Bump undici from 7.24.8 to 7.28.0 in the npm_and_yarn group across 1 directory by dependabot[bot] · Pull Request #61 · LCSOGthb/Games

dependabot · 2026-06-20T09:56:18Z

Bumps the npm_and_yarn group with 1 update in the / directory: undici.

Updates undici from 7.24.8 to 7.28.0

Release notes

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

f9eba0a Bumped v7.28.0 (#5430)
a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
8cb10f9 websocket: limit the number of fragments in a message
04201f8 fix: honor requestTls when proxy is SOCKS5
fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
85a2405 fix(cache): trim qualified field names
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Upgrade undici to 7.28.0 to patch multiple security advisories and harden WebSocket and SOCKS5 proxy handling. Also updates Cloudflare dev tooling for compatibility.

Dependencies
- undici 7.24.8 → 7.28.0 — security fixes (WebSocket fragment DoS, SOCKS5 TLS validation, per-origin pools).
- wrangler ^4.103.0 — updates bring workerd 1.20260617.1, miniflare 4.20260617.1, esbuild 0.28.1, ws 8.21.0; lockfile refreshed.

^{Written for commit dc0d51c. Summary will update on new commits.}

Bumps the npm_and_yarn group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 7.24.8 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.8...v7.28.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cr-gpt · 2026-06-20T09:56:22Z

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

semanticdiff-com · 2026-06-20T09:56:22Z

Review changes with

Changed Files

File	Status
package-lock.json	68% smaller
package.json	0% smaller

vercel · 2026-06-20T09:56:22Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
games	Ready	Preview, Comment	Jun 20, 2026 9:56am

netlify · 2026-06-20T09:56:23Z

✅ Deploy Preview for lsngames ready!

Name	Link
🔨 Latest commit	`dc0d51c`
🔍 Latest deploy log	https://app.netlify.com/projects/lsngames/deploys/6a3663c51ffae40008c99a10
😎 Deploy Preview	https://deploy-preview-61--lsngames.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codeant-ai · 2026-06-20T09:56:24Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

difflens · 2026-06-20T09:56:26Z

View changes in DiffLens

difflens · 2026-06-20T09:56:32Z

View changes in DiffLens

what-the-diff · 2026-06-20T09:56:33Z

PR Summary

Upgraded dependency
The version of the 'wrangler' dependency has been updated. This update might lead to performance improvements, enhanced reliability, and the potential unlocking of additional features for our project.

socket-security · 2026-06-20T09:56:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	wrangler@4.100.0 ⏵ 4.103.0	⁺¹			⁺¹

View full report

difflens · 2026-06-20T09:56:50Z

View changes in DiffLens

deepsource-io · 2026-06-20T09:56:56Z

DeepSource Code Review

We reviewed changes in d7d2ec8...dc0d51c on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
JavaScript	Jun 20, 2026 9:56a.m.	Review ↗
Python	Jun 20, 2026 9:56a.m.	Review ↗
Rust	Jun 20, 2026 9:56a.m.	Review ↗
Secrets	Jun 20, 2026 9:56a.m.	Review ↗
Ruby	Jun 20, 2026 9:56a.m.	Review ↗
Shell	Jun 20, 2026 9:56a.m.	Review ↗
Scala	Jun 20, 2026 9:56a.m.	Review ↗
SQL	Jun 20, 2026 9:56a.m.	Review ↗
Terraform	Jun 20, 2026 9:56a.m.	Review ↗
Code coverage	Jun 20, 2026 9:56a.m.	Review ↗
Swift	Jun 20, 2026 9:56a.m.	Review ↗
C & C++	Jun 20, 2026 9:56a.m.	Review ↗
C#	Jun 20, 2026 9:56a.m.	Review ↗
Ansible	Jun 20, 2026 9:56a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

llamapreview

Auto Pull Request Review from LlamaPReview

Review Status: Automated Review Skipped

Dear contributor,

Thank you for your Pull Request. LlamaPReview has analyzed your changes and determined that this PR does not require an automated code review.

Analysis Result:

PR contains only dependency version bumps (undici and wrangler) and lockfile updates, with no substantive code changes or security-sensitive modifications requiring review.

We're continuously improving our PR analysis capabilities. Have thoughts on when and how LlamaPReview should perform automated reviews? Share your insights in our GitHub Discussions.

Best regards,
LlamaPReview Team

codescene-delta-analysis

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Customizable Safeguards
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

codspeed-hq · 2026-06-20T09:57:39Z

Merging this PR will not alter performance

✅ 13 untouched benchmarks

_{Comparing dependabot/npm_and_yarn/npm_and_yarn-3213b4e331 (dc0d51c) with main (d7d2ec8)}

codacy-production · 2026-06-20T09:59:25Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

kilo-code-bot · 2026-06-20T10:00:07Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This is a Dependabot security update for undici (via wrangler dependency) addressing 7 security advisories including WebSocket DoS vulnerabilities and TLS certificate validation bypasses. The changes are limited to version bumps in package.json and lock file updates in package-lock.json.

Per review guidelines, lock files are generated files and were not reviewed in detail.

Files Reviewed (1 file)

package.json - No issues (dependency version bump for wrangler: ^4.95.0 → ^4.103.0)

_{Reviewed by laguna-m.1-20260312:free · Input: 269K · Output: 2.2K · Cached: 78.5K}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 20, 2026

pull-request-size Bot added the size/XS label Jun 20, 2026

vercel Bot deployed to Preview June 20, 2026 09:56 View deployment

llamapreview Bot reviewed Jun 20, 2026

View reviewed changes

codescene-delta-analysis Bot approved these changes Jun 20, 2026

View reviewed changes

devin-ai-integration Bot reviewed Jun 20, 2026

View reviewed changes

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

Conversation

dependabot Bot commented on behalf of github Jun 20, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.28.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

Summary by cubic

Uh oh!

cr-gpt Bot commented Jun 20, 2026

Uh oh!

semanticdiff-com Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for lsngames ready!

Uh oh!

codeant-ai Bot commented Jun 20, 2026

Uh oh!

difflens Bot commented Jun 20, 2026

Uh oh!

difflens Bot commented Jun 20, 2026

Uh oh!

what-the-diff Bot commented Jun 20, 2026

PR Summary

Uh oh!

socket-security Bot commented Jun 20, 2026

Uh oh!

difflens Bot commented Jun 20, 2026

Uh oh!

deepsource-io Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

llamapreview Bot left a comment

Choose a reason for hiding this comment

Auto Pull Request Review from LlamaPReview

Review Status: Automated Review Skipped

Analysis Result:

Uh oh!

codescene-delta-analysis Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

codspeed-hq Bot commented Jun 20, 2026

Merging this PR will not alter performance

Uh oh!

codacy-production Bot commented Jun 20, 2026

Up to standards ✅

Uh oh!

kilo-code-bot Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 20, 2026 •

edited by cubic-dev-ai Bot

Loading

semanticdiff-com Bot commented Jun 20, 2026 •

edited

Loading

vercel Bot commented Jun 20, 2026 •

edited

Loading

netlify Bot commented Jun 20, 2026 •

edited

Loading

deepsource-io Bot commented Jun 20, 2026 •

edited

Loading

kilo-code-bot Bot commented Jun 20, 2026 •

edited

Loading