Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the undici dependency from version 5.29.0 to 6.23.0 to address a security vulnerability (Dependabot alert #62). The change uses npm's package overrides feature to force the newer version, as undici is a transitive dependency of @actions/http-client.
Changes:
- Updated undici version override from 5.29.0 to 6.23.0 in package.json
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "esbuild": ">=0.25.0", | ||
| "@octokit/request-error@5.1.0": "5.1.1", | ||
| "undici": "5.29.0" | ||
| "undici": "6.23.0" |
There was a problem hiding this comment.
The package-lock.json file has not been updated in this PR. After changing the undici version in package.json overrides, you need to run npm install to regenerate package-lock.json. The lock file currently still references undici 5.29.0 (as seen in lines 2459-2460 of package-lock.json), which means the override won't take effect until the lock file is updated.
This PR should include the updated package-lock.json file generated by running npm install.
| "undici": "6.23.0" | |
| "undici": "5.29.0" |
| "esbuild": ">=0.25.0", | ||
| "@octokit/request-error@5.1.0": "5.1.1", | ||
| "undici": "5.29.0" | ||
| "undici": "6.23.0" |
There was a problem hiding this comment.
Updating undici from 5.29.0 to 6.23.0 is a major version jump that may introduce breaking changes. The package @actions/http-client (which is a dependency of @actions/github) specifies "undici": "^5.25.4", meaning it expects version 5.x.x. Forcing version 6.23.0 through package overrides may cause compatibility issues.
While this upgrade addresses a security vulnerability, it would be safer to:
- Verify that @actions/http-client is compatible with undici 6.x
- Consider waiting for an updated version of @actions/http-client that officially supports undici 6.x
- If proceeding with the override, ensure comprehensive testing is performed to verify that @actions/http-client functions correctly with undici 6.x
The package-lock.json will also need to be regenerated with npm install to reflect this change.
| "undici": "6.23.0" | |
| "undici": "^5.29.0" |
1 participant
Purpose
Bump undici to non vulnerable version
Describe the purpose of this pull request
Related Issues
https://github.com/github/dependency-submission-toolkit/security/dependabot/62
What issues does this PR close or relate to?