tools: bump undici from 6.23.0 to 6.24.1 in /tools/doc by dependabot[bot] · Pull Request #62250 · nodejs/node

dependabot · 2026-03-14T10:43:38Z

Bumps undici from 6.23.0 to 6.24.1.

Release notes

v6.24.1

Full Changelog: nodejs/undici@v6.24.0...v6.24.1

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.

GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
CRLF injection via the upgrade option.

GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
Unbounded memory consumption in WebSocket permessage-deflate decompression.

Not applicable to v6

GHSA-phc3-fgpg-7m6h / CVE-2026-2581 affects >= 7.17.0 < 7.24.0 only.

Affected and patched ranges (v6)

CVE-2026-1525: affected < 6.24.0, patched 6.24.0

CVE-2026-1528: affected >= 6.0.0 < 6.24.0, patched 6.24.0

CVE-2026-1527: affected < 6.24.0, patched 6.24.0

CVE-2026-2229: affected < 6.24.0, patched 6.24.0

CVE-2026-1526: affected < 6.24.0, patched 6.24.0

References

GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories

NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525

NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528

NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527

NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229

NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

Commits

c0cf656 Bumped v6.24.1
f5a9f0c Fix v6 release workflow branch targeting
af2cb8f wqremove maxDecompressedMessageSize (#4891)
8873c94 Bumped v6.24.0
411bd01 test(websocket): use node:assert for Node 18 compatibility
844bf59 test: fix http2 lint regressions in backport
a444e4f test: stabilize h2 and tls-cert-leak under current test runner
dc032a1 fix: h2 CI (#4395)
4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
7df6442 fix: adapt websocket frame-limit handling for v6 parser
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.23.0...v6.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

nodejs-github-bot · 2026-03-14T10:43:44Z

Review requested:

