chore(deps): update dependency undici to v7.24.0 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	7.10.0 → 7.24.0

GitHub Vulnerability Alerts

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

• https://hackerone.com/reports/3456148
• GHSA-gm62-xv2j-4w53
• https://curl.se/docs/CVE-2022-32206.html

CVE-2026-1525

Impact

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

• Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
• Applications that accept user-controlled header names without case-normalization

Potential consequences:

• Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
• HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.

Workarounds

If upgrading is not immediately possible:

1. Validate header names: Ensure no duplicate Content-Length headers (case-insensitive) are present before passing headers to undici
2. Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key
3. Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates

---

Release Notes

nodejs/undici (undici)

v7.24.0

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.23.0...v7.24.0

v7.23.0

Compare Source

v7.22.0

Compare Source

What's Changed

• docs: fix syntax highlighting in WebSocket.md by @​styfle in #​4814
• fix: use OR operator in includesCredentials per WHATWG URL Standard by @​jackhax in #​4816
• feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk by @​SuperOleg39 in #​4676
• fix: route WebSocket upgrades through onRequestUpgrade by @​mcollina in #​4787
• build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 by @​dependabot[bot] in #​4821
• fix(deduplicate): do not deduplicate non-safe methods by default by @​mcollina in #​4818
• feat: Support async cache stores in revalidation by @​marcopiraccini in #​4826

New Contributors

• @​jackhax made their first contribution in #​4816
• @​marcopiraccini made their first contribution in #​4826

Full Changelog: nodejs/undici@v7.21.0...v7.22.0

v7.21.0

Compare Source

What's Changed

• build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by @​dependabot[bot] in #​4796
• test: restore global dispatcher after fetch tests by @​mcollina in #​4790
• Add missing close method to WebSocketStream interface by @​piotr-cz in #​4802
• fix: error stream instead of canceling by @​KhafraDev in #​4804
• Fix clientTtl cleanup race in Agent by @​mcollina in #​4807
• feat(#​4230): Implement pingInterval for dispatching PING frames by @​metcoder95 in #​4296
• fix: handle undefined __filename in bundled environments by @​mcollina in #​4812
• fix: set finalizer only for fetch responses by @​tsctx in #​4803

New Contributors

• @​piotr-cz made their first contribution in #​4802

Full Changelog: nodejs/undici@v7.20.0...v7.21.0

v7.20.0

Compare Source

What's Changed

• fix: preserve fetch stack traces by @​mcollina in #​4778
• Fix error handling in MockPool example by @​dave-kennedy in #​4781
• feat: expose statusText in request() ResponseData by @​domenic in #​4784
• test: reduce retry-after invalid date flake by @​mcollina in #​4788
• extractBody fixes by @​KhafraDev in #​4791
• fix: MockAgent delayed response with AbortSignal (#​4693) by @​mcollina in #​4772
• fix: onParserTimeout potentially accessing undefined by @​vbfox in #​4758

New Contributors

• @​dave-kennedy made their first contribution in #​4781
• @​vbfox made their first contribution in #​4758

Full Changelog: nodejs/undici@v7.19.2...v7.20.0

v7.19.2

Compare Source

What's Changed

• Minor code cleanups to decompress interceptor by @​domenic in #​4754
• fix(h2): fix flaky stream end handling on macOS by @​mcollina in #​4762
• return response when receiving 401 instead of network error by @​KhafraDev in #​4769
• fix: properly close idle connections in test server cleanup by @​mcollina in #​4764
• fix: decode HTTP headers as latin1 instead of utf8 by @​mcollina in #​4768
• fix: submodule update by @​Uzlopak in #​4648
• build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 by @​dependabot[bot] in #​4720

New Contributors

• @​domenic made their first contribution in #​4754

Full Changelog: nodejs/undici@v7.19.1...v7.19.2

v7.19.1

Compare Source

What's Changed

• fix: use commit hash when generating release (#​4757) by @​fenichelar in #​4759
• fix fetch 401 loop by @​KhafraDev in #​4761

