nodejs/undici (undici)

\n\n### [`v8.10.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.10.0)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.9.0...v8.10.0)\n\n#### What's Changed\n\n- feat: namespace h2 options by [@metcoder95](https://redirect.github.com/metcoder95) in [#5498](https://redirect.github.com/nodejs/undici/pull/5498)\n- test: update WPT expectations by [@mcollina](https://redirect.github.com/mcollina) in [#5587](https://redirect.github.com/nodejs/undici/pull/5587)\n- test: add cache/dedupe + dns re-dispatch integration tests by [@GiHoon1123](https://redirect.github.com/GiHoon1123) in [#5535](https://redirect.github.com/nodejs/undici/pull/5535)\n- fix(websocket): support process.unref by [@mcollina](https://redirect.github.com/mcollina) in [#5578](https://redirect.github.com/nodejs/undici/pull/5578)\n- fix(h2): ensure every request settles by [@mcollina](https://redirect.github.com/mcollina) in [#5603](https://redirect.github.com/nodejs/undici/pull/5603)\n- fix(readable): consume a body whose end has already been emitted by [@marko1olo](https://redirect.github.com/marko1olo) in [#5617](https://redirect.github.com/nodejs/undici/pull/5617)\n- fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by [@marko1olo](https://redirect.github.com/marko1olo) in [#5610](https://redirect.github.com/nodejs/undici/pull/5610)\n- fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by [@marceli1404](https://redirect.github.com/marceli1404) in [#5606](https://redirect.github.com/nodejs/undici/pull/5606)\n- fix(env-http-proxy-agent): match bare IPv6 addresses in no\\_proxy by [@marko1olo](https://redirect.github.com/marko1olo) in [#5623](https://redirect.github.com/nodejs/undici/pull/5623)\n- test: handle aggregate balanced pool errors by [@marko1olo](https://redirect.github.com/marko1olo) in [#5377](https://redirect.github.com/nodejs/undici/pull/5377)\n- fix(readable): keep body bytes that arrive after setEncoding() by [@mcollina](https://redirect.github.com/mcollina) in [#5620](https://redirect.github.com/nodejs/undici/pull/5620)\n- fix(socks5): evict unused origin pools by [@Kkartik14](https://redirect.github.com/Kkartik14) in [#5595](https://redirect.github.com/nodejs/undici/pull/5595)\n- fix: skip deduplication for upgrade requests by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5593](https://redirect.github.com/nodejs/undici/pull/5593)\n- fix(retry): forward informational responses by [@mcollina](https://redirect.github.com/mcollina) in [#5625](https://redirect.github.com/nodejs/undici/pull/5625)\n- fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by [@marko1olo](https://redirect.github.com/marko1olo) in [#5619](https://redirect.github.com/nodejs/undici/pull/5619)\n- fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by [@marko1olo](https://redirect.github.com/marko1olo) in [#5628](https://redirect.github.com/nodejs/undici/pull/5628)\n- build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5633](https://redirect.github.com/nodejs/undici/pull/5633)\n- build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5634](https://redirect.github.com/nodejs/undici/pull/5634)\n- build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5636](https://redirect.github.com/nodejs/undici/pull/5636)\n- fix(mock): emit request body lifecycle hooks by [@marko1olo](https://redirect.github.com/marko1olo) in [#5367](https://redirect.github.com/nodejs/undici/pull/5367)\n- fix(h2): detach upgrade close handler after GOAWAY by [@pacocartones](https://redirect.github.com/pacocartones) in [#5641](https://redirect.github.com/nodejs/undici/pull/5641)\n- fix: retry refused HTTP/2 streams by [@mcollina](https://redirect.github.com/mcollina) in [#5598](https://redirect.github.com/nodejs/undici/pull/5598)\n- fix: preserve DNS origin hostname on sockets by [@cyphercodes](https://redirect.github.com/cyphercodes) in [#5577](https://redirect.github.com/nodejs/undici/pull/5577)\n\n#### New Contributors\n\n- [@marceli1404](https://redirect.github.com/marceli1404) made their first contribution in [#5606](https://redirect.github.com/nodejs/undici/pull/5606)\n- [@Kkartik14](https://redirect.github.com/Kkartik14) made their first contribution in [#5595](https://redirect.github.com/nodejs/undici/pull/5595)\n- [@pacocartones](https://redirect.github.com/pacocartones) made their first contribution in [#5641](https://redirect.github.com/nodejs/undici/pull/5641)\n- [@cyphercodes](https://redirect.github.com/cyphercodes) made their first contribution in [#5577](https://redirect.github.com/nodejs/undici/pull/5577)\n\n**Full Changelog**: \n\n### [`v8.9.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.9.0)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.8.0...v8.9.0)\n\n#### What's Changed\n\n- fix(decompress): preserve response trailers by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5572](https://redirect.github.com/nodejs/undici/pull/5572)\n- build(deps-dev): bump ws from 8.21.0 to 8.21.1 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5576](https://redirect.github.com/nodejs/undici/pull/5576)\n- fix: validate coerced header values for CRLF by [@mcollina](https://redirect.github.com/mcollina) in [#5579](https://redirect.github.com/nodejs/undici/pull/5579)\n- fix: handle frozen globalThis in setGlobalDispatcher by [@mhayk](https://redirect.github.com/mhayk) in [#5574](https://redirect.github.com/nodejs/undici/pull/5574)\n- Ignore auto-generated .npmrc on Windows by [@tsctx](https://redirect.github.com/tsctx) in [#5583](https://redirect.github.com/nodejs/undici/pull/5583)\n\n#### New Contributors\n\n- [@mhayk](https://redirect.github.com/mhayk) made their first contribution in [#5574](https://redirect.github.com/nodejs/undici/pull/5574)\n\n**Full Changelog**: \n\n### [`v8.8.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.8.0)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.7.0...v8.8.0)\n\n#### What's Changed\n\n- fetch: use ReadableStreamTee for cloning streams by [@KhafraDev](https://redirect.github.com/KhafraDev) in [#5517](https://redirect.github.com/nodejs/undici/pull/5517)\n- fix(benchmarks): adjust got after v15 upgrade by [@slagiewka](https://redirect.github.com/slagiewka) in [#5526](https://redirect.github.com/nodejs/undici/pull/5526)\n- feat(mock): support asynchronous reply options callbacks by [@Develop-KIM](https://redirect.github.com/Develop-KIM) in [#5534](https://redirect.github.com/nodejs/undici/pull/5534)\n- docs: clarify proxy threat model by [@mcollina](https://redirect.github.com/mcollina) in [#5530](https://redirect.github.com/nodejs/undici/pull/5530)\n- docs: clarify MockAgent pool usage by [@vibhor-aggr](https://redirect.github.com/vibhor-aggr) in [#5542](https://redirect.github.com/nodejs/undici/pull/5542)\n- docs: clarify parser timeout precision by [@vibhor-aggr](https://redirect.github.com/vibhor-aggr) in [#5543](https://redirect.github.com/nodejs/undici/pull/5543)\n- fix: handle flat alternating header arrays in cache normalizeHeaders by [@mcollina](https://redirect.github.com/mcollina) in [#5536](https://redirect.github.com/nodejs/undici/pull/5536)\n- chore(benchmarks): require(esm) on ESM-only packages by [@slagiewka](https://redirect.github.com/slagiewka) in [#5527](https://redirect.github.com/nodejs/undici/pull/5527)\n- fix: run idle socket validation off setImmediate instead of setTimeout by [@carlotestor](https://redirect.github.com/carlotestor) in [#5499](https://redirect.github.com/nodejs/undici/pull/5499)\n- docs: add custom interceptor example by [@vibhor-aggr](https://redirect.github.com/vibhor-aggr) in [#5548](https://redirect.github.com/nodejs/undici/pull/5548)\n- fix(h1): ignore type of service errors by [@mcollina](https://redirect.github.com/mcollina) in [#5547](https://redirect.github.com/nodejs/undici/pull/5547)\n- fix(fetch): convert null init in Response.json by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5540](https://redirect.github.com/nodejs/undici/pull/5540)\n- fix(redirect): remove body headers after POST-to-GET by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5551](https://redirect.github.com/nodejs/undici/pull/5551)\n- build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5556](https://redirect.github.com/nodejs/undici/pull/5556)\n- fix(h2): allow stream-bodied requests to multiplex on a busy session by [@GiHoon1123](https://redirect.github.com/GiHoon1123) in [#5538](https://redirect.github.com/nodejs/undici/pull/5538)\n- fix(h2): destroy aborted stream synchronously instead of via setImmediate by [@staylor](https://redirect.github.com/staylor) in [#5559](https://redirect.github.com/nodejs/undici/pull/5559)\n- fix(decompress): skip HEAD responses by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5564](https://redirect.github.com/nodejs/undici/pull/5564)\n- ci: build undici with node.js v26 by [@shivarm](https://redirect.github.com/shivarm) in [#5237](https://redirect.github.com/nodejs/undici/pull/5237)\n- docs: clarify top-level request option url fields by [@vibhor-aggr](https://redirect.github.com/vibhor-aggr) in [#5545](https://redirect.github.com/nodejs/undici/pull/5545)\n- test: add unexpected disconnect guards to http2 tests by [@Develop-KIM](https://redirect.github.com/Develop-KIM) in [#5533](https://redirect.github.com/nodejs/undici/pull/5533)\n- fix: track origins by client map key in Agent teardown by [@emmayusufu](https://redirect.github.com/emmayusufu) in [#5537](https://redirect.github.com/nodejs/undici/pull/5537)\n- fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error by [@jeswr](https://redirect.github.com/jeswr) in [#5511](https://redirect.github.com/nodejs/undici/pull/5511)\n- fix(retry): handle Retry-After zero delay by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5519](https://redirect.github.com/nodejs/undici/pull/5519)\n- fix: honor stale-if-error on connection errors during revalidation by [@jeswr](https://redirect.github.com/jeswr) in [#5513](https://redirect.github.com/nodejs/undici/pull/5513)\n- fix: store revalidation-only responses so etag revalidation can engage by [@jeswr](https://redirect.github.com/jeswr) in [#5515](https://redirect.github.com/nodejs/undici/pull/5515)\n- fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefined kClient by [@mcollina](https://redirect.github.com/mcollina) in [#5546](https://redirect.github.com/nodejs/undici/pull/5546)\n- fix(h2): complete request stream on 'end' instead of waiting for 'close' by [@staylor](https://redirect.github.com/staylor) in [#5560](https://redirect.github.com/nodejs/undici/pull/5560)\n- fix: invalidate Location and Content-Location URIs on unsafe methods by [@jeswr](https://redirect.github.com/jeswr) in [#5514](https://redirect.github.com/nodejs/undici/pull/5514)\n- test: deflake invalid websocket close status test by [@mcollina](https://redirect.github.com/mcollina) in [#5550](https://redirect.github.com/nodejs/undici/pull/5550)\n- refactor: replace tspl with node:test t.plan in connect-timeout tests by [@mcollina](https://redirect.github.com/mcollina) in [#5518](https://redirect.github.com/nodejs/undici/pull/5518)\n- fix(h2): release completed requests from queue by [@staylor](https://redirect.github.com/staylor) in [#5569](https://redirect.github.com/nodejs/undici/pull/5569)\n\n#### New Contributors\n\n- [@Develop-KIM](https://redirect.github.com/Develop-KIM) made their first contribution in [#5534](https://redirect.github.com/nodejs/undici/pull/5534)\n- [@carlotestor](https://redirect.github.com/carlotestor) made their first contribution in [#5499](https://redirect.github.com/nodejs/undici/pull/5499)\n- [@GiHoon1123](https://redirect.github.com/GiHoon1123) made their first contribution in [#5538](https://redirect.github.com/nodejs/undici/pull/5538)\n- [@emmayusufu](https://redirect.github.com/emmayusufu) made their first contribution in [#5537](https://redirect.github.com/nodejs/undici/pull/5537)\n\n**Full Changelog**: \n\n### [`v8.7.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.7.0)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.6.0...v8.7.0)\n\n##### What's Changed\n\n- test: guard balanced-pool error port lookup by [@mcollina](https://redirect.github.com/mcollina) in [#5463](https://redirect.github.com/nodejs/undici/pull/5463)\n- perf: optimize http/2 request hot path by [@mcollina](https://redirect.github.com/mcollina) in [#5483](https://redirect.github.com/nodejs/undici/pull/5483)\n- fix: do not reject open-ended Range values in simpleRangeHeaderValue by [@spokodev](https://redirect.github.com/spokodev) in [#5490](https://redirect.github.com/nodejs/undici/pull/5490)\n- fix(eventsource): set use-URL-credentials flag by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5489](https://redirect.github.com/nodejs/undici/pull/5489)\n- test: deflake connect-timeout watchdog by [@mcollina](https://redirect.github.com/mcollina) in [#5197](https://redirect.github.com/nodejs/undici/pull/5197)\n- docs: correct npm script name and JSON syntax in examples by [@lenoxfernando](https://redirect.github.com/lenoxfernando) in [#5496](https://redirect.github.com/nodejs/undici/pull/5496)\n- fix: reject non-ascii octets in validateCookiePath by [@spokodev](https://redirect.github.com/spokodev) in [#5452](https://redirect.github.com/nodejs/undici/pull/5452)\n- fix(readable): ignore late consume chunks by [@marko1olo](https://redirect.github.com/marko1olo) in [#5375](https://redirect.github.com/nodejs/undici/pull/5375)\n- fix(h2): destroy the stream on abort instead of relying on close() by [@staylor](https://redirect.github.com/staylor) in [#5462](https://redirect.github.com/nodejs/undici/pull/5462)\n- fix: ignore an unparseable Set-Cookie Expires attribute by [@spokodev](https://redirect.github.com/spokodev) in [#5488](https://redirect.github.com/nodejs/undici/pull/5488)\n- docs: add reproduction guide and update bug report template by [@mcollina](https://redirect.github.com/mcollina) in [#5451](https://redirect.github.com/nodejs/undici/pull/5451)\n- fix(h2): guard onResponse against a 'response' event delivered after completion by [@staylor](https://redirect.github.com/staylor) in [#5440](https://redirect.github.com/nodejs/undici/pull/5440)\n- fix(h2): requeue request on GOAWAY'd session instead of crashing by [@staylor](https://redirect.github.com/staylor) in [#5453](https://redirect.github.com/nodejs/undici/pull/5453)\n- fix: add static buildDispatch method to RedirectHandler type definition by [@matthieusieben](https://redirect.github.com/matthieusieben) in [#5442](https://redirect.github.com/nodejs/undici/pull/5442)\n- fix: auto-detect HTTP proxy tunneling by [@mcollina](https://redirect.github.com/mcollina) in [#5116](https://redirect.github.com/nodejs/undici/pull/5116)\n\n##### New Contributors\n\n- [@spokodev](https://redirect.github.com/spokodev) made their first contribution in [#5490](https://redirect.github.com/nodejs/undici/pull/5490)\n- [@lenoxfernando](https://redirect.github.com/lenoxfernando) made their first contribution in [#5496](https://redirect.github.com/nodejs/undici/pull/5496)\n- [@staylor](https://redirect.github.com/staylor) made their first contribution in [#5462](https://redirect.github.com/nodejs/undici/pull/5462)\n\n**Full Changelog**: \n\n### [`v8.6.0`](https://redirect.github.com/nodejs/undici/compare/v8.5.0...6f86196a0d4bbc8034c4e150a0aec4f6b2bf8742)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.5.0...v8.6.0)\n\n### [`v8.5.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.5.0)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.4.1...v8.5.0)\n\n### ⚠️ Security Release\n\nThis release line addresses **8 security advisories**. Most are fixed in\n**v8.5.0**; the SOCKS5 pool-reuse issue was fixed earlier in **v8.2.0**.\n\n> **Action required:** Upgrade to **undici 8.5.0** or later.\n>\n> ```sh\n> npm install undici@^8.5.0\n> ```\n\n#### Summary\n\n| Advisory | CVE | Severity (CVSS) | Fixed in | Fix commit |\n| ----------------------------------------------------------------------------------------------- | -------------- | --------------- | -------- | -------------------------------------------------------------- |\n| [GHSA-vxpw-j846-p89q](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q) | CVE-2026-12151 | High (7.5) | 8.5.0 | [`32dbf0b3`](https://redirect.github.com/nodejs/undici/commit/32dbf0b3) |\n| [GHSA-38rv-x7px-6hhq](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq) | CVE-2026-9675 | High (7.5) | 8.5.0 | [`b4c287b3`](https://redirect.github.com/nodejs/undici/commit/b4c287b3) |\n| [GHSA-vmh5-mc38-953g](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g) | CVE-2026-9697 | High (7.4) | 8.5.0 | [`42d49559`](https://redirect.github.com/nodejs/undici/commit/42d49559) |\n| [GHSA-hm92-r4w5-c3mj](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj) | CVE-2026-6734 | High (7.5) | 8.2.0 | [`a516f870`](https://redirect.github.com/nodejs/undici/commit/a516f870) |\n| [GHSA-pr7r-676h-xcf6](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6) | CVE-2026-9678 | Moderate (5.9) | 8.5.0 | [`cb105d7c`](https://redirect.github.com/nodejs/undici/commit/cb105d7c) |\n| [GHSA-p88m-4jfj-68fv](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv) | CVE-2026-9679 | Moderate (5.9) | 8.5.0 | [`5655ea43`](https://redirect.github.com/nodejs/undici/commit/5655ea43) |\n| [GHSA-g8m3-5g58-fq7m](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m) | CVE-2026-11525 | Low (3.7) | 8.5.0 | [`5655ea43`](https://redirect.github.com/nodejs/undici/commit/5655ea43) |\n| [GHSA-35p6-xmwp-9g52](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52) | CVE-2026-6733 | Low (3.7) | 8.5.0 | [`6ea54ef8`](https://redirect.github.com/nodejs/undici/commit/6ea54ef8) |\n\n***\n\n#### High severity\n\n##### WebSocket DoS via fragment count bypass — CVE-2026-12151\n\n**[GHSA-vxpw-j846-p89q](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q)** · CWE-400, CWE-770\n**Fix:** [`32dbf0b3`](https://redirect.github.com/nodejs/undici/commit/32dbf0b3) *websocket: limit the number of fragments in a message* (also [`c5ed7875`](https://redirect.github.com/nodejs/undici/commit/c5ed7875) *handle empty fragments and stream limits*)\n\nA malicious WebSocket server can stream a large number of small or empty\ncontinuation frames. Undici enforced a limit on cumulative payload size but did\nnot limit the *number* of fragments per message, leading to unbounded memory\ngrowth and denial of service.\n\n- **Affected:** applications using `new WebSocket(...)` or `WebSocketStream`\n against untrusted endpoints.\n- **Workaround:** none — upgrade is required.\n\n##### WebSocket DoS via cumulative fragment bypass — CVE-2026-9675\n\n**[GHSA-38rv-x7px-6hhq](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq)** · CWE-400, CWE-770\n**Fix:** [`b4c287b3`](https://redirect.github.com/nodejs/undici/commit/b4c287b3) *fix(websocket): enforce max payload size across fragments*\n\nUndici validated the size of individual frames but did not track cumulative size\nacross a fragmented message. An attacker could send many small fragments that\neach pass per-frame validation but collectively exceed the configured limit,\ncausing memory exhaustion. **This is a regression introduced in 8.1.0** (the\n6.x and 7.x lines are not affected).\n\n- **Workaround:** none — upgrade is required.\n\n##### TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697\n\n**[GHSA-vmh5-mc38-953g](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g)** · CWE-295\n**Fix:** [`42d49559`](https://redirect.github.com/nodejs/undici/commit/42d49559) *fix: honor requestTls when proxy is SOCKS5*\n\nThe `ProxyAgent` silently discarded the `requestTls` option when configured with\na SOCKS5 proxy. TLS connections through the SOCKS5 tunnel ignored user-configured\nparameters such as `ca`, `cert`, `key`, `rejectUnauthorized`, and `servername`,\nfalling back to the default Mozilla CA bundle. Applications relying on\ncertificate pinning to an internal CA were exposed to man-in-the-middle attacks.\n\n- **Affected:** `ProxyAgent` / `Socks5ProxyAgent` over SOCKS5 that rely on\n `requestTls`.\n- **Workaround:** route traffic through an HTTP-proxy `ProxyAgent`, where\n `requestTls` functions correctly.\n\n##### Cross-origin request routing via SOCKS5 proxy pool reuse — CVE-2026-6734\n\n**[GHSA-hm92-r4w5-c3mj](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj)** · CWE-346 · **Fixed in 8.2.0**\n**Fix:** [`a516f870`](https://redirect.github.com/nodejs/undici/commit/a516f870) *fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing* ([#5041](https://redirect.github.com/nodejs/undici/pull/5041))\n\n`Socks5ProxyAgent` reused a single connection pool across different origins\nwithout verifying the pool's origin matched the requested origin. This could\nroute credentials and request data to unintended destinations, cause responses\nfrom the wrong origin to be trusted, and enable HTTPS→HTTP downgrade.\n\n- **Affected:** applications using `Socks5ProxyAgent` across multiple origins\n (introduced via [#4385](https://redirect.github.com/nodejs/undici/pull/4385)).\n- **Workaround:** use a separate agent instance per origin.\n\n***\n\n#### Moderate severity\n\n##### Cross-user information disclosure via shared cache whitespace bypass — CVE-2026-9678\n\n**[GHSA-pr7r-676h-xcf6](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6)** · CWE-524\n**Fix:** [`cb105d7c`](https://redirect.github.com/nodejs/undici/commit/cb105d7c) *fix(cache): trim qualified field names*\n\nThe cache interceptor mishandled responses with whitespace-padded\n`Cache-Control` directives such as `private=\" authorization\"`. In shared-cache\nmode this could cause authenticated data to be cached and served to other users.\n\n- **Affected:** apps using the cache interceptor in shared mode that forward\n `Authorization` upstream and receive non-canonical qualified directives.