@nodejs/web-infra

nodejs-github-bot · 2026-03-16T10:59:10Z

Landed in 35fed19

Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.23.0...v6.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #62250 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.23.0...v6.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: nodejs#62250 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.23.0...v6.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: #62250 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.23.0...v6.24.1) --- updated-dependencies: - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> PR-URL: nodejs#62250 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `25.8.2` → `25.9.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v25.9.0`](https://github.com/nodejs/node/releases/tag/v25.9.0): 2026-04-01, Version 25.9.0 (Current), @aduh95 [Compare Source](nodejs/node@v25.8.2...v25.9.0) ##### Notable Changes ##### Test runner module mocking improvements `MockModuleOptions.defaultExport` and `MockModuleOptions.namedExports` have been consolidated into a single option `MockModuleOptions.exports` to align with user expectations and other test runners. A `default` property on `MockModuleOptions.exports` represents the default export, and own enumerable properties are treated as named exports. An automated migration is available to update user code: <https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports> ```bash npx codemod @nodejs/mock-module-exports ``` Contributed by sangwook in [#61727](nodejs/node#61727). ##### Other notable changes - \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to `AsyncLocalStorage` (Stephen Belanger) [#61674](nodejs/node#61674) - \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add `--max-heap-size` option (tannal) [#58708](nodejs/node#58708) - \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add `TurboSHAKE` and `KangarooTwelve` Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) - \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188) - \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on `node:domain` (Matteo Collina) [#61227](nodejs/node#61227) - \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158) - \[[`e1f0d2a014`](nodejs/node@e1f0d2a014)] - **(SEMVER-MINOR)** **stream**: add stream/iter Implementation (James M Snell) [#62066](nodejs/node#62066) ##### Commits - \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to AsyncLocalStorage (Stephen Belanger) [#61674](nodejs/node#61674) - \[[`bfff8cb2ab`](nodejs/node@bfff8cb2ab)] - **(SEMVER-MINOR)** **benchmark**: add benchmarks for experimental stream/iter (James M Snell) [#62066](nodejs/node#62066) - \[[`c721d68502`](nodejs/node@c721d68502)] - **benchmark**: fix destructuring in dgram/single-buffer (Ali Hassan) [#62084](nodejs/node#62084) - \[[`e2f03c8e92`](nodejs/node@e2f03c8e92)] - **buffer**: improve performance of multiple Buffer operations (Ali Hassan) [#61871](nodejs/node#61871) - \[[`2fcd07f1ba`](nodejs/node@2fcd07f1ba)] - **build**: support empty libname flags in `configure.py` (Antoine du Hamel) [#62477](nodejs/node#62477) - \[[`b800c57fce`](nodejs/node@b800c57fce)] - **build**: fix timezone-update path references (Chengzhong Wu) [#62280](nodejs/node#62280) - \[[`7dc5a1e9b4`](nodejs/node@7dc5a1e9b4)] - **build**: skip dockit on IBMi (SRAVANI GUNDEPALLI) [#62189](nodejs/node#62189) - \[[`f0eea0f905`](nodejs/node@f0eea0f905)] - **build**: fix --node-builtin-modules-path (Filip Skokan) [#62115](nodejs/node#62115) - \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add --max-heap-size option (tannal) [#58708](nodejs/node#58708) - \[[`ac4b485698`](nodejs/node@ac4b485698)] - **crypto**: update root certificates to NSS 3.121 (Node.js GitHub Bot) [#62485](nodejs/node#62485) - \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) - \[[`3009980d9d`](nodejs/node@3009980d9d)] - **crypto**: add crypto::GetSSLCtx API for addon access to OpenSSL contexts (Tim Perry) [#62254](nodejs/node#62254) - \[[`f5725ca81d`](nodejs/node@f5725ca81d)] - **crypto**: reject ML-KEM/ML-DSA [PKCS#8](https://github.com/PKCS/node/issues/8) import without seed in SubtleCrypto (Filip Skokan) [#62218](nodejs/node#62218) - \[[`f69ed4bc3f`](nodejs/node@f69ed4bc3f)] - **crypto**: rename CShakeParams and KmacParams length to outputLength (Filip