump github/codeql-action from 2.21.5 to 2.22.5 ([feat] add CSP nonces to script/style tags sveltejs/kit#2394)
• 91ca13c fix(mock-agent): send stream body (Add homepage to package.json sveltejs/kit#2425)
• 987b92e perf(headers): if the guard is immutable (browser-only redirect during load not working sveltejs/kit#2424)
• ecac429 properly handle pseudo-headers in fetch ([chore] upgrade node-fetch to 3.0.0 final sveltejs/kit#2422)
• a3af41c perf: optimize HeadersList.get (Version Packages (next) sveltejs/kit#2420)
• a1342a7 fix: HTTPToken check ([adapter-node] Cannot use import statement outside a module sveltejs/kit#2410)
• 9c1ab5a add additional http2 test with fetch (Version Packages (next) sveltejs/kit#2419)
• b8483ab refactor: use substring (500: Module "stream" has been externalized for browser compatibility sveltejs/kit#2411)
• 57fd343 fix: delay abort on 'close' ([fix] don't format when building sveltejs/kit#2408)
• a593323 test: re-enable conditional WPT Report for websockets ([fix] prerendering not working with kit.paths.base set. sveltejs/kit#2407)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.