\n- **Workaround:** disable shared-cache mode for authenticated traffic, avoid\n caching authenticated responses, or add `Vary: Authorization` upstream.\n\n##### HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679\n\n**[GHSA-p88m-4jfj-68fv](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv)** · CWE-93\n**Fix:** [`5655ea43`](https://redirect.github.com/nodejs/undici/commit/5655ea43) *fix(cookies): preserve values and parse SameSite strictly*\n\n`parseSetCookie` applied percent-decoding to cookie values, turning encoded\nsequences like `%0D%0A` and `%00` into literal bytes, contrary to RFC 6265 §5.4\nand browser behavior. Applications forwarding parsed Set-Cookie values into\nresponse headers were exposed to header injection, enabling session fixation,\nopen redirects, and cache poisoning. Introduced in 7.0.0 via\n[#3789](https://redirect.github.com/nodejs/undici/pull/3789).\n\n- **Workaround:** sanitize values before forwarding — strip or reject CR, LF,\n NUL, `;`, and `=`.\n\n***\n\n#### Low severity\n\n##### Set-Cookie SameSite attribute downgrade — CVE-2026-11525\n\n**[GHSA-g8m3-5g58-fq7m](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m)** · CWE-183\n**Fix:** [`5655ea43`](https://redirect.github.com/nodejs/undici/commit/5655ea43) *fix(cookies): preserve values and parse SameSite strictly*\n\nThe cookie parser accepted `SameSite` values containing `Strict`, `Lax`, or\n`None` as substrings rather than requiring exact matches per RFC 6265. Values\nlike `SameSite=NoneOfYourBusiness` parsed as `None`, and `SameSite=StrictLax`\nparsed as `Lax`, silently weakening cookie security policies for apps that\nforward parsed attributes.\n\n##### HTTP response queue poisoning via keep-alive socket reuse — CVE-2026-6733\n\n**[GHSA-35p6-xmwp-9g52](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52)** · CWE-367 (TOCTOU race condition)\n**Fix:** [`6ea54ef8`](https://redirect.github.com/nodejs/undici/commit/6ea54ef8) *fix: guard idle socket validation to skip fresh sockets*, hardened by [`c9fbe9d2`](https://redirect.github.com/nodejs/undici/commit/c9fbe9d2) *keep idle validation on native timers* ([#5397](https://redirect.github.com/nodejs/undici/pull/5397)) and [`ac5394b8`](https://redirect.github.com/nodejs/undici/commit/ac5394b8) *keep idle validation on global timers* ([#5407](https://redirect.github.com/nodejs/undici/pull/5407))\n\nAn attacker controlling an upstream HTTP/1.1 server could inject unsolicited\nresponses onto idle keep-alive sockets. On socket reuse, the injected response\nwas associated with a new request, delivering responses to the wrong requests.\n\n- **Requirements:** attacker-controlled/compromised upstream and active\n keep-alive reuse.\n- **Workaround:** disable keep-alive reuse with `keepAliveTimeout: 0` on the\n Client or Pool.\n\n***\n\n#### Also in v8.5.0 (non-security)\n\nv8.5.0 shipped the security fixes above alongside the following changes. **These\nare not security fixes** — they are listed for completeness of the release. (The\ntwo queue-poisoning hardening PRs, [#5397](https://redirect.github.com/nodejs/undici/pull/5397)\nand [#5407](https://redirect.github.com/nodejs/undici/pull/5407), are covered under\nCVE-2026-6733 above and are not repeated here.)\n\n- **HTTP/2:** [`#5408`](https://redirect.github.com/nodejs/undici/pull/5408) don't rewind `kPendingIdx` past in-flight requests · [`#5391`](https://redirect.github.com/nodejs/undici/pull/5391) allow h2 POST request multiplexing · [`#5406`](https://redirect.github.com/nodejs/undici/pull/5406) reap idle HTTP/2 sessions · [`#5410`](https://redirect.github.com/nodejs/undici/pull/5410) preserve h2 queue on out-of-order completion\n- **Features:** [`#5416`](https://redirect.github.com/nodejs/undici/pull/5416) add `bodyMixin.textStream()` · [`#5418`](https://redirect.github.com/nodejs/undici/pull/5418) align EventSource with spec\n- **Docs / CI / tests:** [`#5413`](https://redirect.github.com/nodejs/undici/pull/5413) document request header validation · [`#5383`](https://redirect.github.com/nodejs/undici/pull/5383) absorb h2 stream timeout resets (test) · [`#5420`](https://redirect.github.com/nodejs/undici/pull/5420) remove stale repro + lint · [`#5426`](https://redirect.github.com/nodejs/undici/pull/5426) extend Windows CI timeout · [`#5427`](https://redirect.github.com/nodejs/undici/pull/5427) detect available python in WPT runner\n\nFull changelog: [`v8.4.1...v8.5.0`](https://redirect.github.com/nodejs/undici/compare/v8.4.1...v8.5.0).\n\n***\n\n#### Credits\n\nPer-advisory credits (as recorded in each GHSA):\n\n- **CVE-2026-12151** — reported by [@lpinca](https://redirect.github.com/lpinca) & [@Nadav0077](https://redirect.github.com/Nadav0077); reviewed by [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n- **CVE-2026-9675** — reported by [@mauriceng98](https://redirect.github.com/mauriceng98) & [@Str1ckl4nd](https://redirect.github.com/Str1ckl4nd); fixed by [@mcollina](https://redirect.github.com/mcollina) & [@KhafraDev](https://redirect.github.com/KhafraDev); reviewed by [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n- **CVE-2026-9697** — reported by [@tonghuaroot](https://redirect.github.com/tonghuaroot); reviewed by [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n- **CVE-2026-6734** — reported by [@ChALkeR](https://redirect.github.com/ChALkeR); reviewed by [@mcollina](https://redirect.github.com/mcollina); verified by [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n- **CVE-2026-9678** — fixed by [@mcollina](https://redirect.github.com/mcollina); reviewed by [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n- **CVE-2026-9679** — reported by [@tndud042713](https://redirect.github.com/tndud042713); fixed by [@mcollina](https://redirect.github.com/mcollina); reviewed by [@KhafraDev](https://redirect.github.com/KhafraDev) & [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n- **CVE-2026-11525** — fixed by [@mcollina](https://redirect.github.com/mcollina); reviewed by [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n- **CVE-2026-6733** — fixed by [@mcollina](https://redirect.github.com/mcollina); verified by [@UlisesGascon](https://redirect.github.com/UlisesGascon).\n\n### [`v8.4.1`](https://redirect.github.com/nodejs/undici/releases/tag/v8.4.1)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.4.0...v8.4.1)\n\n#### What's Changed\n\n- test: avoid localhost lookup in fetch cookies tests by [@mcollina](https://redirect.github.com/mcollina) in [#5363](https://redirect.github.com/nodejs/undici/pull/5363)\n- fix: prevent race condition between onEnd and onTrailers in HTTP/2 client ([#5216](https://redirect.github.com/nodejs/undici/issues/5216)) by [@mcollina](https://redirect.github.com/mcollina) in [#5343](https://redirect.github.com/nodejs/undici/pull/5343)\n- fix(dns): skip requests without origin by [@marko1olo](https://redirect.github.com/marko1olo) in [#5376](https://redirect.github.com/nodejs/undici/pull/5376)\n- docs: add Getting Started guide by [@AliMahmoudDev](https://redirect.github.com/AliMahmoudDev) in [#5371](https://redirect.github.com/nodejs/undici/pull/5371)\n- docs: fix code examples that crash at runtime and other inaccuracies by [@AliMahmoudDev](https://redirect.github.com/AliMahmoudDev) in [#5386](https://redirect.github.com/nodejs/undici/pull/5386)\n- fix: handle paused parser on socket end (issue [#5360](https://redirect.github.com/nodejs/undici/issues/5360)) by [@mcollina](https://redirect.github.com/mcollina) in [#5389](https://redirect.github.com/nodejs/undici/pull/5389)\n- fix(client): reject pipelined TLS altname errors by [@marko1olo](https://redirect.github.com/marko1olo) in [#5373](https://redirect.github.com/nodejs/undici/pull/5373)\n- docs: fix multiple inaccuracies in API documentation by [@AliMahmoudDev](https://redirect.github.com/AliMahmoudDev) in [#5384](https://redirect.github.com/nodejs/undici/pull/5384)\n- docs: fix remaining broken links in API documentation by [@AliMahmoudDev](https://redirect.github.com/AliMahmoudDev) in [#5342](https://redirect.github.com/nodejs/undici/pull/5342)\n\n#### New Contributors\n\n- [@marko1olo](https://redirect.github.com/marko1olo) made their first contribution in [#5376](https://redirect.github.com/nodejs/undici/pull/5376)\n\n**Full Changelog**: \n\n### [`v8.4.