[dependabot]

Bumps undici to 7.30.1 and updates ancestor dependencies undici, @release-it/conventional-changelog and release-it. These dependencies need to be updated together.

Updates undici from 6.21.1 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits

• 7507102 Bumped v7.30.1 (#6022)
• 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
• 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
• 5394462 fix(websocket): bound automatic PONG writes under backpressure
• 2991627 fix(eventsource): bound retained SSE parser state
• 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
• 63cba77 fix(decompress): converge downstream handler throws to per-request errors
• 07ded49 fix(fetch): abort excessive content encoding responses
• b20b82a fix(cache): prevent cross-origin redirect cache confusion
• 04cb74b fix: preserve Agent connection options
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Updates @release-it/conventional-changelog from 10.0.6 to 12.0.2

Release notes

Sourced from @​release-it/conventional-changelog's releases.

Release 12.0.2

• Stage diving is never a good idea (65dda97cf3d94b4a9376c0fce2126c6e0cd83d23)

Release 12.0.1

• Migrate to pnpm (1df408d0b)
• Update dependencies (6d5e4663b)
• Narrow engines.node a bit (e5d723f3a)
• Enable npm staged publishing (39959f474)

Release 12.0.0

• Skip prereleases without a recommended bump (resolve #151) (3451b9d346c27228b02a099a22838216e833a1ba)
• Avoid shell interpolation when staging changelogs (resolve #149) (dbaba1c8eee91fa792986c90c9767a2f6f78e123)
• Use resolved tag as recommended bump boundary (resolve #99) (d7cce4d82cfce4b90998f34b99f624ae7cb7f454)
• Document stable prerelease promotion (resolve #152) (9fa21def00e690ed9c4cfb72ee6ebfe82d291b4d)
• Upgrade dependencies (41b3201f1746605e6cc11bea70ba9ddb2b7e2bb8)

Release 11.0.1

• Restore no-preset fallback to prevent whatBump error (636c254fd1df5c4858d9ab48d1e1c13a1f24412a)
• Bump tmp from 0.2.5 to 0.2.6 (#145) (ce9a599e2762247bc8c71143214ab1cc6c162489) - thanks @​dependabot[bot]!
• Update dependencies (063b6af211b095465490e5b1c801955c7d25e72e)
• Derive tag prefix from resolved tag for recommended bump (resolve #80) (8947320a51403c8eaf47eebad8d3cef637cc3279)
• Document transform override and parseCommits resolution (resolve #78, resolve #137) (f3461f1ed7133bb70022ae4e6dbdd011f6d4641d)
• Run tests on Node 26 (74812985412d061d39352071a0c04666e25c61c5)

Release 11.0.0

• Fix repository.url (23d3d9cd50fdb4475b8736273a776541833862c0)
• docs: fix broken links and remove outdated override warning (#138) (344bad3bf2f90618a86d3e38883a5d5eff12aaf1) - thanks @​aarondpn!
• fix: support release-it 20 (#142) (043242693e5c88244a25fbcf0dceafcbf955588f) - thanks @​twk3!
• Update dependencies & bump engines.node (1b746e6b5a26335cf01c314074dcf7e291c260a0)

Commits

• 7f28a71 Release 12.0.2
• 65dda97 Stage diving is never a good idea
• b0143b8 Release 12.0.1
• 39959f4 Enable npm staged publishing
• e5d723f Narrow engines.node a bit
• 6d5e466 Update dependencies
• 1df408d Migrate to pnpm
• ee8b92e Release 12.0.0
• 41b3201 Upgrade dependencies
• 9fa21de Document stable prerelease promotion (resolve #152)
• Additional commits viewable in compare view

Updates release-it from 18.1.2 to 21.1.2

Release notes

Sourced from release-it's releases.

Release 21.1.2

• Update pnpm to 11.28.10 (3112b7a569de3c807e72fb0fd5465d6a577cfe4e)
• Map ssh.github.com to github.com for release URLs (resolve #1344) (ce51fd14290e8ef95006ae198ffc012cb43d8808)
• Update undici to 7.30.1 (0afee0b363f02ece2dbe1d747ca91edb5f14695a)
• Show the GitLab error message for failed requests (8b21da45c9d901565359a7f9c523956bc907ac15)
• Pass branch, tag and remote names to git as arguments (resolve #1341) (dd963d54d767ec4cac0c95f088600b9cff5d23f5)

Release 21.1.1

• docs: add release-it-git-cliff to plugins list (#1334) (bf2a3d8625f1ffb68cab1a55564761493febf381) - thanks @​adamhl8!
• Update undici to 7.29.1 (resolve #1335) (37898f1b44d88555ce25a573ea3ce379279a8279)
• Update more dependencies (7bd73af08fe1a1b3ba0a436f888f102263fcf2c9)
• Migrate verkit import (5336543483af172853668d3b67def6eafc6a652a)

