chore(deps): Bump undici from 6.25.0 to 6.27.0 by dependabot[bot] · Pull Request #686 · docker/metadata-action

dependabot · 2026-06-23T20:11:27Z

Bumps undici from 6.25.0 to 6.27.0.

Release notes

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.
Action required: Upgrade to undici 6.27.0 or later.
npm install undici@^6.27.0
Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

551138c Bumped v6.27.0 (#5431)
b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
25efa44 fix(cookies): preserve values and parse SameSite strictly
f4c31d6 fix: guard idle socket validation to skip fresh sockets (#5400)
768beac Bumped v6.26.0 (#5323)
7917b25 fix: validate EOF for chunked h1 responses (#5308)
See full diff in compare view

crazy-max · 2026-07-02T07:55:09Z

@dependabot recreate

crazy-max · 2026-07-02T08:00:49Z

@dependabot rebase

Bumps [undici](https://github.com/nodejs/undici) from 6.25.0 to 6.27.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.25.0...v6.27.0) --- updated-dependencies: - dependency-name: undici dependency-version: 6.27.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…to v6 (#8) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/docker/metadata-action](https://github.com/docker/metadata-action) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>docker/metadata-action (https://github.com/docker/metadata-action)</summary> ### [`v6.2.0`](https://github.com/docker/metadata-action/releases/tag/v6.2.0) [Compare Source](docker/metadata-action@v6.1.0...v6.2.0) - Preserve names in esbuild bundle by [@crazy-max](https://github.com/crazy-max) in [#689](docker/metadata-action#689) - Bump [@actions/core](https://github.com/actions/core) from 3.0.0 to 3.0.1 in [#663](docker/metadata-action#663) - Bump [@actions/github](https://github.com/actions/github) from 9.0.0 to 9.1.1 in [#666](docker/metadata-action#666) - Bump [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#672](docker/metadata-action#672) [#696](docker/metadata-action#696) - Bump [@sigstore/core](https://github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#690](docker/metadata-action#690) - Bump [@sigstore/verify](https://github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#693](docker/metadata-action#693) - Bump csv-parse from 6.2.1 to 7.0.0 in [#683](docker/metadata-action#683) - Bump js-yaml from 4.1.1 to 4.3.0 in [#688](docker/metadata-action#688) - Bump moment-timezone from 0.6.1 to 0.6.2 in [#664](docker/metadata-action#664) - Bump semver from 7.7.4 to 7.8.5 in [#665](docker/metadata-action#665) [#695](docker/metadata-action#695) - Bump sigstore from 4.1.0 to 4.1.1 in [#694](docker/metadata-action#694) - Bump tmp from 0.2.5 to 0.2.7 in [#673](docker/metadata-action#673) - Bump undici from 6.25.0 to 6.27.0 in [#686](docker/metadata-action#686) - Bump vite from 7.3.2 to 7.3.6 in [#685](docker/metadata-action#685) **Full Changelog**: <docker/metadata-action@v6.1.0...v6.2.0> ### [`v6.1.0`](https://github.com/docker/metadata-action/releases/tag/v6.1.0) [Compare Source](docker/metadata-action@v6.0.0...v6.1.0) - Bump [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.79.0 to 0.90.0 in [#613](docker/metadata-action#613) - Bump brace-expansion from 1.1.12 to 5.0.6 in [#658](docker/metadata-action#658) [#630](docker/metadata-action#630) - Bump csv-parse from 6.1.0 to 6.2.1 in [#617](docker/metadata-action#617) - Bump fast-xml-parser from 5.4.2 to 5.8.0 in [#620](docker/metadata-action#620) - Bump flatted from 3.3.3 to 3.4.2 in [#623](docker/metadata-action#623) - Bump glob from 10.3.15 to 10.5.0 in [#621](docker/metadata-action#621) - Bump handlebars from 4.7.8 to 4.7.9 in [#629](docker/metadata-action#629) - Bump lodash from 4.17.23 to 4.18.1 in [#639](docker/metadata-action#639) - Bump moment-timezone from 0.6.0 to 0.6.1 in [#619](docker/metadata-action#619) - Bump picomatch from 4.0.3 to 4.0.4 in [#626](docker/metadata-action#626) - Bump postcss from 8.5.6 to 8.5.10 in [#649](docker/metadata-action#649) - Bump tar from 6.2.1 to 7.5.15 in [#657](docker/metadata-action#657) - Bump undici from 6.23.0 to 6.25.0 in [#614](docker/metadata-action#614) - Bump vite from 7.3.1 to 7.3.2 in [#637](docker/metadata-action#637) **Full Changelog**: <docker/metadata-action@v6.0.0...v6.1.0> ### [`v6.0.0`](https://github.com/docker/metadata-action/releases/tag/v6.0.0) [Compare Source](docker/metadata-action@v5.10.0...v6.0.0) - Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@crazy-max](https://github.com/crazy-max) in [#605](docker/metadata-action#605) - List inputs now preserve `#` inside values while still supporting full-line `#` comments by [@crazy-max](https://github.com/crazy-max) in [#607](docker/metadata-action#607) - Switch to ESM and update config/test wiring by [@crazy-max](https://github.com/crazy-max) in [#602](docker/metadata-action#602) - Bump lodash from 4.17.21 to 4.17.23 in [#588](docker/metadata-action#588) - Bump [@actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#599](docker/metadata-action#599) - Bump [@actions/github](https://github.com/actions/github) from 6.0.1 to 9.0.0 in [#597](docker/metadata-action#597) - Bump [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.68.0 to 0.79.0 in [#604](docker/metadata-action#604) - Bump [@isaacs/brace-expansion](https://github.com/isaacs/brace-expansion) from 5.0.0 to 5.0.1 in [#600](docker/metadata-action#600) - Bump semver from 7.7.3 to 7.7.4 in [#603](docker/metadata-action#603) **Full Changelog**: <docker/metadata-action@v5.10.0...v6.0.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.homelab.devncode.it/marco/vinted-search-mcp/pulls/8

dependabot Bot added bot dependencies labels Jun 23, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.27.0 branch from 72d537f to 935ae1e Compare July 2, 2026 07:56

dependabot Bot force-pushed the dependabot/npm_and_yarn/undici-6.27.0 branch from e14bd0b to 2538bcf Compare July 2, 2026 08:02

[dependabot skip] chore: update generated content

c6f28b3

crazy-max approved these changes Jul 2, 2026

View reviewed changes

crazy-max merged commit 829d9de into master Jul 2, 2026
41 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/undici-6.27.0 branch July 2, 2026 08:04

coderabbitai Bot mentioned this pull request Sep 16, 2026

chore: updating actions pgvillage-tools/pgav#1

Merged

Navigation Menu

chore(deps): Bump undici from 6.25.0 to 6.27.0 - #686

chore(deps): Bump undici from 6.25.0 to 6.27.0#686
crazy-max merged 2 commits into
masterfrom
dependabot/npm_and_yarn/undici-6.27.0

dependabot Bot commented on behalf of github Jun 23, 2026 •

edited

Loading

Uh oh!

crazy-max commented Jul 2, 2026

Uh oh!

crazy-max commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	`b7f252e7`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	`25efa447`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	`25efa447`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	`f4c31d60`

Conversation

dependabot Bot commented on behalf of github Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.27.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

Uh oh!

crazy-max commented Jul 2, 2026

Uh oh!

crazy-max commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jun 23, 2026 •

edited

Loading