Skip to content

[HIGH] Bump undici to 7.29.1 - #58346

Open
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-undici
Open

[HIGH] Bump undici to 7.29.1#58346
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-undici

Conversation

@OskarEichler

Copy link
Copy Markdown
Contributor

Summary

  • update @electron/get’s undici 7.x lockfile entry from 7.25.0 to 7.29.1
  • leave the unaffected React Native dev-middleware 6.x line unchanged
  • remain within the existing compatible 7.x range

Security impact

undici 7.25.0 is affected by multiple advisories fixed in 7.28.0/7.29.0, including cross-user cache disclosure, SOCKS5 cross-origin routing and TLS validation bypass, WebSocket denial of service, response desynchronization, and header/cookie injection (GHSA-4cwx-7wf7-3272, GHSA-hm92-r4w5-c3mj, GHSA-vmh5-mc38-953g, GHSA-vxpw-j846-p89q, GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, and related 7.x advisories).

Verification

  • yarn install --frozen-lockfile --ignore-scripts
  • yarn why undici confirmed the affected line at 7.29.1
  • yarn audit no longer reports undici advisories
  • yarn build
  • debugger-shell: 4 suites, 9 tests, 4 snapshots passed
  • Jest retained a pre-existing open handle after reporting success and was stopped after completion
  • git diff --check

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 4, 2026
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

Warning

Missing Test Plan

Please add a "## Test Plan" section to your PR description. A Test Plan lets us know how these changes were tested.

Caution

Missing Changelog

Please add a Changelog to your PR description. See Changelog format

@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant