chore(deps): update dependency undici to v7.24.0 [security] by renovate[bot] · Pull Request #4040 · liam-hq/liam

renovate · 2026-01-14T22:14:34Z

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	`7.16.0` → `7.24.0`

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

CVE-2026-1528 / GHSA-f269-vfmq-vjvj

More information

Details

Impact

A server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

There are no workarounds.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Undici has an HTTP Request/Response Smuggling issue

CVE-2026-1525 / GHSA-2mjp-6q6p-2qxm

More information

Details

Impact

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
Applications that accept user-controlled header names without case-normalization

Potential consequences:

Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

If upgrading is not immediately possible:

Validate header names: Ensure no duplicate Content-Length headers (case-insensitive) are present before passing headers to undici
Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key
Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Undici has CRLF Injection in undici via `upgrade` option

CVE-2026-1527 / GHSA-4992-7rv2-5pvq

More information

Details

Impact

When an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:

Inject arbitrary HTTP headers
Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)

The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121
if (upgrade) {
  header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

Sanitize the upgrade option string before passing to undici:

function sanitizeUpgrade(value) {
  if (/[\r\n]/.test(value)) {
    throw new Error('Invalid upgrade value')
  }
  return value
}

client.request({
  upgrade: sanitizeUpgrade(userInput)
})

Severity

CVSS Score: 4.6 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodejs/undici (undici)

`v7.24.0`

Compare Source

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).
GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.
GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).
GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
CRLF injection via the upgrade option.
GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.
GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
Unbounded memory consumption in WebSocket permessage-deflate decompression.

Affected and patched ranges

CVE-2026-1525: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-1528: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-2581: affected >= 7.17.0 < 7.24.0, patched 7.24.0
CVE-2026-1527: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-2229: affected 7.0.0 < 7.24.0, patched 7.24.0
CVE-2026-1526: affected 7.0.0 < 7.24.0, patched 7.24.0

References

GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories
NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528
NVD CVE-2026-2581: https://nvd.nist.gov/vuln/detail/CVE-2026-2581
NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527
NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229
NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

`v7.23.0`

Compare Source

What's Changed

fix: prevent AbortController GC when redirect is 'error' by @mcollina in #4750
docs: clarify UndiciHeaders validation guidance by @mcollina in #4832
build(deps): bump actions/checkout from 5.0.0 to 6.0.2 by @dependabot[bot] in #4795
build(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in #4794
build(deps): bump github/codeql-action from 4.31.2 to 4.32.0 by @dependabot[bot] in #4793
test: add unexpected disconnect guards to client test files by @samayer12 in #4833
fix fetch stripping trailing ? from url by @KhafraDev in #4837
fix: forward onResponseStarted through WrapHandler and UnwrapHandler by @7rulnik in #4840
webidl: access keys in lexicographical order by @KhafraDev in #4841
ci: disable coverage on Node.js 25 by @mcollina in #4852
build(deps): bump uWebSockets.js from v20.56.0 to v20.58.0 in /benchmarks by @dependabot[bot] in #4855
fix(h2): TypeError: Cannot read properties of null (reading 'servername') in _resume when H2 stream completes by @hxinhan in #4847
fix(h2): ignore late data frames after request completion by @mcollina in #4845
fix(handler): preserve latin1 header encoding in WrapHandler by @theamodhshetty in #4859
docs(examples): add cache interceptor example with fetch by @nthbotast in #4864
docs(dispatcher): clarify onResponseStart return value is ignored by @nthbotast in #4865
feat: add SOCKS5 proxy support to ProxyAgent by @mcollina in #4385
fix: harden header iterable checks for prototype-pollution scenarios by @mcollina in #4824
fix(interceptor): preserve tuple headers in dns interceptor by @theamodhshetty in #4863
docs(dispatcher): use RFC 2606 domains in interceptor examples by @nthbotast in #4873
feat: add IP prioritization hints for HTTP/1.1 and HTTP/2 by @amyssnippet in #4831
docs: clarify when to install undici vs using Node's built-in fetch by @travisbreaks in #4868
docs(dispatcher): add cache interceptor fetch example by @nthbotast in #4870
fix(dispatcher): pass socketPath to custom connect callbacks by @theamodhshetty in #4857

New Contributors

@samayer12 made their first contribution in #4833
@7rulnik made their first contribution in #4840
@hxinhan made their first contribution in #4847
@theamodhshetty made their first contribution in #4859
@nthbotast made their first contribution in #4864
@amyssnippet made their first contribution in #4831
@travisbreaks made their first contribution in #4868

Full Changelog: nodejs/undici@v7.22.0...v7.23.0

`v7.22.0`

Compare Source

What's Changed

docs: fix syntax highlighting in WebSocket.md by @styfle in #4814
fix: use OR operator in includesCredentials per WHATWG URL Standard by @jackhax in #4816
feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk by @SuperOleg39 in #4676
fix: route WebSocket upgrades through onRequestUpgrade by @mcollina in #4787
build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by @dependabot[bot] in #4821
fix(deduplicate): do not deduplicate non-safe methods by default by @mcollina in #4818
feat: Support async cache stores in revalidation by @marcopiraccini in #4826

New Contributors

@jackhax made their first contribution in #4816
@marcopiraccini made their first contribution in #4826

Full Changelog: nodejs/undici@v7.21.0...v7.22.0

`v7.21.0`

Compare Source

What's Changed

build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by @dependabot[bot] in #4796
test: restore global dispatcher after fetch tests by @mcollina in #4790
Add missing close method to WebSocketStream interface by @piotr-cz in #4802
fix: error stream instead of canceling by @KhafraDev in #4804
Fix clientTtl cleanup race in Agent by @mcollina in #4807
feat(#4230): Implement pingInterval for dispatching PING frames by @metcoder95 in #4296
fix: handle undefined __filename in bundled environments by @mcollina in #4812
fix: set finalizer only for fetch responses by @tsctx in #4803

New Contributors

@piotr-cz made their first contribution in #4802

Full Changelog: nodejs/undici@v7.20.0...v7.21.0

`v7.20.0`

Compare Source

What's Changed

fix: preserve fetch stack traces by @mcollina in #4778
Fix error handling in MockPool example by @dave-kennedy in #4781
feat: expose statusText in request() ResponseData by @domenic in #4784
test: reduce retry-after invalid date flake by @mcollina in #4788
extractBody fixes by @KhafraDev in #4791
fix: MockAgent delayed response with AbortSignal (#4693) by @mcollina in #4772
fix: onParserTimeout potentially accessing undefined by @vbfox in #4758

New Contributors

@dave-kennedy made their first contribution in #4781
@vbfox made their first contribution in #4758

Full Changelog: nodejs/undici@v7.19.2...v7.20.0

`v7.19.2`

Compare Source

What's Changed

Minor code cleanups to decompress interceptor by @domenic in #4754
fix(h2): fix flaky stream end handling on macOS by @mcollina in #4762
return response when receiving 401 instead of network error by @KhafraDev in #4769
fix: properly close idle connections in test server cleanup by @mcollina in #4764
fix: decode HTTP headers as latin1 instead of utf8 by @mcollina in #4768
fix: submodule update by @Uzlopak in #4648
build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 by @dependabot[bot] in #4720

New Contributors

@domenic made their first contribution in #4754

Full Changelog: nodejs/undici@v7.19.1...v7.19.2

`v7.19.1`

Compare Source

What's Changed

fix: use commit hash when generating release (#4757) by @fenichelar in #4759
fix fetch 401 loop by @KhafraDev in #4761

New Contributors

@fenichelar made their first contribution in #4759

Full Changelog: nodejs/undici@v7.19.0...v7.19.1

`v7.19.0`

Compare Source

What's Changed

fix: Handle FormData body type correctly in RetryAgent retried requests by @eliotschu in #4692
feat(client): expose HTTP/2 flow-control options by @pabloelisseo in #4706
Implement origin normalization in MockAgent for case-insensitivity and URL handling by @SksOp in #4731
fix websocket basic auth by @KhafraDev in #4747
fix(cache): regenerate stream from source when cache.match is called after GC by @mcollina in #4713
chore: use testcontext for test:cache by @Uzlopak in #4571
chore: use testcontext for subresource integrity tests by @Uzlopak in #4575
feat(cache): add origins option for whitelist filtering by @mcollina in #4739
ci: test shared-builtin only on Node.js 24 and 25 by @mcollina in #4746
fix websocketstream open error by @KhafraDev in #4748

New Contributors

@eliotschu made their first contribution in #4692
@pabloelisseo made their first contribution in #4706
@SksOp made their first contribution in #4731

Full Changelog: nodejs/undici@v7.18.2...v7.19.0

`v7.18.2`

Compare Source

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in #4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

`v7.18.1`

Compare Source

What's Changed

Test and Fix running without SSL by @mcollina in #4727
docs: add security warning for strictContentLength option by @mcollina in #4726
build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in #4718
build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

