meta: bump undici from 6.28.0 to 6.29.0

[dependabot]

Bumps undici from 6.28.0 to 6.29.0.

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in nodejs/undici#5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in nodejs/undici#5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in nodejs/undici#5834

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• 2a91fc8 fix(retry): settle exposed body on terminal failure (#5778)
• ffc8aa0 Bumped v6.28.1 (#5773)
• 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
• ce31bc8 fix(retry): validate resumed response framing
• 2af0faf fix(websocket): reject unrequested subprotocols
• 07c60d9 fix(websocket): destroy inflater after decompression limit
• bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api-docs-tooling	Ready	Preview	Oct 1, 2026 1:43pm UTC

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		5fb426f	2026-10-01T13:43:02.595Z	View logs ↗
Build: Failed ❌ View logs ↗		dd7c62d	2026-09-30T22:21:21.243Z	View logs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.64%. Comparing base (c5a3fe8) to head (5fb426f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1123   +/-   ##
=======================================
  Coverage   92.64%   92.64%           
=======================================
  Files         244      244           
  Lines       23113    23113           
  Branches     2263     2263           
=======================================
  Hits        21412    21412           
  Misses       1692     1692           
  Partials        9        9           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

api-links Generator

Output: 1 file differs

apilinks.json

Expected values to be strictly deep-equal:
+ actual - expected
... Skipped lines

  {
    'Agent.defaultMaxSockets': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L300',
    'Buffer.alloc': 'https://github.com/{repository}/blob/HEAD/lib/buffer.js#L454',
    'Buffer.allocUnsafe': 'https://github.com/{repository}/blob/HEAD/lib/buffer.js#L473',
    'Buffer.allocUnsafeSlow': 'https://github.com/{repository}/blob/HEAD/lib/buffer.js#L496',
...
    'agent.addRequest': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L365',
+   'agent.createConnection': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L304',
-   'agent.createConnection': 'https://github.com/{repository}/blob/HEAD/lib/https.js#L354',
    'agent.createSocket': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L446',
    'agent.destroy': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L679',
+   'agent.getName': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L334',
+   'agent.keepSocketAlive': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L635',
-   'agent.getName': 'https://github.com/{repository}/blob/HEAD/lib/https.js#L537',
-   'agent.keepSocketAlive': 'https://github.com/{repository}/blob/HEAD/lib/https.js#L506',
    'agent.removeSocket': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L574',
    'agent.reuseSocket': 'https://github.com/{repository}/blob/HEAD/lib/_http_agent.js#L671',
    'assert.assert': 'https://github.com/{repository}/blob/HEAD/lib/assert.js#L185',
    'asyncResource.asyncId': 'https://github.com/{repository}/blob/HEAD/lib/async_hooks.js#L243',
    'asyncResource.bind': 'https://github.com/{repository}/blob/HEAD/lib/async_hooks.js#L275',
...
    'server.address': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2776',
+   'server.close': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L697',
+   'server.closeAllConnections': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L707',
+   'server.closeIdleConnections': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L719',
-   'server.close': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2909',
-   'server.closeAllConnections': 'https://github.com/{repository}/blob/HEAD/lib/https.js#L125',
-   'server.closeIdleConnections': 'https://github.com/{repository}/blob/HEAD/lib/https.js#L127',
    'server.getConnections': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2871',
    'server.listen': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2566',
    'server.ref': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L3023',
+   'server.setTimeout': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L735',
-   'server.setTimeout': 'https://github.com/{repository}/blob/HEAD/lib/https.js#L129',
    'server.unref': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L3032',
+   'server[SymbolAsyncDispose]': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L703',
-   'server[SymbolAsyncDispose]': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2950',
    'server[SymbolAsyncIterator]': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2957',
    'server[kDeserialize]': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2487',
    'server[kTransferList]': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2459',
    'server[kTransfer]': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2464',
+   'server[undefined]': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L742',
-   'server[undefined]': 'https://github.com/{repository}/blob/HEAD/lib/net.js#L2987',
    'serverresponse._finish': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L262',
    'serverresponse._implicitHeader': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L419',
    'serverresponse.assignSocket': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L312',
    'serverresponse.detachSocket': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L323',
    'serverresponse.statusCode': 'https://github.com/{repository}/blob/HEAD/lib/_http_server.js#L285',

Performance estimate _{(single CI run)}

• Generation time: 26.6% faster (1.43 s → 1.05 s)
• Peak memory: 2.2% higher (423.48 MB → 432.64 MB)

json Generator

Performance estimate _{(single CI run)}

• Generation time: 7.0% faster (10.17 s → 9.46 s)
• Peak memory: 11.7% higher (1.45 GB → 1.62 GB)

legacy-html Generator

Performance estimate _{(single CI run)}

• Generation time: 49.9% slower (28.34 s → 42.48 s)
• Peak memory: 10.6% lower (2.45 GB → 2.19 GB)

legacy-json Generator

Performance estimate _{(single CI run)}

• Generation time: 0.2% slower (6.43 s → 6.44 s)
• Peak memory: 14.8% higher (1.58 GB → 1.82 GB)

llms-txt Generator

Performance estimate _{(single CI run)}

• Generation time: 4.5% slower (6.83 s → 7.14 s)
• Peak memory: 11.1% higher (1.56 GB → 1.74 GB)

orama-db Generator

Output size: 1 file changed · net +2.21 KB

File size details

File	Main	PR	Change
orama-db.json	9.55 MB	9.55 MB	+2.21 KB (+0.0%)

Performance estimate _{(single CI run)}

• Generation time: 24.5% slower (6.41 s → 7.98 s)
• Peak memory: 6.1% higher (1.63 GB → 1.73 GB)

web Generator

Performance estimate _{(single CI run)}

• Generation time: 15.4% faster (51.81 s → 43.83 s)
• Peak memory: 23.9% higher (3.25 GB → 4.02 GB)