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.4.0)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.3.0...v8.4.0)\n\n#### What's Changed\n\n- fix: register connect listener before initiating requests in close-and-destroy test by [@mcollina](https://redirect.github.com/mcollina) in [#5272](https://redirect.github.com/nodejs/undici/pull/5272)\n- test: stabilize tls-cert-leak regression by [@mcollina](https://redirect.github.com/mcollina) in [#5306](https://redirect.github.com/nodejs/undici/pull/5306)\n- fix: replace tspl with native test context in test/examples.js by [@mcollina](https://redirect.github.com/mcollina) in [#5300](https://redirect.github.com/nodejs/undici/pull/5300)\n- http2: remove redundant request stream binding by [@trivikr](https://redirect.github.com/trivikr) in [#5302](https://redirect.github.com/nodejs/undici/pull/5302)\n- test: limit cache-tests workers on Windows by [@mcollina](https://redirect.github.com/mcollina) in [#5309](https://redirect.github.com/nodejs/undici/pull/5309)\n- test: use test context cleanup hooks in parser issue tests by [@mcollina](https://redirect.github.com/mcollina) in [#5282](https://redirect.github.com/nodejs/undici/pull/5282)\n- Add redirect option to strip headers on redirect by [@mcollina](https://redirect.github.com/mcollina) in [#5281](https://redirect.github.com/nodejs/undici/pull/5281)\n- chore(test): fix lint failure by [@aduh95](https://redirect.github.com/aduh95) in [#5316](https://redirect.github.com/nodejs/undici/pull/5316)\n- chore(ci): use `npm ci` instead of `npm install` by [@aduh95](https://redirect.github.com/aduh95) in [#5315](https://redirect.github.com/nodejs/undici/pull/5315)\n- docs: clarify formData security considerations by [@mcollina](https://redirect.github.com/mcollina) in [#5320](https://redirect.github.com/nodejs/undici/pull/5320)\n- docs: add EventSource server example by [@Will-thom](https://redirect.github.com/Will-thom) in [#5321](https://redirect.github.com/nodejs/undici/pull/5321)\n- fix(core): simplify `addAbortListener` util by [@aduh95](https://redirect.github.com/aduh95) in [#5317](https://redirect.github.com/nodejs/undici/pull/5317)\n- build(deps-dev): bump ws from 8.20.0 to 8.21.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5325](https://redirect.github.com/nodejs/undici/pull/5325)\n- build(deps-dev): bump jsondiffpatch from 0.7.3 to 0.7.6 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5313](https://redirect.github.com/nodejs/undici/pull/5313)\n- docs: match undici EoL to node version it's bundled in by [@trivikr](https://redirect.github.com/trivikr) in [#5330](https://redirect.github.com/nodejs/undici/pull/5330)\n- fix: handle all HTTP/2 request stream sync errors by [@mcollina](https://redirect.github.com/mcollina) in [#5311](https://redirect.github.com/nodejs/undici/pull/5311)\n- fix: preserve timeout errors for HTTP/2 requests by [@mcollina](https://redirect.github.com/mcollina) in [#5091](https://redirect.github.com/nodejs/undici/pull/5091)\n- fix(core): normalize autoSelectFamily timeout AggregateError by [@youcefzemmar](https://redirect.github.com/youcefzemmar) in [#5329](https://redirect.github.com/nodejs/undici/pull/5329)\n- chore(core): define `kEnumerableProperty` atomically by [@aduh95](https://redirect.github.com/aduh95) in [#5332](https://redirect.github.com/nodejs/undici/pull/5332)\n- chore(core): use `regex.exec` instead of `string.match` by [@aduh95](https://redirect.github.com/aduh95) in [#5331](https://redirect.github.com/nodejs/undici/pull/5331)\n- fix: reset invalid HTTP/2 sessions by [@mcollina](https://redirect.github.com/mcollina) in [#5310](https://redirect.github.com/nodejs/undici/pull/5310)\n- feat(connect): add `preferH2` connector option to offer h2 first in ALPN by [@Antamansid](https://redirect.github.com/Antamansid) in [#5327](https://redirect.github.com/nodejs/undici/pull/5327)\n- test: fix flaky http2 trailers test by [@mcollina](https://redirect.github.com/mcollina) in [#5338](https://redirect.github.com/nodejs/undici/pull/5338)\n- fix(mock): restore single-arg MockCallHistory.filterCallsByX by [@youcefzemmar](https://redirect.github.com/youcefzemmar) in [#5328](https://redirect.github.com/nodejs/undici/pull/5328)\n- docs: document missing error types in Errors.md by [@cesarvspr](https://redirect.github.com/cesarvspr) in [#5339](https://redirect.github.com/nodejs/undici/pull/5339)\n- build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5346](https://redirect.github.com/nodejs/undici/pull/5346)\n- build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5347](https://redirect.github.com/nodejs/undici/pull/5347)\n- build(deps): bump uWebSockets.js from v20.67.0 to v20.68.0 in /benchmarks by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5352](https://redirect.github.com/nodejs/undici/pull/5352)\n- build(deps): bump concurrently from 9.2.1 to 10.0.3 in /benchmarks by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5353](https://redirect.github.com/nodejs/undici/pull/5353)\n- build(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5348](https://redirect.github.com/nodejs/undici/pull/5348)\n- build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5351](https://redirect.github.com/nodejs/undici/pull/5351)\n- build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5349](https://redirect.github.com/nodejs/undici/pull/5349)\n- docs: improve connect option documentation in Client.md by [@AliMahmoudDev](https://redirect.github.com/AliMahmoudDev) in [#5344](https://redirect.github.com/nodejs/undici/pull/5344)\n- fix(mock): do not persist snapshots on close in playback mode by [@GeoffreyBooth](https://redirect.github.com/GeoffreyBooth) in [#5359](https://redirect.github.com/nodejs/undici/pull/5359)\n- fix(fetch): remove abort listener when request settles by [@ATOM00blue](https://redirect.github.com/ATOM00blue) in [#5318](https://redirect.github.com/nodejs/undici/pull/5318)\n- test: add Node.js global fetch regression coverage by [@mcollina](https://redirect.github.com/mcollina) in [#5361](https://redirect.github.com/nodejs/undici/pull/5361)\n- fix(h2): make Client multiplex on h2 ([#4143](https://redirect.github.com/nodejs/undici/issues/4143)) by [@mcollina](https://redirect.github.com/mcollina) in [#5362](https://redirect.github.com/nodejs/undici/pull/5362)\n\n#### New Contributors\n\n- [@Will-thom](https://redirect.github.com/Will-thom) made their first contribution in [#5321](https://redirect.github.com/nodejs/undici/pull/5321)\n- [@youcefzemmar](https://redirect.github.com/youcefzemmar) made their first contribution in [#5329](https://redirect.github.com/nodejs/undici/pull/5329)\n- [@Antamansid](https://redirect.github.com/Antamansid) made their first contribution in [#5327](https://redirect.github.com/nodejs/undici/pull/5327)\n- [@cesarvspr](https://redirect.github.com/cesarvspr) made their first contribution in [#5339](https://redirect.github.com/nodejs/undici/pull/5339)\n- [@AliMahmoudDev](https://redirect.github.com/AliMahmoudDev) made their first contribution in [#5344](https://redirect.github.com/nodejs/undici/pull/5344)\n- [@ATOM00blue](https://redirect.github.com/ATOM00blue) made their first contribution in [#5318](https://redirect.github.com/nodejs/undici/pull/5318)\n\n**Full Changelog**: \n\n### [`v8.3.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.3.0)\n\n[Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.2.0...v8.3.0)\n\n#### What's Changed\n\n- fix: preserve pool capacity after removing stale client by [@trivikr](https://redirect.github.com/trivikr) in [#5151](https://redirect.github.com/nodejs/undici/pull/5151)\n- build(deps): bump actions/github-script from 8.0.0 to 9.0.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5157](https://redirect.github.com/nodejs/undici/pull/5157)\n- build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.1 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5162](https://redirect.github.com/nodejs/undici/pull/5162)\n- build(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5156](https://redirect.github.com/nodejs/undici/pull/5156)\n- chore(http2): collapse duplicate request stream setup by [@trivikr](https://redirect.github.com/trivikr) in [#5140](https://redirect.github.com/nodejs/undici/pull/5140)\n- perf(client): cache HTTP/2 authority by [@trivikr](https://redirect.github.com/trivikr) in [#5141](https://redirect.github.com/nodejs/undici/pull/5141)\n- build(deps-dev): bump borp from 0.20.2 to 1.0.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#4819](https://redirect.github.com/nodejs/undici/pull/4819)\n- types: add TOpaque to client connect options by [@samuel871211](https://redirect.github.com/samuel871211) in [#4928](https://redirect.github.com/nodejs/undici/pull/4928)\n- build(deps): bump tinybench from 5.1.0 to 6.0.1 in /benchmarks by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#4688](https://redirect.github.com/nodejs/undici/pull/4688)\n- build(deps): bump codecov/codecov-action from 5.5.1 to 6.0.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#4950](https://redirect.github.com/nodejs/undici/pull/4950)\n- build(deps): bump actions/dependency-review-action from 4.8.1 to 4.9.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#4951](https://redirect.github.com/nodejs/undici/pull/4951)\n- test(fetch): add userinfo coverage for issue-4897 URLs by [@mcollina](https://redirect.github.com/mcollina) in [#4901](https://redirect.github.com/nodejs/undici/pull/4901)\n- perf: avoid duplicate pool dispatcher selection on backpressure by [@trivikr](https://redirect.github.com/trivikr) in [#5149](https://redirect.github.com/nodejs/undici/pull/5149)\n- build(deps): bump actions/setup-node from 6.2.0 to 6.4.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5163](https://redirect.github.com/nodejs/undici/pull/5163)\n- build(deps): bump step-security/harden-runner from 2.14.1 to 2.19.1 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5160](https://redirect.github.com/nodejs/undici/pull/5160)\n- build(deps): bump cronometro from 5.3.0 to 6.0.3 in /benchmarks by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#4687](https://redirect.github.com/nodejs/undici/pull/4687)\n- build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5161](https://redirect.github.com/nodejs/undici/pull/5161)\n- build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#4853](https://redirect.github.com/nodejs/undici/pull/4853)\n- build(deps): bump hendrikmuhs/ccache-action from 1.2.22 to 1.2.23 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5158](https://redirect.github.com/nodejs/undici/pull/5158)\n- build(deps): bump fastify/github-action-merge-dependabot from 3.11.2 to 3.12.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5159](https://redirect.github.com/nodejs/undici/pull/5159)\n- build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#4854](https://redirect.github.com/nodejs/undici/pull/4854)\n- build(deps): bump uWebSockets.js from v20.64.0 to v20.66.0 in /benchmarks by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5130](https://redirect.github.com/nodejs/undici/pull/5130)\n- docs: mention install() also installs WebSocket globals by [@mcollina](https://redirect.github.com/mcollina) in [#5174](https://redirect.github.com/nodejs/undici/pull/5174)\n- types: stop interfering with [@types/node](https://redirect.github.com/types/node) by [@Renegade334](https://redirect.github.com/Renegade334) in [#5173](https://redirect.github.com/nodejs/undici/pull/5173)\n- fix: align h2 empty body content-length methods with h1 by [@trivikr](https://redirect.github.com/trivikr) in [#5172](https://redirect.github.com/nodejs/undici/pull/5172)\n- build(deps-dev): bump fast-check from 4.6.0 to 4.7.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5192](https://redirect.github.com/nodejs/undici/pull/5192)\n- build(deps-dev): bump typescript from 6.0.2 to 6.0.3 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5191](https://redirect.github.com/nodejs/undici/pull/5191)\n- test: move cleanup from finally to after hooks by [@trivikr](https://redirect.github.com/trivikr) in [#5194](https://redirect.github.com/nodejs/undici/pull/5194)\n- test: resolve flaky timeout in issue-3356 by [@trivikr](https://redirect.github.com/trivikr) in [#5188](https://redirect.github.com/nodejs/undici/pull/5188)\n- `SnapshotAgent`: Add `normalizeBody` and `normalizeQuery` by [@GeoffreyBooth](https://redirect.github.com/GeoffreyBooth) in [#5121](https://redirect.github.com/nodejs/undici/pull/5121)\n- fix(socks5): use configured connector in Socks5ProxyAgent by [@trivikr](https://redirect.github.com/trivikr) in [#5168](https://redirect.github.com/nodejs/undici/pull/5168)\n- perf(http2): avoid isArray checks for common headers by [@trivikr](https://redirect.github.com/trivikr) in [#5170](https://redirect.github.com/nodejs/undici/pull/5170)\n- fix(test): make deduplicate body-streaming test non-flaky by [@mcollina](https://redirect.github.com/mcollina) in [#5196](https://redirect.github.com/nodejs/undici/pull/5196)\n- test(retry): add regression test for RetryAgent + HTTP/2 stream timeout ([#5137](https://redirect.github.com/nodejs/undici/issues/5137)) by [@mcollina](https://redirect.github.com/mcollina) in [#5176](https://redirect.github.com/nodejs/undici/pull/5176)\n- fix(socks5): preserve dispatch backpressure return value by [@trivikr](https://redirect.github.com/trivikr) in [#5166](https://redirect.github.com/nodejs/undici/pull/5166)\n- perf(http2): end zero-length request bodies with headers by [@trivikr](https://redirect.github.com/trivikr) in [#5169](https://redirect.github.com/nodejs/undici/pull/5169)\n- fix(test): make