New Contributors

• @​fenichelar made their first contribution in #​4759

Full Changelog: nodejs/undici@v7.19.0...v7.19.1

v7.19.0

Compare Source

What's Changed

• fix: Handle FormData body type correctly in RetryAgent retried requests by @​eliotschu in #​4692
• feat(client): expose HTTP/2 flow-control options by @​pabloelisseo in #​4706
• Implement origin normalization in MockAgent for case-insensitivity and URL handling by @​SksOp in #​4731
• fix websocket basic auth by @​KhafraDev in #​4747
• fix(cache): regenerate stream from source when cache.match is called after GC by @​mcollina in #​4713
• chore: use testcontext for test:cache by @​Uzlopak in #​4571
• chore: use testcontext for subresource integrity tests by @​Uzlopak in #​4575
• feat(cache): add origins option for whitelist filtering by @​mcollina in #​4739
• ci: test shared-builtin only on Node.js 24 and 25 by @​mcollina in #​4746
• fix websocketstream open error by @​KhafraDev in #​4748

New Contributors

• @​eliotschu made their first contribution in #​4692
• @​pabloelisseo made their first contribution in #​4706
• @​SksOp made their first contribution in #​4731

Full Changelog: nodejs/undici@v7.18.2...v7.19.0

v7.18.2

Compare Source

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @​mcollina in #​4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

Compare Source

What's Changed

• Test and Fix running without SSL by @​mcollina in #​4727
• docs: add security warning for strictContentLength option by @​mcollina in #​4726
• build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @​dependabot[bot] in #​4718
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

Compare Source

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

Compare Source

What's Changed

• chore: extract infra and encoding methods by @​Uzlopak in #​4523
• ci: remove h2 by @​Uzlopak in #​4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @​Uzlopak in #​4535
• ci: fix nightly shared library case by @​Uzlopak in #​4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @​Uzlopak in #​4528
• docs: add Cache Interceptor example to README by @​tawseefnabi in #​4393
• test: remove node20 version check by @​Uzlopak in #​4544
• types: use MessagePort instance type in MessageEvent by @​Renegade334 in #​4546
• ci: set write permissions on job level by @​Uzlopak in #​4537
• lint: activate n/no-process-exit by @​Uzlopak in #​4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @​Uzlopak in #​4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @​Uzlopak in #​4547
• feat(H2): correct CONNECT behaviour by @​metcoder95 in #​4541
• test: fix plans by @​Uzlopak in #​4550
• feat: add runtime feature "detection" by @​Uzlopak in #​4545
• perf: use less promises in extractBody by @​Uzlopak in #​4458
• fix(proxy-agent): add missing return after callback-call by @​Uzlopak in #​4553
• fix: remove redundant line in retry-handler by @​Uzlopak in #​4554
• ci: add no-wasm-simd option by @​Uzlopak in #​4533
• fix: use lazyloaders for runtime feature detection by @​Uzlopak in #​4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @​Uzlopak in #​4556
• http2: refactor and split tests of http2.js into multiple files by @​Uzlopak in #​4561
• fix: dns-interceptor test should await plan to complete by @​Uzlopak in #​4560
• chore: remove istanbul instructions by @​Uzlopak in #​4559
• fix: keep promise chains intact by @​Uzlopak in #​4558
• build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @​dependabot[bot] in #​4567
• chore: remove tspl from eventsource by @​Uzlopak in #​4569
• chore: remove tspl from fetch by @​Uzlopak in #​4570
• feat: add getUpstream() method to BalancedPool by @​mcollina in #​4586
• fetch: handle invalid priority values properly by @​Uzlopak in #​4522
• ci: fix test coverage for codecov by @​Uzlopak in #​4520
