[dependabot]

Bumps undici to 7.29.1 and updates ancestor dependencies undici, @release-it/conventional-changelog and release-it. These dependencies need to be updated together.

Updates undici from 6.21.1 to 7.29.1

Release notes

Sourced from undici's releases.

v7.29.1

⚠️ Security fixes

High severity

• GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.
• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.
• GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.
• GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.
• GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.
• GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

• GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.
• GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.
• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

• [v7.x] drop: remove Node.js 26 from shared-builtin CI build by @​mcollina in nodejs/undici#5592
• fix(h2): honour headersTimeout by @​mcollina in nodejs/undici#5604
• fix(h2): keep the connection ref'd while requests are outstanding by @​mcollina in nodejs/undici#5605
• ci: increase Windows workflow timeout on v7.x by @​mcollina in nodejs/undici#5621
• fix(h2): retire the request that completed, not the head of the queue by @​mcollina in nodejs/undici#5618
• fix(h2): settle a request whose stream is cancelled by @​mcollina in nodejs/undici#5607
• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5646
• fix(h2): handle GOAWAY for CONNECT streams by @​mcollina in nodejs/undici#5640
• [v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5769

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

... (truncated)

Commits

• d39a83e Bumped v7.29.1 (#5772)
• 0d88464 fix(test): remove unused EventEmitter import
• f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
• 3c67265 fix(retry): settle exposed body on terminal failure
• cd8af90 fix(retry): validate resumed response framing
• 6615e01 fix(websocket): reject unrequested subprotocols
• 2c7d7e1 fix(decompress): limit decompressed response size
• b6c5a00 fix(cache): do not cache Set-Cookie in shared caches
• 21693f4 fix(interceptor/dump): abort oversized chunked responses
• f690157 fix: preserve BalancedPool connection options
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Updates @release-it/conventional-changelog from 10.0.6 to 12.0.2

Release notes

Sourced from @​release-it/conventional-changelog's releases.

Release 12.0.2

• Stage diving is never a good idea (65dda97cf3d94b4a9376c0fce2126c6e0cd83d23)

Release 12.0.1

• Migrate to pnpm (1df408d0b)
• Update dependencies (6d5e4663b)
• Narrow engines.node a bit (e5d723f3a)
• Enable npm staged publishing (39959f474)

Release 12.0.0

• Skip prereleases without a recommended bump (resolve #151) (3451b9d346c27228b02a099a22838216e833a1ba)
• Avoid shell interpolation when staging changelogs (resolve #149) (dbaba1c8eee91fa792986c90c9767a2f6f78e123)
• Use resolved tag as recommended bump boundary (resolve #99) (d7cce4d82cfce4b90998f34b99f624ae7cb7f454)
• Document stable prerelease promotion (resolve #152) (9fa21def00e690ed9c4cfb72ee6ebfe82d291b4d)
• Upgrade dependencies (41b3201f1746605e6cc11bea70ba9ddb2b7e2bb8)

Release 11.0.1

• Restore no-preset fallback to prevent whatBump error (636c254fd1df5c4858d9ab48d1e1c13a1f24412a)
• Bump tmp from 0.2.5 to 0.2.6 (#145) (ce9a599e2762247bc8c71143214ab1cc6c162489) - thanks @​dependabot[bot]!
• Update dependencies (063b6af211b095465490e5b1c801955c7d25e72e)
• Derive tag prefix from resolved tag for recommended bump (resolve #80) (8947320a51403c8eaf47eebad8d3cef637cc3279)
• Document transform override and parseCommits resolution (resolve #78, resolve #137) (f3461f1ed7133bb70022ae4e6dbdd011f6d4641d)
• Run tests on Node 26 (74812985412d061d39352071a0c04666e25c61c5)

Release 11.0.0

• Fix repository.url (23d3d9cd50fdb4475b8736273a776541833862c0)
• docs: fix broken links and remove outdated override warning (#138) (344bad3bf2f90618a86d3e38883a5d5eff12aaf1) - thanks @​aarondpn!
• fix: support release-it 20 (#142) (043242693e5c88244a25fbcf0dceafcbf955588f) - thanks @​twk3!
• Update dependencies & bump engines.node (1b746e6b5a26335cf01c314074dcf7e291c260a0)

Commits

• 7f28a71 Release 12.0.2
• 65dda97 Stage diving is never a good idea
• b0143b8 Release 12.0.1
• 39959f4 Enable npm staged publishing
• e5d723f Narrow engines.node a bit
• 6d5e466 Update dependencies
• 1df408d Migrate to pnpm
• ee8b92e Release 12.0.0
• 41b3201 Upgrade dependencies
• 9fa21de Document stable prerelease promotion (resolve #152)
• Additional commits viewable in compare view

Updates release-it from 18.1.2 to 21.1.1

Release notes

Sourced from release-it's releases.

Release 21.1.1

• docs: add release-it-git-cliff to plugins list (#1334) (bf2a3d8625f1ffb68cab1a55564761493febf381) - thanks @​adamhl8!
• Update undici to 7.29.1 (resolve #1335) (37898f1b44d88555ce25a573ea3ce379279a8279)
• Update more dependencies (7bd73af08fe1a1b3ba0a436f888f102263fcf2c9)
• Migrate verkit import (5336543483af172853668d3b67def6eafc6a652a)

Release 21.1.0

• chore(deps): replace semver with verkit (#1329) (033dca25dcca548d889b13e0ae1b7d063b0dca92) - thanks @​gameroman!
• fix(schema): remove fragment from schema $id values (#1332) (6e4022238a2255d86842321d6cc8f5b72fc39194) - thanks @​DanMat!
• Fix version increments and coercion after verkit migration (eab4b8cef600379dc0211bebb9c8de0df1ce9bdb)
• Log in to npm automatically before interactive publishing (resolve #1333) (76e409fd271509706307e31b1658389afb678d89)
• Support proxy environment variables in GitLab (resolve #1131) (#1331) (afb5565a09dfd38a02d5dbcc6c6317d824ffcccd) - thanks @​mrpmohiburrahman!
• Update dependencies (9ca5d328012cd740094841069d295df8152ad695)
• Narrow engines.node (98dcf1910981e13236d7ac02106a134bec71387d)
• Fix version coercion for verkit 0.4 (7ee54c2d7528244a032da948f478381d898ee52a)

Release 21.0.3

• Fix npm staging approval URL and prompt (9f64e098aa04aac44fe9484add1f1f2119fa294c)

Release 21.0.2

• Prevent duplicate comments on resolved issues and PRs (#1324) (7ca61cccd16ad56742ee0cb694c946353b66c117) - thanks @​krisu-pl!
• Migrate to pnpm + update deps (6c211f087f465af8942060812ec4ee662419da9f)

Release 21.0.1

• Fix regression and support --no-hooks to skip all hooks (a8888b45b1d9db40a8f8ea5ad625b15b53d78925)

Release 21.0.0

• fix(ci): do not run integration on forks (#1315) (1e90d9f28f08a847029ed58f8ac211028d4203ca) - thanks @​trueberryless!
• Pin GitHub Actions to immutable commits (#1316) (38355d8068ac5c0818bc183ddb39db643aeab0c3)
• Fix npm publish workspace config resolution (#1312) (3bf251f5ab4c3665397aef8a7a4db6a21e02a98f) - thanks @​cyphercodes!
• Add gitlab.repoId option (#1224) (e4e9d0e35cbd99492c8b1a7b48e5a695951af7a2) - thanks @​microHoffman!
• Exit successfully when no release version is available (56c70c3f1436101a9284c535bed233081af85960)
• Support numeric GitLab repository IDs (0332c4ac4ecb8b714c8971b3953c972f59fe1f30)
• Parse CLI arguments strictly (resolve #1196) (caf77c928bfefa48339e8246261ffb8e41d70a4c)
• fix: shell caching and working tree detection (#1317) (8d1f7522ffc6afb445a00ab03357fdc7554b48ac) - thanks @​Mopsgamer!
• Remove dependabot workflow (e7e04ef3fb6151324ffde438a278539fbbc24eec)
• Fix configured GitHub proxy routing (1ed9cddf5d18d2c4107500081254cc7af22eff42)
• Upgrade dependencies and require Node 22 (c055e7fa5b2dcaf5078d4a5c337140a5bea0ac7e)
• Fix npm custom registry argument handling (resolve #1318) (98c45c4503e1d8bad0b7c38d99f6fda380c3681e)
• Pin GitLab releases to the current commit (resolve #1216) (70ab5769852bc5a3fafe4ac193f28bd247fa067e)
• Refresh GitHub Actions and package preview runtime (5c5513966ba2d4f1133c9b33c33850470c12a934)
• Document v21 runtime requirements (daab8460c0f0ed7f8a97c0ef806ef506d59f7268)
• Simplify git-cliff recipe (resolve #1195) (52c89a7965d3aff0a5d2474903fc902dbde59cf5)
• Make GitLab CA tests platform-independent (ba4326fb1a79b700a909ac6adab8bd242401971c)
• Raise Node 22 requirement to 22.21 (df94838844154a6b885af1888af81a75d43c80d9)
• Verify GitLab server certificates by default (c381a2d4ce1deb26a9e54ead63339c4860231bfd)
• Update changelog for v21 (2637e8a91fb560f23686773d3f476bff20daa5ae)

Release 20.2.1

• Document the draft flow for GitHub immutable releases (284e63c6d2022eaf87f9fa66373ca6ad6a942ea0)

... (truncated)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: [https://github.com/release-it/release-it/releases][1]

v21 (2026-07-25)

• Removed support for Node.js v20 and raised the Node.js v22 minimum to v22.21.0.
• CLI argument parsing is now strict. Unknown options, invalid booleans, and extra positional arguments are rejected.
• GitLab server certificates are verified by default. Configure private CA or explicitly set gitlab.secure to false.

v20 (2026-03-24)

• Upgraded undici from v6 to v7 to resolve security vulnerabilities.
• Upgraded proxy-agent from v6 to v7 to fix DEP0169 (url.parse() deprecation).
• Migrated from deprecated inquirer to @inquirer/prompts.
• Bumped engines.node to minimum Node.js v20.19.0 (was v20.12.0).

v19 (2025-04-18)

• No breaking changes (dependency party)

v18 (2025-01-06)

• Removed support for Node.js v18.

v17 (2023-11-11)

• Removed support for Node.js v16.

v16 (2023-07-05)

• Removed support for Node.js v14.

v15 (2022-04-30)

• Removed support for Node.js v10 and v12.
• Removed support for GitLab v12.4 and lower.
• Removed anonymous metrics (and the option to disable it).
• Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

• Removed global property from plugins. Use this.config[key] instead.
• Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

... (truncated)

Commits

• 4548399 Release 21.1.1
• 5336543 Migrate verkit import
• 7bd73af Update more dependencies
• 37898f1 Update undici to 7.29.1 (resolve #1335)
• bf2a3d8 docs: add release-it-git-cliff to plugins list (#1334)
• ef1f03b Release 21.1.0
• 7ee54c2 Fix version coercion for verkit 0.4
• 98dcf19 Narrow engines.node
• 9ca5d32 Update dependencies
• afb5565 Support proxy environment variables in GitLab (resolve #1131) (#1331)
• Additional commits viewable in compare view

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Superseded by #119.