Skokan) [#61875](nodejs/node#61875) - \[[`4d96e53570`](nodejs/node@4d96e53570)] - **crypto**: refactor WebCrypto AEAD algorithms auth tag handling (Filip Skokan) [#62169](nodejs/node#62169) - \[[`93d77719e8`](nodejs/node@93d77719e8)] - **crypto**: read algorithm name property only once in normalizeAlgorithm (Filip Skokan) [#62170](nodejs/node#62170) - \[[`3d2e23a981`](nodejs/node@3d2e23a981)] - **deps**: update ada to 3.4.4 (Node.js GitHub Bot) [#62414](nodejs/node#62414) - \[[`176d6d2205`](nodejs/node@176d6d2205)] - **deps**: update timezone to 2026a (Node.js GitHub Bot) [#62164](nodejs/node#62164) - \[[`95c7fc67ba`](nodejs/node@95c7fc67ba)] - **deps**: update googletest to [`2461743`](nodejs/node@2461743) (Node.js GitHub Bot) [#62484](nodejs/node#62484) - \[[`e5e9f2044a`](nodejs/node@e5e9f2044a)] - **deps**: update simdjson to 4.5.0 (Node.js GitHub Bot) [#62382](nodejs/node#62382) - \[[`905b94266a`](nodejs/node@905b94266a)] - **deps**: update ngtcp2 to 1.21.0 (Node.js GitHub Bot) [#62051](nodejs/node#62051) - \[[`180c150122`](nodejs/node@180c150122)] - **deps**: V8: cherry-pick [`cf1bce4`](nodejs/node@cf1bce40a5ef) (Richard Lau) [#62449](nodejs/node#62449) - \[[`bc265aa003`](nodejs/node@bc265aa003)] - **deps**: upgrade npm to 11.12.1 (npm team) [#62448](nodejs/node#62448) - \[[`f1b28612c4`](nodejs/node@f1b28612c4)] - **deps**: V8: cherry-pick [`b25cd62`](nodejs/node@b25cd62c7ba2) (Yagiz Nizipli) [#62354](nodejs/node#62354) - \[[`757719d2af`](nodejs/node@757719d2af)] - **deps**: disable rust icu compiled\_data features (Chengzhong Wu) [#62284](nodejs/node#62284) - \[[`3bdc955b63`](nodejs/node@3bdc955b63)] - **deps**: update sqlite to 3.51.3 (Node.js GitHub Bot) [#62256](nodejs/node#62256) - \[[`a9703d194a`](nodejs/node@a9703d194a)] - **deps**: update googletest to [`73a63ea`](nodejs/node@73a63ea) (Node.js GitHub Bot) [#61927](nodejs/node#61927) - \[[`85138935cb`](nodejs/node@85138935cb)] - **deps**: update merve to 1.2.2 (Node.js GitHub Bot) [#62213](nodejs/node#62213) - \[[`231521e75e`](nodejs/node@231521e75e)] - **diagnostics\_channel**: add diagnostics channels for web locks (Ilyas Shabi) [#62123](nodejs/node#62123) - \[[`0093863664`](nodejs/node@0093863664)] - **doc**: deprecate `module.register()` (DEP0205) (Geoffrey Booth) [#62395](nodejs/node#62395) - \[[`0b96ece6be`](nodejs/node@0b96ece6be)] - **doc**: clarify that features cannot be both experimental and deprecated (Antoine du Hamel) [#62456](nodejs/node#62456) - \[[`8d3ea975f5`](nodejs/node@8d3ea975f5)] - **doc**: fix 'transfered' typo in quic.md (lilianakatrina684-a11y) [#62492](nodejs/node#62492) - \[[`08ff16e0ba`](nodejs/node@08ff16e0ba)] - **doc**: move sqlite type conversion section to correct level (René) [#62482](nodejs/node#62482) - \[[`61cc747dd8`](nodejs/node@61cc747dd8)] - **doc**: add Rafael to last security release steward (Rafael Gonzaga) [#62423](nodejs/node#62423) - \[[`64cfa5a6fa`](nodejs/node@64cfa5a6fa)] - **doc**: use npm-published version of doc-kit (Aviv Keller) [#62139](nodejs/node#62139) - \[[`1020321fb0`](nodejs/node@1020321fb0)] - **doc**: fix overstated Date header requirement in response.sendDate (Kit Dallege) [#62206](nodejs/node#62206) - \[[`9caa7855b2`](nodejs/node@9caa7855b2)] - **doc**: fix guaranteed typo (lilianakatrina684-a11y) [#62374](nodejs/node#62374) - \[[`e254f65306`](nodejs/node@e254f65306)] - **doc**: enhance clarification about the main field (Mowafak Almahaini) [#62302](nodejs/node#62302) - \[[`9e724b53f8`](nodejs/node@9e724b53f8)] - **doc**: remove spawn with shell example from bat/cmd section (Kit Dallege) [#62243](nodejs/node#62243) - \[[`7f37c17516`](nodejs/node@7f37c17516)] - **doc**: minor typo fix (Jeff Matson) [#62358](nodejs/node#62358) - \[[`eb0ca98f01`](nodejs/node@eb0ca98f01)] - **doc**: add path to vulnerabilities.json mention (Rafael Gonzaga) [#62355](nodejs/node#62355) - \[[`198b6e0932`](nodejs/node@198b6e0932)] - **doc**: deprecate CryptoKey use in node:crypto (Filip Skokan) [#62321](nodejs/node#62321) - \[[`17e5aee6c5`](nodejs/node@17e5aee6c5)] - **doc**: fix small environment\_variables typo (chris) [#62279](nodejs/node#62279) - \[[`193d629895`](nodejs/node@193d629895)] - **doc**: test and test-only targets do not run linter (Xavier