• types: optional status in Response.redirect by @​gineika in #​4591
• docs: unix socket add-on by @​FelixVaughan in #​4587
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @​dependabot[bot] in #​4601
• build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @​dependabot[bot] in #​4600
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in #​4603
• build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @​dependabot[bot] in #​4604
• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​4602
• build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @​dependabot[bot] in #​4598
• build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @​dependabot[bot] in #​4599
• build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @​dependabot[bot] in #​4597
• fix: cacheStores types and usage in README by @​lucalooz in #​4605
• Feat dns interceptor storage by @​SuperOleg39 in #​4589
• docs: add crawling best practices by @​Uzlopak in #​4590
• fix: 304 not modified reply upon revalidation did not update cache. by @​daan944 in #​4617
• chore: use testcontext for test:infra by @​Uzlopak in #​4579
• fetch: improve regexes in data-uri.js by @​Uzlopak in #​4483
• perf: optimize validate http token by @​PandaWorker in #​4608
• test: improve long-lived-abort-controller test by @​Uzlopak in #​4621
• ci: add node.js 25 to test matrix by @​shivarm in #​4626
• chore: use testcontext for test/utils tests by @​Uzlopak in #​4577
• chore: remove tspl from websocket by @​Uzlopak in #​4568
• fix(ws) onSocketClose being called multiple times by @​KhafraDev in #​4632
• fix: prevent duplicate debug logs when multiple undici instances exist by @​mcollina in #​4630
• chore: use testcontext for busboy tests by @​Uzlopak in #​4572
• test: fix flaky http2-dispatcher test by @​mcollina in #​4633
• build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @​dependabot[bot] in #​4635
• Run the gc() in long-lived-abort-controller test by @​mcollina in #​4638
• Do not destroy the HTTP2 stream twice in tests by @​mcollina in #​4637
• Fix http2-dispatcher test by @​mcollina in #​4640
• fix: fetch blob with range off-by-one error by @​platypii in #​4643
• fix: ensure HTTP/2 sends Content-Length for empty POST requests by @​mcollina in #​4613
• build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @​dependabot[bot] in #​4645
• feat(#​2458): WebSocket through HTTP/2 by @​metcoder95 in #​4540
• docs(README): correct the example code for the consumption of respons… by @​tenkirin in #​4658
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @​dependabot[bot] in #​4653
• build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @​dependabot[bot] in #​4655
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​4652
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @​dependabot[bot] in #​4651
• build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @​dependabot[bot] in #​4654
• don't freeze urlList for opaque filtered responses by @​KhafraDev in #​4656
• fix fd parsing unquoted attribute values by @​KhafraDev in #​4662
• build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @​dependabot[bot] in #​4665
• feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @​SuperOleg39 in #​4659
• Feat/round robin pool by @​FelixVaughan in #​4650
• Formdata ignore epilogue preamble by @​KhafraDev in #​4672
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in #​4682
• fix: snapshot url exclusion by @​FelixVaughan in #​4670
• feat: support h2c over unix domain sockets by @​chrros95 in #​4690
• fix(docs): remove unused TypeScript example code block by @​kerolloz in #​4701
• feat: add deduplicate interceptor for request deduplication by @​mcollina in #​4679
• chore: use testcontext for mock tests by @​Uzlopak in #​4582
• fix(test): remove hardcoded folder name in client-error-stack-trace test by @​mcollina in #​4707

New Contributors

• @​gineika made their first contribution in #​4591
• @​lucalooz made their first contribution in #​4605
• @​SuperOleg39 made their first contribution in #​4589
• @​daan944 made their first contribution in #​4617
• @​PandaWorker made their first contribution in #​4608
• @​platypii made their first contribution in #​4643
• @​tenkirin made their first contribution in #​4658
• @​kerolloz made their first contribution in #​4701

Full Changelog: nodejs/undici@v7.16.0...v7.17.0

v7.16.0

Compare Source

What's Changed

• Drop npm token, use OIDC instead by @​mcollina in #​4447
• fetch: instantiate readableStream in extractBody with sync methods by @​Uzlopak in #​4350
• fix: remove async on [kClose] and [kDestroy], only return Promise by @​Uzlopak in #​4450
• fetch: make consumeBody sync by @​Uzlopak in #​4449
• perf: make client.connect() sync by @​Uzlopak in #​4455
• fetch: remove promise in exported fetch by @​Uzlopak in #​4452
• fix(#​4451): implement http2 cookie support by @​metcoder95 in #​4453
• test: cache store tests should properly be skipped by @​Uzlopak in #​4463
• test: fix IPv6 skip check for test/client.js by @​Uzlopak in #​4466
• test: remove skip check for AbortSignal.timeout, as it exists since node18 by @​Uzlopak in #​4464
• test: investigate macos failing by @​Uzlopak in #​4467
• test: remove obsolete < node v18 test case for http2 by @​Uzlopak in #​4461
• perf: avoid intermediate promise on BodyReadable.dump by @​Uzlopak in #​4459
• test: remove skip check for long-lived-abort-controller test (was flaky 10 months ago) by @​Uzlopak in #​4465
• test: remove skip checks for existance of global available Blob and File by @​Uzlopak in #​4460
• perf (fetch): use less promises for ReadableStream by @​Uzlopak in #​4457
• fix: catch synchronous errors in request callbacks by @​mcollina in #​4443
• fix: avoid instanceof MockNotMatchedError by @​Uzlopak in #​4474
• eventsource: remove promise for #reconnect method by @​Uzlopak in #​4469
• feat: make UndiciErrors reliable to instanceof by @​Uzlopak in #​4472
• chore: call super() after type checks by @​Uzlopak in #​4475
• chore: FixedQueue does not need special constructor by @​Uzlopak in #​4476
• fix: buildAndValidateMockOptions should always get an object passed and always return an object by @​Uzlopak in #​4479
• fix: remove unused ResponseStatusCodeError by @​Uzlopak in #​4473
• chore: pool and dispatcherbase dont need constructor, use no array helper functions by @​Uzlopak in #​4477
• lint: avoid unintented use of globals in code and tests, improve test for installing/overwriting globals by @​Uzlopak in #​4478
• test: fix macos flakyness by @​Uzlopak in #​4468
• fix: 'no-referrer-when-downgrade' in determineRequestsReferrer should return referrerURL by @​Uzlopak in #​4482
• fix: deflake cache-fastimers-fix.js by @​Uzlopak in #​4491
• fix: improve validation of IP addresses as trustworthy, correct ipv4 check by @​Uzlopak in #​4489
• test (pool.js): fix flakyness of clientTtl test by @​Uzlopak in #​4494
• test (eventsource): refactor tests for eventsource, speed them up by @​Uzlopak in #​4493
• fix: remove useless catch in client-h1.js by @​Uzlopak in #​4481
• test: skip flaky encoding test on macos and node20 by @​Uzlopak in #​4497
• fix: implement proper stale-while-revalidate behavior per RFC 5861 by @​mcollina in #​4492
• test (websocket): speed up test/websocket/issue-2679.js by @​Uzlopak in #​4501
• webidl: fix existing and add missing buffer source converters by @​Renegade334 in #​4503
• use real wpt test server by @​KhafraDev in #​4486
• test: another try to fix flaky macos and node 20 by @​Uzlopak in #​4490
• build(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​4507
• build(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.3 by @​dependabot[bot] in #​4509
• fix writing to websocketstream with SharedArrayBuffer/SharedArrayBuff… by @​KhafraDev in #​4504
• test: use faketimers for test/client-keep-alive, refactor a little by @​Uzlopak in #​4499
• build(deps): bump github/codeql-action from 3.29.7 to 3.30.0 by @​dependabot[bot] in #​4510
• build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @​dependabot[bot] in #​4508
• fix(h2): adjust :scheme on h2 requests by @​metcoder95 in #​4454
• chore: use lowercase filenames, remove unused verifyVersion.js by @​Uzlopak in #​4514
• chore: refactor workflows by @​Uzlopak in #​4513
• chore: use [] instead of new Array(0) by @​Uzlopak in #​4435
• change webidl attribute to bitwise flag by @​KhafraDev in #​4505
• chore: make also cache-tests integrated as a submodule by @​Uzlopak in #​4517
• ci: fine grained test nodejs workflow by @​Uzlopak in #​4516
• feat: Support for capping the number of origins in Agent by @​JoshMock in #​4365
• wpt: properly handle write permissions errors in wpt-runner setup by @​Uzlopak in #​4518
• fetch: process content-encoding header only if relevant by @​Uzlopak in #​4496
• websocket: always emit error event by @​KhafraDev in #​4521
• refactor: parseHttpDate by @​Uzlopak in #​4421
• fix: wpt should use master branch by @​Uzlopak in #​4524
• fix: shell command built from environment values by @​ptrgits in #​4392
• example: use metcoders https-pem for the example by @​Uzlopak in #​4436
• Disable SIMD for PPC64 architecture, add UNDICI_NO_WASM_SIMD env to facilitate testing by @​mcollina in #​4530
• fix: make error symbols non enumerable by @​Uzlopak in #​4531

New Contributors

• @​Renegade334 made their first contribution in #​4503
• @​JoshMock made their first contribution in #​4365
• @​ptrgits made their first contribution in #​4392

