[Snyk] Upgrade undici from 5.22.1 to 5.28.2

[leonardoadame]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade undici from 5.22.1 to 5.28.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 26 versions ahead of your current version.
• The recommended version was released 22 days ago, on 2023-11-30.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Information Exposure SNYK-JS-UNDICI-5962466	409/1000 Why? Has a fix available, CVSS 3.9	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: undici

• 5.28.2 - 2023-11-30
  

  What's Changed

  • fix: remove optional chainning for compatible with Nodejs12 and below by @ bugb in #2470
  • fix: remove node: prefix by @ tsctx in #2471
  • perf: avoid Headers initialization by @ tsctx in #2468
  • fix: handle SharedArrayBuffer correctly by @ tsctx in #2466
  • fix: Add null type to signal in RequestInit by @ gebsh in #2455
  • fix: correctly handle data URL with hashes. by @ tsctx in #2475
  • fix: check response for timinginfo allow flag by @ ToshB in #2477
  • Make call to onBodySent conditional in RetryHandler by @ MzUgM in #2478
  • refactor: better integrity check by @ tsctx in #2462
  • fix: Added support for inline URL username:password proxy auth by @ matt-way in #2473
  • build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @ dependabot in #2472
  • build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @ dependabot in #2405
  • build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @ dependabot in #2396
  • build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @ dependabot in #2395
  • build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @ dependabot in #2392
  • build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @ dependabot in #2389
  • build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @ dependabot in #2302

  New Contributors

  • @ bugb made their first contribution in #2470
  • @ gebsh made their first contribution in #2455
  • @ ToshB made their first contribution in #2477
  • @ MzUgM made their first contribution in #2478
  • @ matt-way made their first contribution in #2473

  Full Changelog: v5.28.1...v5.28.2

• 5.28.1 - 2023-11-27
  

  What's Changed

  • perf: Improve normalizeMethod by @ tsctx in #2456
  • fix: dispatch error handling by @ ronag in #2459
  • perf(request): optimize if headers are given by @ tsctx in #2454

  Full Changelog: v5.28.0...v5.28.1

• 5.28.0 - 2023-11-24
  Read more
• 5.27.2 - 2023-11-03
  

  Full Changelog: v5.27.1...v5.27.2

• 5.27.1 - 2023-11-03
  

  What's Changed

  • add regression test by @ KhafraDev in #2376
  • fix: define conditions when content-length should be sent by @ pxue in #2305
  • refactor: removed unnecessary default by @ nikelborm in #2381
  • fix: stream body handling by @ ronag in #2391

  New Contributors

  • @ pxue made their first contribution in #2305
  • @ nikelborm made their first contribution in #2381

  Full Changelog: v5.27.0...v5.27.1

• 5.27.0 - 2023-10-26
  

  What's Changed

  • Use sets and reusable TextEncoder/TextDecoder instances by @ kibertoad in #2368
  • feat: forward onRequestSent to handler by @ ronag in #2375
  • skip bundle test on node 16 by @ KhafraDev in #2377
  • fix windows CI by @ KhafraDev in #2379

  Full Changelog: v5.26.5...v5.27.0

• 5.26.5 - 2023-10-23
  Read more
• 5.26.4 - 2023-10-19
  Read more
• 5.26.3 - 2023-10-11
  No content.
• 5.26.2 - 2023-10-11
  

  Security Release, CVE-2023-45143.

• 5.26.1 - 2023-10-11
• 5.26.0 - 2023-10-11
• 5.25.4 - 2023-10-03
• 5.25.3 - 2023-10-01
• 5.25.2 - 2023-09-22
• 5.25.1 - 2023-09-20
• 5.25.0 - 2023-09-20
• 5.24.0 - 2023-09-08
• 5.24.0-test.6 - 2023-09-20
• 5.24.0-test.5 - 2023-09-19
• 5.24.0-test.4 - 2023-09-19
• 5.24.0-test.3 - 2023-09-19
• 5.24.0-test.2 - 2023-09-19
• 5.24.0-test.1 - 2023-09-19
• 5.24.0-test.0 - 2023-09-19
• 5.23.0 - 2023-08-03
• 5.22.1 - 2023-05-11

from undici GitHub release notes

Commit messages

Package name: undici

• 9a14e5f Bumped v5.28.2
• fcdfe87 build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 (Route with no content is not torn down properly on navigation sveltejs/kit#2302)
• 169c157 build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 ([fix] deeply-nested error components render with correct layout sveltejs/kit#2389)
• 9788177 build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 (Version Packages (next) sveltejs/kit#2392)
• 1f6d159 build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 ([chore] remove overriden CSS property sveltejs/kit#2395)
• a393a86 build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 ([chore] template: use installed cookie package to serialize cookie sveltejs/kit#2396)
• ea2f606 build(deps-dev): bump sinon from 16.1.3 to 17.0.1 (chore: bump lockfile after versioning sveltejs/kit#2405)
• 80979ed build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 (deno svelte kit sveltejs/kit#2472)
• 08183ea fix: Added support for inline URL username:password proxy auth (Remove usages of waitForTimeout sveltejs/kit#2473)
• 28759f4 refactor: better integrity check ([fix] browser only redirect during load sveltejs/kit#2462)
• ed15e98 Make call to onBodySent conditional in RetryHandler (Pages with duplicate styling blocks don't always generate a .css file on build sveltejs/kit#2478)
• 19c69a0 fix: check response for timinginfo allow flag (Async _navigate() unintuitively prevents scrolling or focusing with onMount() or actions sveltejs/kit#2477)
• c5d73ca fix: correctly handle data URL with hashes. (Version Packages (next) sveltejs/kit#2475)
• 0437f69 Add `null` to `signal` in `RequestInit` (Page script is only executed once sveltejs/kit#2455)
• 56efa96 fix: handle SharedArrayBuffer correctly (Version Packages (next) sveltejs/kit#2466)
• c182c32 perf: avoid Headers initialization (client only components sveltejs/kit#2468)
• 6298bfa fix: remove `node:` prefix (Cannot run npm init svelte@next sveltejs/kit#2471)
• 02807b6 fix: remove optional chainning for compatible with Nodejs12 and below (ParseError: Semicolon or block is expected sveltejs/kit#2470)
• 286bb44 Bumped v5.28.1
• 600a952 Revert "chore: less async await (Version Packages (next) sveltejs/kit#2463)"
• e7ab79a chore: less async await (Version Packages (next) sveltejs/kit#2463)
• 0c45ff7 perf(request): optimize if headers are given (Error pages in SPA mode adapter-static sveltejs/kit#2454)
• ac30400 fix: dispatch error handling (Include a default adapter for the demo project sveltejs/kit#2459)
• 17c7a73 perf: Improve `normalizeMethod` (Vite deduplication causing problems with non-deterministic asset order sveltejs/kit#2456)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.