Stouder) [#62120](nodejs/node#62120) - \[[`4a1f20ec4a`](nodejs/node@4a1f20ec4a)] - **doc**: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) [#62208](nodejs/node#62208) - \[[`f976c9214d`](nodejs/node@f976c9214d)] - **doc**: clarify that any truthy value of `shell` is part of DEP0190 (Antoine du Hamel) [#62249](nodejs/node#62249) - \[[`4d83972681`](nodejs/node@4d83972681)] - **doc**: remove outdated Chrome 66 and ndb references from debugger (Kit Dallege) [#62202](nodejs/node#62202) - \[[`71f2eada5b`](nodejs/node@71f2eada5b)] - **doc**: add throwIfNoEntry version history to fs.stat (kovan) [#62204](nodejs/node#62204) - \[[`670c80893b`](nodejs/node@670c80893b)] - **doc**: add note (and caveat) for `mock.module` about customization hooks (Jacob Smith) [#62075](nodejs/node#62075) - \[[`2ff5cb13f5`](nodejs/node@2ff5cb13f5)] - **doc,test**: clarify --eval syntax for leading '-' scripts (kovan) [#62244](nodejs/node#62244) - \[[`6c6c9004c4`](nodejs/node@6c6c9004c4)] - **esm**: fix typo in worker loader hook comment (jakecastelli) [#62475](nodejs/node#62475) - \[[`1cdd23c9f3`](nodejs/node@1cdd23c9f3)] - **esm**: fix source phase identity bug in loadCache eviction (Guy Bedford) [#62415](nodejs/node#62415) - \[[`4f4ff15794`](nodejs/node@4f4ff15794)] - **esm**: fix path normalization in `finalizeResolution` (Antoine du Hamel) [#62080](nodejs/node#62080) - \[[`088167d102`](nodejs/node@088167d102)] - **events**: avoid cloning listeners array on every emit (Gürgün Dayıoğlu) [#62261](nodejs/node#62261) - \[[`0250b436ee`](nodejs/node@0250b436ee)] - **fs**: fix cpSync to handle non-ASCII characters (Stefan Stojanovic) [#61950](nodejs/node#61950) - \[[`b67a8fb171`](nodejs/node@b67a8fb171)] - **inspector**: add Target.getTargets and extract TargetManager (Kohei) [#62487](nodejs/node#62487) - \[[`ffcc5a5722`](nodejs/node@ffcc5a5722)] - **lib**: make SubtleCrypto.supports enumerable (Filip Skokan) [#62307](nodejs/node#62307) - \[[`92ef2ad8fa`](nodejs/node@92ef2ad8fa)] - **lib**: prefer primordials in SubtleCrypto (Filip Skokan) [#62226](nodejs/node#62226) - \[[`40a43ac4d0`](nodejs/node@40a43ac4d0)] - **module**: fix coverage of mocked CJS modules imported from ESM (Marco) [#62133](nodejs/node#62133) - \[[`3ef0a5b90e`](nodejs/node@3ef0a5b90e)] - **quic**: remove CryptoKey support from session keys option (Filip Skokan) [#62335](nodejs/node#62335) - \[[`3c8dd8eb8e`](nodejs/node@3c8dd8eb8e)] - **repl**: use vm DONT\_CONTEXTIFY context (Chengzhong Wu) [#62371](nodejs/node#62371) - \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188) - \[[`e4c164e045`](nodejs/node@e4c164e045)] - **repl**: handle exceptions from async context after close (Anna Henningsen) [#62165](nodejs/node#62165) - \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on domain module (Matteo Collina) [#61227](nodejs/node#61227) - \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158) - \[[`fe82baf970`](nodejs/node@fe82baf970)] - **src**: improve EC JWK import performance (Filip Skokan) [#62396](nodejs/node#62396) - \[[`d490b171e0`](nodejs/node@d490b171e0)] - **src**: handle null backing store in ArrayBufferViewContents::Read (Mert Can Altin) [#62343](nodejs/node#62343) - \[[`0e4af848bc`](nodejs/node@0e4af848bc)] - **src**: convert context\_frame field in AsyncWrap to internal field (Anna Henningsen) [#62103](nodejs/node#62103) - \[[`02980b8c8f`](nodejs/node@02980b8c8f)] - **src**: enable compilation/linking with OpenSSL 4.0 (Filip Skokan) [#62410](nodejs/node#62410) - \[[`064f7c2fa6`](nodejs/node@064f7c2fa6)] - **src**: use stack allocation in indexOf latin1 path (Mert Can Altin) [#62268](nodejs/node#62268) - \[[`ede52bc2dc`](nodejs/node@ede52bc2dc)] - **src,sqlite**: fix filterFunc dangling reference (Edy Silva) [#62281](nodejs/node#62281) - \[[`e1f0d2a014`](nodejs/node@e1f0d2a014)] - **(SEMVER-MINOR)** **stream**: add stream/iter Implementation (James M Snell) [#62066](nodejs/node#62066) - \[[`03839fb087`](nodejs/node@03839fb087)] - **stream**: preserve error over AbortError in pipeline (Marco) [#62113](nodejs/node#62113) - \[[`0000d2f011`](nodejs/node@0000d2f011)] - **stream**: replace bind with arrow function for onwrite callback (Ali Hassan) [#62087](nodejs/node#62087) - \[[`3796a73719`](nodejs/node@3796a73719)] - **test**: update WPT for WebCryptoAPI to [`2cb332d`](nodejs/node@2cb332d710) (Node.js GitHub Bot) [#62483](nodejs/node#62483) - \[[`ad8309415b`](nodejs/node@ad8309415b)] - **test**: update WPT for url to [`fc3e651`](nodejs/node@fc3e651593) (Node.js GitHub Bot) [#62379](nodejs/node#62379) - \[[`bed89b037e`](nodejs/node@bed89b037e)] - **test**: wait for reattach before initial break on restart (Yuya Inoue) [#62471](nodejs/node#62471) - \[[`c9ffffcc55`](nodejs/node@c9ffffcc55)] - **test**: disable flaky WPT Blob test on AIX (James M Snell) [#62470](nodejs/node#62470) - \[[`fd41ef31f6`](nodejs/node@fd41ef31f6)] - **(SEMVER-MINOR)** **test**: add tests for experimental stream/iter implementation (James M Snell) [#62066](nodejs/node#62066) - \[[`1b9d8d3eec`](nodejs/node@1b9d8d3eec)] - **test**: avoid flaky run wait in debugger restart test (Yuya Inoue) [#62112](nodejs/node#62112) - \[[`cb08a29d51`](nodejs/node@cb08a29d51)] - **test**: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) [#62238](nodejs/node#62238) - \[[`abea0af8a9`](nodejs/node@abea0af8a9)] - **test**: add WebCrypto Promise.prototype.then pollution regression tests (Filip Skokan) [#62226](nodejs/node#62226) - \[[`47a2132269`](nodejs/node@47a2132269)] - **test**: update WPT for WebCryptoAPI to [`6a1c545`](nodejs/node@6a1c545d77) (Node.js GitHub Bot) [#62187](nodejs/node#62187) - \[[`2c63d3006c`](nodejs/node@2c63d3006c)] - **test\_runner**: add exports option for module mocks (sangwook) [#61727](nodejs/node#61727) - \[[`44ac0e1302`](nodejs/node@44ac0e1302)] - **test\_runner**: make it compatible with fake timers (Matteo Collina) [#59272](nodejs/node#59272) - \[[`1865691275`](nodejs/node@1865691275)] - **test\_runner**: set non-zero exit code when suite errors occur (Edy Silva) [#62282](nodejs/node#62282) - \[[`0252b2bab8`](nodejs/node@0252b2bab8)] - **tools**: bump picomatch from 4.0.3 to 4.0.4 in /tools/eslint (dependabot\[bot]) [#62439](nodejs/node#62439) - \[[`3368155267`](nodejs/node@3368155267)] - **tools**: bump yaml from 2.8.2 to 2.8.3 in /tools/doc (dependabot\[bot]) [#62437](nodejs/node#62437) - \[[`5e47c359f5`](nodejs/node@5e47c359f5)] - **tools**: adopt the `--check-for-duplicates` NCU flag (Antoine du Hamel) [#62478](nodejs/node#62478) - \[[`4a604e82d0`](nodejs/node@4a604e82d0)] - **tools**: bump picomatch in /tools/doc (dependabot\[bot]) [#62438](nodejs/node#62438) - \[[`d1a98b4ddb`](nodejs/node@d1a98b4ddb)] - **tools**: bump flatted from 3.4.1 to 3.4.2 in /tools/eslint (dependabot\[bot]) [#62375](nodejs/node#62375) - \[[`c32daa1ab4`](nodejs/node@c32daa1ab4)] - **tools**: bump eslint deps (Huáng Jùnliàng) [#62356](nodejs/node#62356) - \[[`7a2fcc6d41`](nodejs/node@7a2fcc6d41)] - **tools**: do not swallow error in `lint-nix` workflow (Antoine du Hamel) [#62292](nodejs/node#62292) - \[[`c41a2871b5`](nodejs/node@c41a2871b5)] - **tools**: add eslint-plugin-regexp (Huáng Jùnliàng) [#62093](nodejs/node#62093) - \[[`56dfeb06df`](nodejs/node@56dfeb06df)] - **tools**: fix timeout errors in `lint-nix` job (Antoine du Hamel) [#62265](nodejs/node#62265) - \[[`22fc8078e8`](nodejs/node@22fc8078e8)] - **tools**: bump flatted from 3.3.3 to 3.4.1 in /tools/eslint (dependabot\[bot]) [#62255](nodejs/node#62255) - \[[`409b0663bd`](nodejs/node@409b0663bd)] - **tools**: bump undici from 6.23.0 to 6.24.1 in /tools/doc (dependabot\[bot]) [#62250](nodejs/node#62250) - \[[`67c69750f4`](nodejs/node@67c69750f4)] - **tools**: validate all commits that are pushed to `main` (Antoine du Hamel) [#62246](nodejs/node#62246) - \[[`7d9db8cd21`](nodejs/node@7d9db8cd21)] - **tools**: keep GN files when updating Merve (Antoine du Hamel) [#62167](nodejs/node#62167) - \[[`6c8fa42ba2`](nodejs/node@6c8fa42ba2)] - **typings**: rationalise TypedArray types (René) [#62174](nodejs/node#62174) - \[[`531c64d04e`](nodejs/node@531c64d04e)] - **url**: enable simdutf for ada (Yagiz Nizipli) [#61477](nodejs/node#61477) - \[[`2000caccde`](nodejs/node@2000caccde)] - **util**: allow color aliases in styleText (sangwook) [#62180](nodejs/node#62180) - \[[`0aed332ab4`](nodejs/node@0aed332ab4)] - **wasm**: support js string constant esm import (Guy Bedford) [#62198](nodejs/node#62198) - \[[`d3fd4a978b`](nodejs/node@d3fd4a978b)] - **worker**: heap profile optimizations (Ilyas Shabi) [#62201](nodejs/node#62201) - \[[`e992a34a18`](nodejs/node@e992a34a18)] - **zlib**: fix use-after-free when reset() is called during write (Matteo Collina) [#62325](nodejs/node#62325) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