issue-2898-comment.js assertion robust against flakiness by [@mcollina](https://redirect.github.com/mcollina) in [#5208](https://redirect.github.com/nodejs/undici/pull/5208)\n- test: disable timeouts in h2 high concurrency regression by [@trivikr](https://redirect.github.com/trivikr) in [#5205](https://redirect.github.com/nodejs/undici/pull/5205)\n- test: deflake stream compat coverage by [@mcollina](https://redirect.github.com/mcollina) in [#5209](https://redirect.github.com/nodejs/undici/pull/5209)\n- fix(dispatcher): remove unreachable assert in writeBlob by [@SAY-5](https://redirect.github.com/SAY-5) in [#5231](https://redirect.github.com/nodejs/undici/pull/5231)\n- fix: clean up benchmark resources before worker exit by [@trivikr](https://redirect.github.com/trivikr) in [#5225](https://redirect.github.com/nodejs/undici/pull/5225)\n- test: avoid per-chunk assertions in diagnostics get by [@trivikr](https://redirect.github.com/trivikr) in [#5224](https://redirect.github.com/nodejs/undici/pull/5224)\n- test: capture cache test worker stderr and preserve failures by [@trivikr](https://redirect.github.com/trivikr) in [#5206](https://redirect.github.com/nodejs/undici/pull/5206)\n- chore: gitignore benchmarks/package-lock.json by [@trivikr](https://redirect.github.com/trivikr) in [#5228](https://redirect.github.com/nodejs/undici/pull/5228)\n- perf(proxy-agent): avoid extra header allocations in auth guard by [@trivikr](https://redirect.github.com/trivikr) in [#5164](https://redirect.github.com/nodejs/undici/pull/5164)\n- test(wpt): retry WPT server startup on port conflicts or timeout by [@trivikr](https://redirect.github.com/trivikr) in [#5215](https://redirect.github.com/nodejs/undici/pull/5215)\n- test: make websocket diagnostics ping-pong ordering deterministic by [@trivikr](https://redirect.github.com/trivikr) in [#5222](https://redirect.github.com/nodejs/undici/pull/5222)\n- test(websocket): fix flaky send test by [@mcollina](https://redirect.github.com/mcollina) in [#5232](https://redirect.github.com/nodejs/undici/pull/5232)\n- fix: prevent node-fetch test server close from hanging on Windows by [@mcollina](https://redirect.github.com/mcollina) in [#5246](https://redirect.github.com/nodejs/undici/pull/5246)\n- test: wait for cache test server to listen by [@trivikr](https://redirect.github.com/trivikr) in [#5242](https://redirect.github.com/nodejs/undici/pull/5242)\n- fix: accept unknown-size Content-Range values by [@trivikr](https://redirect.github.com/trivikr) in [#5120](https://redirect.github.com/nodejs/undici/pull/5120)\n- test: avoid global dispatcher state in mock client tests by [@trivikr](https://redirect.github.com/trivikr) in [#5258](https://redirect.github.com/nodejs/undici/pull/5258)\n- test: fix flaky permessage-deflate limit timeout by [@mcollina](https://redirect.github.com/mcollina) in [#5229](https://redirect.github.com/nodejs/undici/pull/5229)\n- test: drain request bodies in request tests by [@trivikr](https://redirect.github.com/trivikr) in [#5247](https://redirect.github.com/nodejs/undici/pull/5247)\n- test: reduce retry-after invalid date timing flake by [@trivikr](https://redirect.github.com/trivikr) in [#5250](https://redirect.github.com/nodejs/undici/pull/5250)\n- test: drive request timeout ticks after connect by [@trivikr](https://redirect.github.com/trivikr) in [#5251](https://redirect.github.com/nodejs/undici/pull/5251)\n- test: only fail max-listener checks on max-listener warnings by [@trivikr](https://redirect.github.com/trivikr) in [#5253](https://redirect.github.com/nodejs/undici/pull/5253)\n- test: avoid double-closing server in client-request test by [@trivikr](https://redirect.github.com/trivikr) in [#5255](https://redirect.github.com/nodejs/undici/pull/5255)\n- fix(retry-handler): validate response body length against Content-Range by [@mcollina](https://redirect.github.com/mcollina) in [#4975](https://redirect.github.com/nodejs/undici/pull/4975)\n- test: wait for inflight-and-close body cleanup by [@trivikr](https://redirect.github.com/trivikr) in [#5261](https://redirect.github.com/nodejs/undici/pull/5261)\n- fix(test): make http2-pseudo-headers test order-independent by [@mcollina](https://redirect.github.com/mcollina) in [#5234](https://redirect.github.com/nodejs/undici/pull/5234)\n- fix: preserve fetch multipart body on MockAgent fallback by [@mcollina](https://redirect.github.com/mcollina) in [#5269](https://redirect.github.com/nodejs/undici/pull/5269)\n- ci: build Node FFI fixtures for shared-builtin tests by [@trivikr](https://redirect.github.com/trivikr) in [#5275](https://redirect.github.com/nodejs/undici/pull/5275)\n- test: deflake issue-5137 stream count assertion by [@trivikr](https://redirect.github.com/trivikr) in [#5243](https://redirect.github.com/nodejs/undici/pull/5243)\n- fix: replace finished() with writable lifecycle tracking by [@trivikr](https://redirect.github.com/trivikr) in [#5001](https://redirect.github.com/nodejs/undici/pull/5001)\n- perf(client-h2): reuse request stream handlers by [@trivikr](https://redirect.github.com/trivikr) in [#5280](https://redirect.github.com/nodejs/undici/pull/5280)\n- fix: prevent pipeline body replay on redirect by [@mcollina](https://redirect.github.com/mcollina) in [#5274](https://redirect.github.com/nodejs/undici/pull/5274)\n- fix(types): remove throwOnError from Dispatcher.RequestOptions by [@Zelys-DFKH](https://redirect.github.com/Zelys-DFKH) in [#5279](https://redirect.github.com/nodejs/undici/pull/5279)\n- fix: validate EOF for chunked h1 responses by [@mcollina](https://redirect.github.com/mcollina) in [#5273](https://redirect.github.com/nodejs/undici/pull/5273)\n- test: deflake parser-issues teardown by [@mcollina](https://redirect.github.com/mcollina) in [#5278](https://redirect.github.com/nodejs/undici/pull/5278)\n- test: make http2-alpn control requests explicit by [@trivikr](https://redirect.github.com/trivikr) in [#5252](https://redirect.github.com/nodejs/undici/pull/5252)\n- test: include cache-test worker metadata on failure by [@trivikr](https://redirect.github.com/trivikr) in [#5276](https://redirect.github.com/nodejs/undici/pull/5276)\n- test: include after in parser-issues by [@trivikr](https://redirect.github.com/trivikr) in [#5284](https://redirect.github.com/nodejs/undici/pull/5284)\n- cache formdata boundary by [@KhafraDev](https://redirect.github.com/KhafraDev) in [#5292](https://redirect.github.com/nodejs/undici/pull/5292)\n- build(deps-dev): bump fast-check from 4.7.0 to 4.8.0 by [@dependabot](https://redirect.github.com/dependabot)\\[bot] in [#5298](https://redirect.github.com/nodejs/undici/pull/5298)\n- test: retry crashed cache-test workers once by [@trivikr](https://redirect.github.com/trivikr) in [#5294](https://redirect.github.com/nodejs/undici/pull/5294)\n- Add Node 26 to the matrix by [@mcollina](https://redirect.github.com/mcollina) in [#5271](https://redirect.github.com/nodejs/undici/pull/5271)\n- perf(client-h2): reuse request upgrade strea\n\n> ❗ **Important**\n> \n> ✂ PR body was truncated to here.\n\n\n

