Bump undici override to the latest 7.x version - #4268
mbg merged 3 commits into
Conversation
Sorry, something went wrong.
| "license": "MIT", | ||
| "engines": { | ||
| "node": ">=18.17" | ||
| "node": ">=20.18.1" |
There was a problem hiding this comment.
Did you check that the >=20.18.1 Node version aligns with the runner versions we support (those shipped with the GHES versions we support)?
Sorry, something went wrong.
There was a problem hiding this comment.
The oldest GHES we support is now 3.19 which ships with 20.19.4 so I think this is fine. (For the record, 3.18 before that shipped with 20.19.1 which would also have been fine).
Sorry, something went wrong.
There was a problem hiding this comment.
Who keeps bumping him out it seems like he should of been bigger than a 3.19
Sorry, something went wrong.
There was a problem hiding this comment.
🔵 Needs a closer look
The global override forces Undici 7 onto consumers declaring 5.x or 6.x requirements, and compatibility remains unverified.
No open issues 🎉
1 file not reviewed- lib/entry-points.js: Excluded by your content exclusion settings
Updates the CodeQL Action’s Undici dependency and global override, while shifting future Undici updates to manual maintenance.
Changes:
- Upgrades Undici from 6.28.0 to 7.30.1 and updates the lockfile.
- Adds a Dependabot ignore rule for Undici versions >=7.30.1, with comments explaining manual updates.
| File | Description |
|---|---|
| package.json | Updates the direct Undici dependency and global override. |
| package-lock.json | Records Undici 7.30.1 and its higher minimum Node.js requirement. |
| .github/dependabot.yml | Adds and documents the Undici update exclusion. |
Review effort: Max
Sorry, something went wrong.
Updates undici to a newer version, including the override. We have at least one dependency that is lagging behind with a 5.x requirement on undici that we can't shed.