Skip to content

fix(deps): Update undici to 6.28.0 - #726

Merged
Zee2413 merged 2 commits into
aws-cloudformation:mainfrom
Zee2413:fix/undici-moderate-advisories
Aug 24, 2026
Merged

fix(deps): Update undici to 6.28.0#726
Zee2413 merged 2 commits into
aws-cloudformation:mainfrom
Zee2413:fix/undici-moderate-advisories

Conversation

@Zee2413

@Zee2413 Zee2413 commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • update the transitive Undici runtime dependency from 6.27.0 to 6.28.0
  • add a range-qualified override that replaces vulnerable Undici versions below 6.28.0
  • resolve CVE-2026-16728, CVE-2026-15157, and CVE-2026-16729
  • rebuild the checked-in action bundle with the patched dependency

Security verification

  • all three affected Dependabot findings resolve outside the vulnerable <6.28.0 range
  • the package override preserves the minimum safe version if the lockfile is regenerated
  • npm audit --audit-level=moderate reports zero vulnerabilities

Validation

  • npm ci resolves the override, lockfile, and installed package to 6.28.0
  • formatting and lint checks pass
  • all 20 action tests pass
  • action bundle builds and the CI bundle comparison passes

Zee2413 added 2 commits August 24, 2026 12:45
@Zee2413
fix(deps): Update undici to 6.28.0
c97e0ea 
Resolve three moderate-severity advisories by updating the transitive runtime dependency and rebuilding the action bundle.
@Zee2413
fix(deps): Enforce patched undici version
14a1e02 
Add a range-qualified override so regenerated lockfiles cannot resolve an Undici release affected by the three moderate-severity advisories.
@Zee2413
Zee2413 merged commit fcc079f into aws-cloudformation:main Aug 24, 2026
16 checks passed
social4hyq pushed a commit to social4hyq/homebrew-core that referenced this pull request Sep 20, 2026
HarmonybrewBot HarmonybrewBot
!17668 merge bump-cloudformation-guard-3.2.1 into main
05f06a7 
cloudformation-guard 3.2.1

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre><!-- Release notes generated using configuration in .github/release.yml at 3.2.1 -->

## What's Changed
* Use remote check for tag and force-with-lease for branch to allow rel… by @Zee2413 in aws-cloudformation/cloudformation-guard#675
* Fetch before pushing release branch by @Zee2413 in aws-cloudformation/cloudformation-guard#676
* Remove homebrew step and skip scratch compilation during cargo publish by @Zee2413 in aws-cloudformation/cloudformation-guard#678
* Prevent cargo publish errors from being swallowed as already published by @Zee2413 in aws-cloudformation/cloudformation-guard#680
* fix: exclude bot authors from release notes and prevent duplication o… by @Zee2413 in aws-cloudformation/cloudformation-guard#682
* fix: bump form-data to 4.0.5 to resolve CVE-2025-7783 (Dependabot #46) by @Zee2413 in aws-cloudformation/cloudformation-guard#685
* fix: resolve npm audit vulnerabilities in action/ and replace dead gitpkg dependency by @Zee2413 in aws-cloudformation/cloudformation-guard#691
* fix: resolve 9 npm audit vulnerabilities in guard/ dev dependencies by @Zee2413 in aws-cloudformation/cloudformation-guard#690
* fix: add explicit permissions to all GitHub Actions workflows by @Zee2413 in aws-cloudformation/cloudformation-guard#693
* fix: upgrade @actions/github to 8.0.1 and @actions/core to 2.0.3 to resolve undici CVEs by @Zee2413 in aws-cloudformation/cloudformation-guard#695
* fix: bump bytes crate to 1.11.1 to resolve CVE-2026-25541 by @Zee2413 in aws-cloudformation/cloudformation-guard#694
* chore: automate ATTRIBUTION generation with cargo-about by @Zee2413 in aws-cloudformation/cloudformation-guard#697
* chore(deps): Fix high severity npm audit findings in /action and /guard by @Zee2413 in aws-cloudformation/cloudformation-guard#711
* Fix evaluator and reporter defects where a rule reported compliance, or nothing at all, for input it should have rejected by @awsmadi in aws-cloudformation/cloudformation-guard#717
* fix(deps): Patch high-severity advisories by @Zee2413 in aws-cloudformation/cloudformation-guard#724
* fix(deps): Update undici to 6.28.0 by @Zee2413 in aws-cloudformation/cloudformation-guard#726

## New Contributors
* @github-actions[bot] made their first contribution in aws-cloudformation/cloudformation-guard#681
* @awsmadi made their first contribution in aws-cloudformation/cloudformation-guard#717

**Full Changelog**: https://github.com/aws-cloudformation/cloudformation-guard/compare/3.2.0...3.2.1</pre>
  <p>View the full release notes at <a href="https://github.com/aws-cloudformation/cloudformation-guard/releases/tag/3.2.1">https://github.com/aws-cloudformation/cloudformation-guard/releases/tag/3.2.1</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!17668
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@atennak1 atennak1 atennak1 approved these changes
@satyakigh satyakigh satyakigh approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Zee2413 @atennak1 @satyakigh