What's Changed

chore: extract infra and encoding methods by @Uzlopak in #4523
ci: remove h2 by @Uzlopak in #4534
ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in #4535
ci: fix nightly shared library case by @Uzlopak in #4543
test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in #4528
docs: add Cache Interceptor example to README by @tawseefnabi in #4393
test: remove node20 version check by @Uzlopak in #4544
types: use MessagePort instance type in MessageEvent by @Renegade334 in #4546
ci: set write permissions on job level by @Uzlopak in #4537
lint: activate n/no-process-exit by @Uzlopak in #4548
ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in #4536
chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in #4547
feat(H2): correct CONNECT behaviour by @metcoder95 in #4541
test: fix plans by @Uzlopak in #4550
feat: add runtime feature "detection" by @Uzlopak in #4545
perf: use less promises in extractBody by @Uzlopak in #4458
fix(proxy-agent): add missing return after callback-call by @Uzlopak in #4553
fix: remove redundant line in retry-handler by @Uzlopak in #4554
ci: add no-wasm-simd option by @Uzlopak in #4533
fix: use lazyloaders for runtime feature detection by @Uzlopak in #4557
fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in #4556
http2: refactor and split tests of http2.js into multiple files by @Uzlopak in #4561
fix: dns-interceptor test should await plan to complete by @Uzlopak in #4560
chore: remove istanbul instructions by @Uzlopak in #4559
fix: keep promise chains intact by @Uzlopak in #4558
build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @dependabot[bot] in #4567
chore: remove tspl from eventsource by @Uzlopak in #4569
chore: remove tspl from fetch by @Uzlopak in #4570
feat: add getUpstream() method to BalancedPool by @mcollina in #4586
fetch: handle invalid priority values properly by @Uzlopak in #4522
ci: fix test coverage for codecov by @Uzlopak in #4520
types: optional status in Response.redirect by @gineika in #4591
docs: unix socket add-on by @FelixVaughan in #4587
build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #4601
build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @dependabot[bot] in #4600
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4603
build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @dependabot[bot] in #4604
build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #4602
build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #4598
build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @dependabot[bot] in #4599
build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #4597
fix: cacheStores types and usage in README by @lucalooz in #4605
Feat dns interceptor storage by @SuperOleg39 in #4589
docs: add crawling best practices by @Uzlopak in #4590
fix: 304 not modified reply upon revalidation did not update cache. by @daan944 in #4617
chore: use testcontext for test:infra by @Uzlopak in #4579
fetch: improve regexes in data-uri.js by @Uzlopak in #4483
perf: optimize validate http token by @PandaWorker in #4608
test: improve long-lived-abort-controller test by @Uzlopak in #4621
ci: add node.js 25 to test matrix by @shivarm in #4626
chore: use testcontext for test/utils tests by @Uzlopak in #4577
chore: remove tspl from websocket by @Uzlopak in #4568
fix(ws) onSocketClose being called multiple times by @KhafraDev in #4632
fix: prevent duplicate debug logs when multiple undici instances exist by @mcollina in #4630
chore: use testcontext for busboy tests by @Uzlopak in #4572
test: fix flaky http2-dispatcher test by @mcollina in #4633
build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @dependabot[bot] in #4635
Run the gc() in long-lived-abort-controller test by @mcollina in #4638
Do not destroy the HTTP2 stream twice in tests by @mcollina in #4637
Fix http2-dispatcher test by @mcollina in #4640
fix: fetch blob with range off-by-one error by @platypii in #4643
fix: ensure HTTP/2 sends Content-Length for empty POST requests by @mcollina in #4613
build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @dependabot[bot] in #4645
feat(#2458): WebSocket through HTTP/2 by @metcoder95 in #4540
docs(README): correct the example code for the consumption of respons… by @tenkirin in #4658
build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #4653
build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @dependabot[bot] in #4655
build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #4652
build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #4651
build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @dependabot[bot] in #4654
don't freeze urlList for opaque filtered responses by @KhafraDev in #4656
fix fd parsing unquoted attribute values by @KhafraDev in #4662
build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @dependabot[bot] in #4665
feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @SuperOleg39 in #4659
Feat/round robin pool by @FelixVaughan in #4650
Formdata ignore epilogue preamble by @KhafraDev in #4672
build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #4682
fix: snapshot url exclusion by @FelixVaughan in #4670
feat: support h2c over unix domain sockets by @chrros95 in #4690
fix(docs): remove unused TypeScript example code block by @kerolloz in #4701
feat: add deduplicate interceptor for request deduplication by @mcollina in #4679
chore: use testcontext for mock tests by @Uzlopak in #4582
fix(test): remove hardcoded folder name in client-error-stack-trace test by @mcollina in #4707