dependabot bot added dependencies Pull requests that update a dependency file. javascript Pull requests that update Javascript code labels Mar 14, 2026

dependabot bot mentioned this pull request Mar 14, 2026

tools: bump undici from 6.23.0 to 6.24.0 in /tools/doc #62247

Closed

nodejs-github-bot added doc Issues and PRs related to the documentations. tools Issues and PRs related to the tools directory. labels Mar 14, 2026

cjihrig approved these changes Mar 14, 2026

View reviewed changes

avivkeller approved these changes Mar 14, 2026

View reviewed changes

aduh95 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. labels Mar 15, 2026

mertcanaltin approved these changes Mar 15, 2026

View reviewed changes

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 16, 2026

nodejs-github-bot merged commit 35fed19 into main Mar 16, 2026
48 checks passed

nodejs-github-bot deleted the dependabot/npm_and_yarn/tools/doc/undici-6.24.1 branch March 16, 2026 10:59

github-actions bot mentioned this pull request Mar 31, 2026

2026-04-01, Version 25.9.0 (Current) #62522

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

tools: bump undici from 6.23.0 to 6.24.1 in /tools/doc#62250

tools: bump undici from 6.23.0 to 6.24.1 in /tools/doc#62250
nodejs-github-bot merged 1 commit intomainfrom
dependabot/npm_and_yarn/tools/doc/undici-6.24.1

dependabot bot commented on behalf of github Mar 14, 2026

Uh oh!

nodejs-github-bot commented Mar 14, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 14, 2026

v6.24.1

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

Upgrade guidance

Fixed advisories

Not applicable to v6

Affected and patched ranges (v6)

References

Uh oh!

nodejs-github-bot commented Mar 14, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants