Repository navigation
Release tooling: resolve Dependabot #21 for bundled undici 6.29.0 #460
Description
Existing finding
GitHub reports Dependabot alert #21: GHSA-xjj6-f33q-929c, denial of service through an unhandled error on excessive content encodings. The alert is open, severity high, created 2026-10-24. Its affected range is >=6.23.0 <6.29.1; the first patched version is 6.29.1.
package-lock.json on main aa41820aa91659e6789633117f87597b3c6e7649 contains node_modules/npm/node_modules/undici at 6.29.0. This is a transitive development dependency of the release tooling. The finding was surfaced by the push for #459, whose diff changes no dependency manifest or lockfile; it predates that PR. No existing issue mentioning undici or this advisory was found.
Expected result
- Update the release tooling dependency chain/lockfile to eliminate the vulnerable bundled copy without an unrelated major migration.
- Verify the actual nested installed version after
npm ci, dependency audit and existing release-configuration checks. - Use the repository's release dry-run validation where applicable; do not perform a real NuGet release as part of this fix.
Recorded separately under CLAUDE.md's scope rule while #459 is in progress.
Activity
dborgards commentedon Oct 26, 2026
Investigation on 2026-10-26 after #459 merged (
d74230b9). No repository files or dependency pins were changed.The vulnerable installed file remains
node_modules/npm/node_modules/undici/package.jsonat 6.29.0. I reproduced the following in separate temporary projects with scripts disabled:overrides: { "npm": { "undici": "6.29.1" } }, followed by freshnpm ci --ignore-scripts: actual nested version 6.29.0.npm audit fix --ignore-scripts: reports a repair as available but leaves the actual nested version 6.29.0.inBundleremoved: freshnpm cistill installs 6.29.0, while the lock can misleadingly continue to say 6.29.1.^11.6.2range): its actual bundled undici is also 6.29.0; no benefit from that major override.8834421d14085fdf6e871e6f3a20f6ae1b3de599, installed as a Git dependency: CLI version 11.21.1, bundled undici still 6.29.0. A bare source tarball also leaves old dependencies and lacks workspace packages needed by the CLI.The root application's other undici copies are already patched (6.29.1 and 7.30.1). npm's documentation explicitly notes that published bundles can dictate their own resolutions. The advisory requires a genuinely patched copy, not a cosmetic lockfile edit.
Leaving this open pending a patched upstream npm bundle or an explicit packaging-policy decision (for example maintaining/repacking a patched bundle). Replacing the unused npm release plugin with an unrelated alias or adding an ad-hoc privileged install-time patch would change the tooling contract and has not been done. No PR or release was created for this investigation.
dborgards commentedon Oct 27, 2026
Fresh recheck on 2026-10-27 after #487 merged (
d80bf712), without repository dependency changes or a release:^11.6.2range is still 11.21.1. Fresh isolatednpm ci --ignore-scriptsfrom the actual main manifests installsnode_modules/npm/node_modules/undici/package.jsonat 6.29.0.npm ciin a second isolated project, also contains bundled undici 6.29.0. It is outside the allowed major range and still provides no repair.@semantic-release/npm13.2.0 still declares npm^11.6.2; its version alone does not supply a patched npm bundle.ip-addressis affected by GHSA-rxp7-6hxx-x8q5. Both bundled copies must be genuinely repaired; this audit is not clean.The existing upstream-bundle/packaging prerequisite therefore remains. No ineffective overrides, cosmetic lock edit, privileged install patch, major tooling migration or real NuGet publication was introduced. Recommendation remains an actually patched upstream bundle; a maintained repack/replacement policy needs an explicit contract and maintenance decision. Evidence, install logs and full audit JSON are retained under
/private/tmp/cankit-460-recheck-20261027-n0w_5fu3/in this workspace.