New Contributors

@gineika made their first contribution in #4591
@lucalooz made their first contribution in #4605
@SuperOleg39 made their first contribution in #4589
@daan944 made their first contribution in #4617
@PandaWorker made their first contribution in #4608
@platypii made their first contribution in #4643
@tenkirin made their first contribution in #4658
@kerolloz made their first contribution in #4701

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-01-14T22:14:40Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
liam-app	Ready	Preview, Comment	Jul 12, 2026 1:17pm
liam-assets	Ready	Preview	Jul 12, 2026 1:17pm
liam-docs	Ready	Preview, Comment	Jul 12, 2026 1:17pm
liam-erd-sample	Ready	Preview	Jul 12, 2026 1:17pm
liam-storybook	Ready	Preview, Comment	Jul 12, 2026 1:17pm

giselles-ai · 2026-01-14T22:14:42Z

Finished running flow.

Step 1
🟢	On Pull Request Opened Status: Success Updated: Jan 14, 2026 10:14pm
Step 2
🟢	gpt-5 Status: Success Updated: Jan 14, 2026 10:16pm
Step 3
🟢	Create Pull Request Comment Status: Success Updated: Jan 14, 2026 10:16pm

coderabbitai · 2026-01-14T22:14:46Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

giselles-ai · 2026-01-14T22:16:34Z

Check changeset necessity

Status: NOT REQUIRED

Reason:

Only the root pnpm overrides and lockfile were updated to pin undici from 7.16.0 to 7.18.2; no package code or manifests for target packages (@liam-hq/cli, @liam-hq/erd-core, @liam-hq/schema, @liam-hq/ui) were changed.
This is a dependency bump for security hardening with no user-facing feature, API, or behavior changes in our published packages.
Lockfile and tooling/override adjustments do not affect consumers directly and are considered non-user-facing per the guide.

Changeset (copy & paste):

# No changeset required for this PR (dependency override/lockfile only).

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional flags.

github-actions · 2026-07-12T13:12:36Z

Dependency Review

The following issues were found:

❌ 1 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

pnpm-lock.yaml

Name	Version	Vulnerability	Severity
undici	7.24.0	undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent	high
		undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse	high
		undici WebSocket client vulnerable to denial of service via fragment count bypass	high
		undici vulnerable to cross-user information disclosure via shared cache whitespace bypass	moderate
		undici vulnerable to HTTP header injection via Set-Cookie percent-decoding	moderate
		undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse	low
		undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching	low

OpenSSF Scorecard

Package

Version

Score

Details

npm/undici

7.24.0

🟢 8.2

Details

Check	Score	Reason
Dependency-Update-Tool	🟢 10	update tool detected
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 8	binaries present in source code
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
SAST	🟢 10	SAST tool is run on all commits
Signed-Releases	⚠️ -1	no releases found
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 76 contributing companies or organizations

Scanned Files

pnpm-lock.yaml

renovate Bot requested a review from a team as a code owner January 14, 2026 22:14

renovate Bot requested review from NoritakaIkeda, junkisai and sasamuku and removed request for a team January 14, 2026 22:14

vercel Bot deployed to Preview – liam-assets January 14, 2026 22:14 View deployment

vercel Bot deployed to Preview – liam-erd-sample January 14, 2026 22:15 View deployment

vercel Bot deployed to Preview – liam-storybook January 14, 2026 22:16 View deployment

vercel Bot deployed to Preview – liam-docs January 14, 2026 22:16 View deployment

vercel Bot deployed to Preview – liam-app January 14, 2026 22:19 View deployment

renovate Bot force-pushed the renovate/npm-undici-vulnerability branch from dd15cf6 to 9edfb25 Compare January 19, 2026 17:41

vercel Bot deployed to Preview – liam-assets January 19, 2026 17:41 View deployment

vercel Bot deployed to Preview – liam-erd-sample January 19, 2026 17:41 View deployment

vercel Bot deployed to Preview – liam-docs January 19, 2026 17:42 View deployment

vercel Bot deployed to Preview – liam-storybook January 19, 2026 17:42 View deployment

vercel Bot deployed to Preview – liam-app January 19, 2026 17:44 View deployment

renovate Bot force-pushed the renovate/npm-undici-vulnerability branch from 9edfb25 to a75777d Compare January 23, 2026 17:43

vercel Bot deployed to Preview – liam-assets January 23, 2026 17:43 View deployment

vercel Bot deployed to Preview – liam-docs January 23, 2026 17:44 View deployment

devin-ai-integration Bot reviewed Jan 23, 2026

View reviewed changes

vercel Bot deployed to Preview – liam-storybook January 23, 2026 17:44 View deployment

vercel Bot deployed to Preview – liam-erd-sample January 23, 2026 17:45 View deployment

vercel Bot deployed to Preview – liam-app January 23, 2026 17:46 View deployment

renovate Bot force-pushed the renovate/npm-undici-vulnerability branch from a75777d to 0236f47 Compare February 15, 2026 11:12

vercel Bot deployed to Preview – liam-assets February 15, 2026 11:13 View deployment

vercel Bot deployed to Preview – liam-erd-sample February 15, 2026 11:14 View deployment

vercel Bot deployed to Preview – liam-storybook April 16, 2026 04:29 View deployment

vercel Bot deployed to Preview – liam-docs April 16, 2026 04:29 View deployment

vercel Bot deployed to Preview – liam-app April 16, 2026 04:32 View deployment

renovate Bot force-pushed the renovate/npm-undici-vulnerability branch from 8abb6ed to 3dd1870 Compare April 29, 2026 19:06

vercel Bot deployed to Preview – liam-assets April 29, 2026 19:07 View deployment

vercel Bot deployed to Preview – liam-erd-sample April 29, 2026 19:08 View deployment

vercel Bot deployed to Preview – liam-storybook April 29, 2026 19:08 View deployment

vercel Bot deployed to Preview – liam-docs April 29, 2026 19:08 View deployment

vercel Bot deployed to Preview – liam-app April 29, 2026 19:10 View deployment

renovate Bot force-pushed the renovate/npm-undici-vulnerability branch from 3dd1870 to e0ed5e7 Compare May 12, 2026 10:55

vercel Bot deployed to Preview – liam-assets May 12, 2026 10:56 View deployment

vercel Bot deployed to Preview – liam-erd-sample May 12, 2026 10:56 View deployment

vercel Bot deployed to Preview – liam-storybook May 12, 2026 10:57 View deployment

vercel Bot deployed to Preview – liam-docs May 12, 2026 10:57 View deployment

vercel Bot deployed to Preview – liam-app May 12, 2026 11:00 View deployment

renovate Bot force-pushed the renovate/npm-undici-vulnerability branch from e0ed5e7 to 42592b7 Compare May 28, 2026 17:42

vercel Bot deployed to Preview – liam-assets May 28, 2026 17:42 View deployment

vercel Bot deployed to Preview – liam-erd-sample May 28, 2026 17:43 View deployment

vercel Bot deployed to Preview – liam-storybook May 28, 2026 17:44 View deployment

vercel Bot deployed to Preview – liam-docs May 28, 2026 17:44 View deployment

vercel Bot deployed to Preview – liam-app May 28, 2026 17:47 View deployment

renovate Bot changed the title ~~Update dependency undici to v7.24.0 [SECURITY]~~ chore(deps): update dependency undici to v7.24.0 [security] Jun 18, 2026

chore(deps): update dependency undici to v7.24.0 [security]

d0e4ef1

renovate Bot force-pushed the renovate/npm-undici-vulnerability branch from 42592b7 to d0e4ef1 Compare July 12, 2026 13:12

vercel Bot deployed to Preview – liam-assets July 12, 2026 13:12 View deployment

vercel Bot deployed to Preview – liam-erd-sample July 12, 2026 13:13 View deployment

vercel Bot deployed to Preview – liam-storybook July 12, 2026 13:14 View deployment

vercel Bot deployed to Preview – liam-docs July 12, 2026 13:14 View deployment

vercel Bot deployed to Preview – liam-app July 12, 2026 13:17 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency undici to v7.24.0 [security]#4040

chore(deps): update dependency undici to v7.24.0 [security]#4040
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-undici-vulnerability

renovate Bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

giselles-ai Bot commented Jan 14, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jan 14, 2026

Review skipped

Uh oh!

giselles-ai Bot commented Jan 14, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Details

Impact

Patches

Workarounds

Severity

References

Undici has an HTTP Request/Response Smuggling issue

Details

Impact

Patches

Workarounds

Severity

References

Undici has CRLF Injection in undici via upgrade option

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

Affected and patched ranges

References

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

⚠️ Security Release

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

vercel Bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giselles-ai Bot commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jan 14, 2026

Review skipped

Uh oh!

giselles-ai Bot commented Jan 14, 2026

Check changeset necessity

Reason:

Changeset (copy & paste):

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

github-actions Bot commented Jul 12, 2026

Dependency Review

Vulnerabilities

pnpm-lock.yaml

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

renovate Bot commented Jan 14, 2026 •

edited

Loading

Undici has CRLF Injection in undici via `upgrade` option

vercel Bot commented Jan 14, 2026 •

edited

Loading

giselles-ai Bot commented Jan 14, 2026 •

edited

Loading