Update dependency undici to v8 by renovate[bot] · Pull Request #252 · digicatapult/sqnc-attachment-api

renovate · 2026-04-05T09:15:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	`^7.25.0` → `^8.3.0`

Release Notes

nodejs/undici (undici)

`v8.3.0`

Compare Source

What's Changed

fix: preserve pool capacity after removing stale client by @trivikr in #5151
build(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @dependabot[bot] in #5157
build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.1 by @dependabot[bot] in #5162
build(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by @dependabot[bot] in #5156
chore(http2): collapse duplicate request stream setup by @trivikr in #5140
perf(client): cache HTTP/2 authority by @trivikr in #5141
build(deps-dev): bump borp from 0.20.2 to 1.0.0 by @dependabot[bot] in #4819
types: add TOpaque to client connect options by @samuel871211 in #4928
build(deps): bump tinybench from 5.1.0 to 6.0.1 in /benchmarks by @dependabot[bot] in #4688
build(deps): bump codecov/codecov-action from 5.5.1 to 6.0.0 by @dependabot[bot] in #4950
build(deps): bump actions/dependency-review-action from 4.8.1 to 4.9.0 by @dependabot[bot] in #4951
test(fetch): add userinfo coverage for issue-4897 URLs by @mcollina in #4901
perf: avoid duplicate pool dispatcher selection on backpressure by @trivikr in #5149
build(deps): bump actions/setup-node from 6.2.0 to 6.4.0 by @dependabot[bot] in #5163
build(deps): bump step-security/harden-runner from 2.14.1 to 2.19.1 by @dependabot[bot] in #5160
build(deps): bump cronometro from 5.3.0 to 6.0.3 in /benchmarks by @dependabot[bot] in #4687
build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in #5161
build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in #4853
build(deps): bump hendrikmuhs/ccache-action from 1.2.22 to 1.2.23 by @dependabot[bot] in #5158
build(deps): bump fastify/github-action-merge-dependabot from 3.11.2 to 3.12.0 by @dependabot[bot] in #5159
build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @dependabot[bot] in #4854
build(deps): bump uWebSockets.js from v20.64.0 to v20.66.0 in /benchmarks by @dependabot[bot] in #5130
docs: mention install() also installs WebSocket globals by @mcollina in #5174
types: stop interfering with @types/node by @Renegade334 in #5173
fix: align h2 empty body content-length methods with h1 by @trivikr in #5172
build(deps-dev): bump fast-check from 4.6.0 to 4.7.0 by @dependabot[bot] in #5192
build(deps-dev): bump typescript from 6.0.2 to 6.0.3 by @dependabot[bot] in #5191
test: move cleanup from finally to after hooks by @trivikr in #5194
test: resolve flaky timeout in issue-3356 by @trivikr in #5188
SnapshotAgent: Add normalizeBody and normalizeQuery by @GeoffreyBooth in #5121
fix(socks5): use configured connector in Socks5ProxyAgent by @trivikr in #5168
perf(http2): avoid isArray checks for common headers by @trivikr in #5170
fix(test): make deduplicate body-streaming test non-flaky by @mcollina in #5196
test(retry): add regression test for RetryAgent + HTTP/2 stream timeout (#5137) by @mcollina in #5176
fix(socks5): preserve dispatch backpressure return value by @trivikr in #5166
perf(http2): end zero-length request bodies with headers by @trivikr in #5169
fix(test): make issue-2898-comment.js assertion robust against flakiness by @mcollina in #5208
test: disable timeouts in h2 high concurrency regression by @trivikr in #5205
test: deflake stream compat coverage by @mcollina in #5209
fix(dispatcher): remove unreachable assert in writeBlob by @SAY-5 in #5231
fix: clean up benchmark resources before worker exit by @trivikr in #5225
test: avoid per-chunk assertions in diagnostics get by @trivikr in #5224
test: capture cache test worker stderr and preserve failures by @trivikr in #5206
chore: gitignore benchmarks/package-lock.json by @trivikr in #5228
perf(proxy-agent): avoid extra header allocations in auth guard by @trivikr in #5164
test(wpt): retry WPT server startup on port conflicts or timeout by @trivikr in #5215
test: make websocket diagnostics ping-pong ordering deterministic by @trivikr in #5222
test(websocket): fix flaky send test by @mcollina in #5232
fix: prevent node-fetch test server close from hanging on Windows by @mcollina in #5246
test: wait for cache test server to listen by @trivikr in #5242
fix: accept unknown-size Content-Range values by @trivikr in #5120
test: avoid global dispatcher state in mock client tests by @trivikr in #5258
test: fix flaky permessage-deflate limit timeout by @mcollina in #5229
test: drain request bodies in request tests by @trivikr in #5247
test: reduce retry-after invalid date timing flake by @trivikr in #5250
test: drive request timeout ticks after connect by @trivikr in #5251
test: only fail max-listener checks on max-listener warnings by @trivikr in #5253
test: avoid double-closing server in client-request test by @trivikr in #5255
fix(retry-handler): validate response body length against Content-Range by @mcollina in #4975
test: wait for inflight-and-close body cleanup by @trivikr in #5261
fix(test): make http2-pseudo-headers test order-independent by @mcollina in #5234
fix: preserve fetch multipart body on MockAgent fallback by @mcollina in #5269
ci: build Node FFI fixtures for shared-builtin tests by @trivikr in #5275
test: deflake issue-5137 stream count assertion by @trivikr in #5243
fix: replace finished() with writable lifecycle tracking by @trivikr in #5001
perf(client-h2): reuse request stream handlers by @trivikr in #5280
fix: prevent pipeline body replay on redirect by @mcollina in #5274
fix(types): remove throwOnError from Dispatcher.RequestOptions by @Zelys-DFKH in #5279
fix: validate EOF for chunked h1 responses by @mcollina in #5273
test: deflake parser-issues teardown by @mcollina in #5278
test: make http2-alpn control requests explicit by @trivikr in #5252
test: include cache-test worker metadata on failure by @trivikr in #5276
test: include after in parser-issues by @trivikr in #5284
cache formdata boundary by @KhafraDev in #5292
build(deps-dev): bump fast-check from 4.7.0 to 4.8.0 by @dependabot[bot] in #5298
test: retry crashed cache-test workers once by @trivikr in #5294
Add Node 26 to the matrix by @mcollina in #5271
perf(client-h2): reuse request upgrade stream handlers by @trivikr in #5293
build(deps-dev): bump jest from 30.3.0 to 30.4.2 by @dependabot[bot] in #5297
build(deps): bump uWebSockets.js from v20.66.0 to v20.67.0 in /benchmarks by @dependabot[bot] in #5299
test: fix flaky http2-dispatcher WebSocket upgrade tests by @mcollina in #5304

New Contributors

@Zelys-DFKH made their first contribution in #5279

Full Changelog: nodejs/undici@v8.2.0...v8.3.0

`v8.2.0`

Compare Source

What's Changed

chore: use native addAbortListener by @trivikr in #5021
fix: fix the logic for the UNDICI_NO_WASM_SIMD environment variable by @ShenHongFei in #5026
fix(http2): send body for non-expectsPayload methods with content by @mcollina in #5030
fix(fetch): correct 'navigator' typo to 'navigate' in fetchFinale by @deepview-autofix in #5044
fix(webidl): correct signed integer bounds in ConvertToInt by @deepview-autofix in #5038
fix(fetch): use || for CRLF check in multipart formdata-parser by @deepview-autofix in #5049
fix(websocket): correct argument order in WebSocketStream UTF-8 failure by @deepview-autofix in #5050
fix(pool): propagate useH2c to connector when connections > 1 by @SAY-5 in #5031
fix(cache): return immutable staleAt in milliseconds by @deepview-autofix in #5048
fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing by @deepview-autofix in #5041
fix(cache): evict oldest entries first in SqliteCacheStore prune by @deepview-autofix in #5039
fix(socks5): correctly expand IPv6 '::' compressed notation by @deepview-autofix in #5046
Remove unused func and unnecessary shim by @tsctx in #5053
fix: reject malformed content-length request headers by @trivikr in #5060
fix(request): reject NaN highWaterMark during option validation by @trivikr in #5062
docs: fix broken links in docsify sidebar by @maruthang in #5065
fix(fetch): prefer filename* over filename in multipart form-data by @maruthang in #5068
fix(http2): reject websocket upgrades on non-200 responses by @trivikr in #5072
feat: support username-only proxy authentication in ProxyAgent by @rossilor95 in #4935
build(deps): bump uWebSockets.js from v20.58.0 to v20.64.0 in /benchmarks by @dependabot[bot] in #5083
fix(client-h2): stop double-decrementing kOpenStreams on stream timeout by @SAY-5 in #5076
fix(http2): reject upgrade streams closed before response headers by @trivikr in #5069
fix(http2): allow GET and HEAD request bodies over h2 by @trivikr in #5058
fix(cache): include query in cache key when opts.path is undefined by @maruthang in #5081
fix: avoid premature cleanup of dispatcher in Agent by @bienzaaron in #5034
fix(http2): record ping failures on the socket by @trivikr in #5075
add undici security policy by @mcollina in #5056
fix(mock): make filterCalls AND operator actually intersect results by @deepview-autofix in #5045
fix(socks5): enforce authenticated state before CONNECT by @trivikr in #5097
fix(cache): skip expired sqlite vary entries during lookup by @trivikr in #5095
fix: enforce maxCachedSessions in TLS session cache by @trivikr in #5102
fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly by @trivikr in #5099
fix: handle invalid HTTP/2 connection headers (#4356) by @mcollina in #5101
fix(interceptor): add throwOnMaxRedirect to types and interceptor opts by @maruthang in #5066
fix(websocket): avoid double-closing canceled stream readers by @colinaaa in #5105
fix(cache): persist vary when updating sqlite cache entries by @trivikr in #5109
refactor(h1): track HEAD keep-alive override as boolean by @trivikr in #5110
client: cache llhttp wasm buffer view by @trivikr in #5115
deps: update llhttp to 9.3.1 by @mcollina in #5113
fix(http2): preserve accepted streams after GOAWAY by @trivikr in #5090
fix: reuse parser WeakRef for timeout callbacks by @trivikr in #5125
fix: stop buffering data after SOCKS5 connect by @trivikr in #5118
perf(http2): avoid response header reserialization by @trivikr in #5085
fix(cache): enforce sqlite maxCount after insert by @trivikr in #5112
perf: reduce EventSourceStream parser allocations by @trivikr in #5032
types(dispatcher): use OutgoingHttpHeaders for request headers by @maruthang in #5067
cleanup: delete redundant .gitkeep file by @shivarm in #5133
fix(http2): respect peer max concurrent streams by @trivikr in #5135
test(http2): ensure websocket upgrade resumes queued requests by @trivikr in #5132
test(mock): cover SnapshotAgent excludeUrls playback by @maruthang in #5080
perf(client): parse h1 content-length statelessly by @trivikr in #5124
perf(http2): reduce writeH2 per-request callback allocations by @trivikr in #5138
chore(deps): add lockfile by @aduh95 in #5139
perf: use byteLength property for binary body chunks by @trivikr in #5126
fix(cache): allow streamed entries at maxEntrySize limit by @trivikr in #5129
perf(http2): avoid cloning headers when removing status by @trivikr in #5127
fix: validate H2CClient maxConcurrentStreams option by @trivikr in #5143
perf: avoid redundant scans in BalancedPool dispatcher selection by @trivikr in #5146
fix: replace stale pool clients under connection limit by @trivikr in #5145

New Contributors

@deepview-autofix made their first contribution in #5044
@SAY-5 made their first contribution in #5031
@maruthang made their first contribution in #5065
@bienzaaron made their first contribution in #5034

Full Changelog: nodejs/undici@v8.1.0...v8.2.0

`v8.1.0`

Compare Source

What's Changed

feat: add configurable maxPayloadSize for WebSocket by @mcollina in #4955

Full Changelog: nodejs/undici@v8.0.3...v8.1.0

`v8.0.3`

Compare Source

What's Changed

docs: add an Undici 7 to 8 migration guide by @mcollina in #4963
chore: switch deferred promise with Promise.withResolvers() by @trivikr in #4972
chore: remove zstd and markAsUncloneable feature probes by @trivikr in #4968
test: remove obsolete nodeMajor/nodeMinor util exports by @trivikr in #4976
chore: use Promise.withResolvers in SOCKS5 proxy agent by @trivikr in #4978
build(deps-dev): bump esbuild from 0.27.7 to 0.28.0 by @dependabot[bot] in #4985
build(deps-dev): bump proxy from 2.2.0 to 4.0.0 by @dependabot[bot] in #4987
build(deps): bump got from 14.6.6 to 15.0.0 in /benchmarks by @dependabot[bot] in #4988
chore: use Object.hasOwn for iterator checks by @trivikr in #4979
doc: Update dump({ limit: Integer }) default value by @samuel871211 in #4981
fix: avoid 401 failures for stream-backed request bodies by @mcollina in #4941
test: remove unsupported Node version checks from fetch tests by @trivikr in #4977
types: remove legacy AbortSignal alias now provided by @types/node by @trivikr in #4995
fix: remove stale constructor interceptors from types and pool options by @trivikr in #4994
doc: update incorrect description of dump.maxSize by @samuel871211 in #4982
ci: enable coverage for node.js 25 by @shivarm in #4980
refactor: reuse wrapRequestBody in RedirectHandler by @trivikr in #4992
fix: preserve connect option in H2CClient by @trivikr in #5000
types: document Client and H2CClient option declarations by @trivikr in #4998
fix: native WebSocket over H2 server after undici import by @mcollina in #4990
chore(test): issue 3969 by @rozzilla in #5005
fix(1270): throw descriptive error when opts.dispatcher–passed instance methods by @rozzilla in #5007
docs: Change the default value of allowH2 in JSDoc by @7hokerz in #5009
chore(test): cover issue 5014 by @rozzilla in #5015
fix: prevent cache dedup key collision via unescaped delimiters by @eddieran in #5013
fix(proxy agent): respect connectTimeout by @rozzilla in #5011

New Contributors

@7hokerz made their first contribution in #5009
@eddieran made their first contribution in #5013

Full Changelog: nodejs/undici@v8.0.2...v8.0.3

`v8.0.2`

Compare Source

What's Changed

fix(websocket): fallback to HTTP/1.1 when H2 CONNECT is unavailable by @mcollina in #4966
fix: release ref by @mcollina in #4965
ci: reenable shared builtin CI tests by @mcollina in #4967

Full Changelog: nodejs/undici@v8.0.1...v8.0.2

`v8.0.1`

Compare Source

What's Changed

Remove legacy handler wrappers by @mcollina in #4786
fix: isolate global dispatcher v2 and add Dispatcher1Wrapper bridge by @mcollina in #4827
fix: preserve request statusText and update h2 dispatch tests by @mcollina in #4830
feat!: enable h2 by default by @metcoder95 in #4828
fix(cache): preserve short-lived entries for revalidation by @mcollina in #4934
fix: remove support for non-real Blob objects by @mcollina in #4937
build(deps): bump github/codeql-action from 4.32.3 to 4.35.1 by @dependabot[bot] in #4953
Undici 8 by @mcollina in #4916
build(deps): bump hendrikmuhs/ccache-action from 1.2.19 to 1.2.22 by @dependabot[bot] in #4954
doc: remove duplicate listItem of RetryHandler.md & RetryHandler.md by @samuel871211 in #4948
fix: mirror the legacy global dispatcher for built-in fetch by @mcollina in #4962
fix(websocket/stream): only enqueue parsed messages in WebSocketStream by @colinaaa in #4959

New Contributors

@colinaaa made their first contribution in #4959

Full Changelog: nodejs/undici@v7.24.7...v8.0.1

`v8.0.0`

Compare Source

What's Changed

Remove legacy handler wrappers by @mcollina in #4786
fix: isolate global dispatcher v2 and add Dispatcher1Wrapper bridge by @mcollina in #4827
fix: preserve request statusText and update h2 dispatch tests by @mcollina in #4830
feat!: enable h2 by default by @metcoder95 in #4828
fix(cache): preserve short-lived entries for revalidation by @mcollina in #4934
fix: remove support for non-real Blob objects by @mcollina in #4937
build(deps): bump github/codeql-action from 4.32.3 to 4.35.1 by @dependabot[bot] in #4953
Undici 8 by @mcollina in #4916

Full Changelog: nodejs/undici@v7.24.7...v8.0.0

Configuration

📅 Schedule: (in timezone Europe/London)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added dependencies non-production npm labels Apr 5, 2026

renovate Bot requested a review from a team as a code owner April 5, 2026 09:15

renovate Bot added the non-production label Apr 5, 2026

renovate Bot force-pushed the renovate/undici-8.x branch 5 times, most recently from 5a412c9 to 172aacc Compare April 12, 2026 21:36

renovate Bot force-pushed the renovate/undici-8.x branch 6 times, most recently from 32027b1 to b9cc100 Compare April 20, 2026 23:10

renovate Bot force-pushed the renovate/undici-8.x branch 2 times, most recently from 26e1d7e to a9c0510 Compare April 30, 2026 21:50

renovate Bot force-pushed the renovate/undici-8.x branch 4 times, most recently from a51e358 to 4938a49 Compare May 8, 2026 22:06

renovate Bot force-pushed the renovate/undici-8.x branch 3 times, most recently from d76525e to a0f5960 Compare May 16, 2026 00:58

Update dependency undici to v8

3c42b38

renovate Bot force-pushed the renovate/undici-8.x branch from a0f5960 to 3c42b38 Compare May 17, 2026 17:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency undici to v8#252

Update dependency undici to v8#252
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/undici-8.x

renovate Bot commented Apr 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v8.3.0

What's Changed

New Contributors

v8.2.0

What's Changed

New Contributors

v8.1.0

What's Changed

v8.0.3

What's Changed

New Contributors

v8.0.2

What's Changed

v8.0.1

What's Changed

New Contributors

v8.0.0

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 5, 2026 •

edited

Loading

`v8.3.0`

`v8.2.0`

`v8.1.0`

`v8.0.3`

`v8.0.2`

`v8.0.1`

`v8.0.0`