Full Changelog: nodejs/undici@v7.15.0...v7.16.0

v7.15.0

Compare Source

What's Changed

• feat: extract sri from fetch, upgrade to latest spec by @​Uzlopak in #​4307
• Update WPT by @​github-actions[bot] in #​4422
• build(deps-dev): bump @​fastify/busboy from 3.1.1 to 3.2.0 by @​dependabot[bot] in #​4428
• fix: memory leak in Agent by @​hexchain in #​4425
• chore: remove lib/api/util.js by @​Uzlopak in #​3578
• ci: reenable shared builtin CI tests by @​richardlau in #​4426
• Decompression Interceptor by @​FelixVaughan in #​4317
• chore: update llhttp by @​Uzlopak in #​4431
• chore: remove unused exceptions in try catch blocks by @​Uzlopak in #​4440
• types: remove type Error = unknown for diagnostic-channels by @​Uzlopak in #​4438
• chore: avoid overriding global escape and unescape by @​Uzlopak in #​4437
• cache : serialize Query only if needed, avoid throwing error by @​Uzlopak in #​4441
• types: add SnapshotRecorderMode by @​Uzlopak in #​4442

New Contributors

• @​hexchain made their first contribution in #​4425

Full Changelog: nodejs/undici@v7.14.0...v7.15.0

v7.14.0

Compare Source

What's Changed

• Fix flaky snapshot-testing by @​mcollina in #​4367
• Actually flush the file in lib/mock/snapshot-recorder.js by @​mcollina in #​4378
• docs: clarify Node.js version support in LTS table by @​mcollina in #​4375
• cache: fix excessive caching and some other lack of caching by @​fredericDelaporte in #​4335
• feat(websocket): add handshake response info to undici:websocket:open diagnostic event by @​tawseefnabi in #​4396
• feat: add install() function to type definitions by @​jsaguet in #​4384
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @​dependabot[bot] in #​4380
• build(deps): bump cronometro from 4.0.3 to 5.3.0 in /benchmarks by @​dependabot[bot] in #​4171
• build(deps): bump step-security/harden-runner from 2.12.0 to 2.13.0 by @​dependabot[bot] in #​4379
• fix: h2 CI by @​metcoder95 in #​4395
• feat: EventSource can be configured with reconnectionTime by @​Uzlopak in #​4260
• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in #​4404
• eventsource: deflake reconnectionTime tests by @​Uzlopak in #​4406
• cache: change normaliseHeaders to normalizeHeaders by @​Uzlopak in #​4408
• build(deps-dev): bump jest from 29.7.0 to 30.0.5 by @​dependabot[bot] in #​4387
• build(deps-dev): bump cross-env from 7.0.3 to 10.0.0 by @​dependabot[bot] in #​4386
• cache-control: no-cache: use quoted-string form by @​alxndrsn in #​4177
• test: fix snapshot testing flaky test by @​Uzlopak in #​4410
• fix formdata constructor args mark optional by @​tsctx in #​4411
• Update WPT by @​github-actions[bot] in #​4358
• Update Cache Tests by @​github-actions[bot] in #​4096
• chore: improve imports and requires by @​Uzlopak in #​4418
• refactor: snapshot-recorder by @​Uzlopak in #​4413
• Update WPT by @​github-actions[bot] in #​4416
• fix: better set a finalizer on cloned response by @​tsctx in #​4419

New Contributors

• @​tawseefnabi made their first contribution in #​4396
• @​jsaguet made their first contribution in #​4384

Full Changelog: nodejs/undici@v7.13.0...v7.14.0

v7.13.0

Compare Source

What's Changed

• MockAgent.prototype.get support ignoreTrailingSlash option by @​lisez in #​4344
• chore: more jsdoc and minor improvements for lib/api/readable.js, by @​Uzlopak in #​4351
• ci: skip Node.js 20 tests on Windows by @​mcollina in #​4353
• Update WPT by @​github-actions[bot] in #​4267
• feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#​4180) by @​caitp in #​4340
• fix: detect and prevent redirect loops with Client/Pool by @​mcollina in #​4361
• remove node:buffer imports by @​KhafraDev in #​4362
• fix: remove deprecated maxRedirections option from types by @​mcollina in #​4363
• Amend the GC warning in the README to clarify that consuming bodies is recommended but not required by @​mcollina in #​4364
• fix(inteceptor/dump): handle preemptive network errors by @​metcoder95 in #​4354
• feat: add SnapshotAgent for HTTP request recording and playback by @​mcollina in #​4270

New Contributors

• @​lisez made their first contribution in #​4344

Full Changelog: nodejs/undici@v7.12.0...v7.13.0

v7.12.0

Compare Source

What's Changed

• test: remove tspl on 2283 test by @​Uzlopak in #​4301
• chore: reduce amount of intermediate functions by @​Uzlopak in #​4298
• ci: disable shared builtin CI tests by [@​

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.