Release 21.1.0

• chore(deps): replace semver with verkit (#1329) (033dca25dcca548d889b13e0ae1b7d063b0dca92) - thanks @​gameroman!
• fix(schema): remove fragment from schema $id values (#1332) (6e4022238a2255d86842321d6cc8f5b72fc39194) - thanks @​DanMat!
• Fix version increments and coercion after verkit migration (eab4b8cef600379dc0211bebb9c8de0df1ce9bdb)
• Log in to npm automatically before interactive publishing (resolve #1333) (76e409fd271509706307e31b1658389afb678d89)
• Support proxy environment variables in GitLab (resolve #1131) (#1331) (afb5565a09dfd38a02d5dbcc6c6317d824ffcccd) - thanks @​mrpmohiburrahman!
• Update dependencies (9ca5d328012cd740094841069d295df8152ad695)
• Narrow engines.node (98dcf1910981e13236d7ac02106a134bec71387d)
• Fix version coercion for verkit 0.4 (7ee54c2d7528244a032da948f478381d898ee52a)

Release 21.0.3

• Fix npm staging approval URL and prompt (9f64e098aa04aac44fe9484add1f1f2119fa294c)

Release 21.0.2

• Prevent duplicate comments on resolved issues and PRs (#1324) (7ca61cccd16ad56742ee0cb694c946353b66c117) - thanks @​krisu-pl!
• Migrate to pnpm + update deps (6c211f087f465af8942060812ec4ee662419da9f)

Release 21.0.1

• Fix regression and support --no-hooks to skip all hooks (a8888b45b1d9db40a8f8ea5ad625b15b53d78925)

Release 21.0.0

• fix(ci): do not run integration on forks (#1315) (1e90d9f28f08a847029ed58f8ac211028d4203ca) - thanks @​trueberryless!
• Pin GitHub Actions to immutable commits (#1316) (38355d8068ac5c0818bc183ddb39db643aeab0c3)
• Fix npm publish workspace config resolution (#1312) (3bf251f5ab4c3665397aef8a7a4db6a21e02a98f) - thanks @​cyphercodes!
• Add gitlab.repoId option (#1224) (e4e9d0e35cbd99492c8b1a7b48e5a695951af7a2) - thanks @​microHoffman!
• Exit successfully when no release version is available (56c70c3f1436101a9284c535bed233081af85960)
• Support numeric GitLab repository IDs (0332c4ac4ecb8b714c8971b3953c972f59fe1f30)
• Parse CLI arguments strictly (resolve #1196) (caf77c928bfefa48339e8246261ffb8e41d70a4c)
• fix: shell caching and working tree detection (#1317) (8d1f7522ffc6afb445a00ab03357fdc7554b48ac) - thanks @​Mopsgamer!
• Remove dependabot workflow (e7e04ef3fb6151324ffde438a278539fbbc24eec)
• Fix configured GitHub proxy routing (1ed9cddf5d18d2c4107500081254cc7af22eff42)
• Upgrade dependencies and require Node 22 (c055e7fa5b2dcaf5078d4a5c337140a5bea0ac7e)
• Fix npm custom registry argument handling (resolve #1318) (98c45c4503e1d8bad0b7c38d99f6fda380c3681e)
• Pin GitLab releases to the current commit (resolve #1216) (70ab5769852bc5a3fafe4ac193f28bd247fa067e)
• Refresh GitHub Actions and package preview runtime (5c5513966ba2d4f1133c9b33c33850470c12a934)
• Document v21 runtime requirements (daab8460c0f0ed7f8a97c0ef806ef506d59f7268)
• Simplify git-cliff recipe (resolve #1195) (52c89a7965d3aff0a5d2474903fc902dbde59cf5)

... (truncated)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: [https://github.com/release-it/release-it/releases][1]

v21 (2026-07-25)

• Removed support for Node.js v20 and raised the Node.js v22 minimum to v22.21.0.
• CLI argument parsing is now strict. Unknown options, invalid booleans, and extra positional arguments are rejected.
• GitLab server certificates are verified by default. Configure private CA or explicitly set gitlab.secure to false.

v20 (2026-03-24)

• Upgraded undici from v6 to v7 to resolve security vulnerabilities.
• Upgraded proxy-agent from v6 to v7 to fix DEP0169 (url.parse() deprecation).
• Migrated from deprecated inquirer to @inquirer/prompts.
• Bumped engines.node to minimum Node.js v20.19.0 (was v20.12.0).

v19 (2025-04-18)

• No breaking changes (dependency party)

v18 (2025-01-06)

• Removed support for Node.js v18.

v17 (2023-11-11)

• Removed support for Node.js v16.

v16 (2023-07-05)

• Removed support for Node.js v14.

v15 (2022-04-30)

• Removed support for Node.js v10 and v12.
• Removed support for GitLab v12.4 and lower.
• Removed anonymous metrics (and the option to disable it).
• Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

• Removed global property from plugins. Use this.config[key] instead.
• Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

... (truncated)

Commits

• 10bce41 Release 21.1.2
• dd963d5 Pass branch, tag and remote names to git as arguments (resolve #1341)
• 8b21da4 Show the GitLab error message for failed requests
• 0afee0b Update undici to 7.30.1
• ce51fd1 Map ssh.github.com to github.com for release URLs (resolve #1344)
• 3112b7a Update pnpm to 11.28.10
• 4548399 Release 21.1.1
• 5336543 Migrate verkit import
• 7bd73af Update more dependencies
• 37898f1 Update undici to 7.29.1 (resolve #1335)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud