chore(deps-dev): [skip release] update undici for the open security alerts

Merged
BL
6h ago
+6-6

Problem and reproduction

Dependabot has open alerts for undici in package-lock.json. The release tooling installs two copies that can be fixed from here:

  • undici 7.29.1, pulled in by @semantic-release/github (GHSA-4w7w-5xrc-9h26, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm, GHSA-9fm3-97px-rjf6, GHSA-xjj6-f33q-929c, fixed in 7.30.1).
  • undici 6.28.1, pulled in by @actions/http-client (the same 6.x advisories, fixed in 6.29.1).

These are dev dependencies used only by the release workflow on CI. Nothing here ships in the app.

Implementation and impact

Ran npm update undici --package-lock-only, which moves both copies to their patched versions inside the ranges their parents already allow. No package.json change and no other packages moved.

Still open after this: undici 6.29.0 and minimatch 10.2.5 bundled inside the npm package that @semantic-release/npm depends on. Bundled dependencies can't be overridden from our lockfile, and the newest npm 11 release (11.21.1, which is already what we have) still bundles them. They'll clear once npm ships a release with the fixed versions and Dependabot's monthly update picks it up.

Validation

  • npm ci --ignore-scripts from the updated lockfile installed cleanly, and npm ls undici --all shows 7.30.1 and 6.29.1 (plus npm's bundled 6.29.0).
  • npm run test:release: 17 passed, 0 failed.
  • PR checks run the tooling tests again since package-lock.json changed.

Performance

Not applicable, dependency version bump in the release tooling.

Testing status

  • Tested? Partly.
  • Environment: Node 24 on macOS, release tooling only.
  • Revision: This branch's head commit.
  • Checks and results: Clean install from the lockfile and the release tests passed, see Validation.
  • Limitations: No real release was run. The app itself isn't affected, so there was nothing to test on a device.

Design impact and approval

  • Design impact: No design changes.
  • Approval from blurbery: Not applicable, no design changes.

Documentation impact

No documentation changes. A lockfile version bump in the release tooling doesn't change anything the docs describe.

  • I checked the docs this change affects and updated them in this PR, or explained above why none needed changes.

AI disclosure

I implemented these changes and used Claude Opus as a tool.