\n\n---\n\n### Configuration\n\n📅 **Schedule**: (UTC)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n🔕 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ForgeRock/ping-javascript-sdk).\n\n","headSha","4b9ec19ebe16551e12f9789ff3e7f02674d3c0e5","baseSha","357a609cea8a84e1c23a934037038cb5443427e6","isDraft","isFork","pipelineHeadSha",{"_124":125,"_126":127,"_128":129,"_130":131,"_132":-5,"_133":134,"_135":-5,"_136":-5,"_137":-5,"_138":139,"_140":141,"_142":143,"_144":145,"_146":-5,"_147":148,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_92":153,"_154":155,"_156":-5,"_102":157,"_158":159,"_160":-5,"_161":-5,"_162":-5,"_163":-5,"_164":-5,"_165":-5,"_166":-5,"_167":-5,"_168":-5,"_169":-5,"_170":-5,"_171":172,"_173":174,"_175":-5,"_176":174},"suggestedFixId","6aa2ec26c5ddf19c9f241555","fixedTasks",[177],"otherFailedTasks",[],"verificationStatus","NOT_STARTED","verificationTasksExecuted","userAction","NONE","userActionOrigin","userCommitMessage","suggestedFix","suggestedFixDescription","","suggestedFixStatus","COMPLETED","suggestedFixReasoning","The failing task `@forgerock/davinci-suites:e2e-ci--src/phone-number-field.test.ts` was classified as a flaky task rather than a code change for the following reasons:\n\n1. **Error type is a UI timing issue, not an API regression.**\n The test fails because the \"Registration Complete\" heading is not visible within a 5000ms timeout. This is a classic non-deterministic E2E failure — the element may simply not have rendered in time — and bears no logical connection to the undici HTTP client upgrade.\n\n2. **High historical flakiness rate.**\n This task has an 18.06% flakiness rate, meaning it has a well-established history of intermittent failures independent of code changes.\n\n3. **The lockfile-driven `touched_projects: [\"*\"]` does not indicate code relevance.**\n The `*` in touched_projects comes from the undici lockfile bump, not from any modification to the `davinci-suites` e2e test files or the application code they exercise. The `*` wildcard therefore does not signal that the PR change is causally related to this test's failure.\n\n4. **Failure is absent in the comparison branch.**\n The similar-task-failure detector found no matching failure in branch 802, ruling out a pre-existing environment or configuration issue shared across branches.\n\n5. **No direct code path connects undici v8 to this failure.**\n Even if undici's HTTP behaviour changed, the assertion is on a DOM heading element — any undici-related latency or behavioural change would have to propagate through the entire request/response/render pipeline to cause a 5000ms DOM timeout, with no evidence that this occurred deterministically.","suggestedFixExecutionTime",71216,"verificationExecutionTime","reviewComment","We classified this E2E failure as flaky rather than a regression introduced by the undici upgrade. The test has an 18% historical flakiness rate and the error — a 5000ms DOM visibility timeout on the \"Registration Complete\" heading — has no direct causal link to HTTP client behaviour changes. Rerunning the suite should resolve it.","originalSuggestedFix","originalSuggestedFixDescription","originalSuggestedFixReasoning","userActionRecordedAt",["D",1789062182125],"suggestedAt",["D",1789062182125],"verifiedAt","a6dd","failureClassification","flaky_task","fileModeMap","suggestedFixFailureReason","suggestedFixFailureReasonDetails","suggestedFixFailureReasonType","assignedAgentName","autoApplySkipped","autoApplySkipReason","flakyRerunSkipped","flakyRerunPending","confidence","confidenceReasoning","fixApplicationAttempts",[],"taskOutputSummary","TASK ID: @forgerock/davinci-suites:e2e-ci--src/phone-number-field.test.ts\n> playwright test src/phone-number-field.test.ts --output=.playwright/src-phone-number-field-test-ts\r\n\r\n\nRunning 2 tests using 1 worker\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/vite.svg, use /vite.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/typescript.svg, use /typescript.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/vite.svg, use /vite.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/typescript.svg, use /typescript.svg.\nF[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/vite.svg, use /vite.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/typescript.svg, use /typescript.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/vite.svg, use /vite.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/typescript.svg, use /typescript.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/vite.svg, use /vite.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/typescript.svg, use /typescript.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/vite.svg, use /vite.svg.\n[WebServer] Files in the public directory are served at the root path.\n[WebServer] Instead of /public/typescript.svg, use /typescript.svg.\n·\n\n 1) src/phone-number-field.test.ts:27:3 › Device registration tests › Login - add email device - authenticate with email device \n\n Error: expect(locator).toBeVisible() failed\n\n Locator: getByRole('heading', { name: 'Registration Complete' })\n Expected: visible\n Timeout: 5000ms\n Error: element(s) not found\n\n Call log:\n - Expect \"toBeVisible\" with timeout 5000ms\n - waiting for getByRole('heading', { name: 'Registration Complete' })\n\n\n 44 | await page.getByRole('button', { name: 'Submit' }).click();\n 45 |\n > 46 | await expect(page.getByRole('heading', { name: 'Registration Complete' })).toBeVisible();\n | ^\n 47 | await page.getByRole('button', { name: 'Continue' }).click();\n 48 | await page.getByRole('button', { name: 'Logout' }).click();\n 49 |\n at /home/workflows/workspace/e2e/davinci-suites/src/phone-number-field.test.ts:46:80\n\n Error Context: .playwright/src-phone-number-field-test-ts/phone-number-field-Device--2d6b7-henticate-with-email-device/error-context.md\n\n 1 failed\n src/phone-number-field.test.ts:27:3 › Device registration tests › Login - add email device - authenticate with email device \n 1 passed (29.5s)\n::error file=src/phone-number-field.test.ts,title=src/phone-number-field.test.ts:27:3 › Device registration tests › Login - add email device - authenticate with email device,line=46,col=80:: 1) src/phone-number-field.test.ts:27:3 › Device registration tests › Login - add email device - authenticate with email device %0A Error: expect(locator).toBeVisible() failed%0A%0A Locator: getByRole('heading', { name: 'Registration Complete' })%0A Expected: visible%0A Timeout: 5000ms%0A Error: element(s) not found%0A%0A Call log:%0A - Expect \"toBeVisible\" with timeout 5000ms%0A - waiting for getByRole('heading', { name: 'Registration Complete' })%0A%0A%0A 44 | await page.getByRole('button', { name: 'Submit' }).click();%0A 45 |%0A > 46 | await expect(page.getByRole('heading', { name: 'Registration Complete' })).toBeVisible();%0A | ^%0A 47 | await page.getByRole('button', { name: 'Continue' }).click();%0A 48 | await page.getByRole('button', { name: 'Logout' }).click();%0A 49 |%0A at /home/workflows/workspace/e2e/davinci-suites/src/phone-number-field.test.ts:46:80\n::notice title=🎭 Playwright Run Summary:: 1 failed%0A src/phone-number-field.test.ts:27:3 › Device registration tests › Login - add email device - authenticate with email device %0A 1 passed (29.5s)\nWarning: command \"playwright test src/phone-number-field.test.ts --output=.playwright/src-phone-number-field-test-ts\" exited with non-zero status code","remoteTaskSummary","localTaskSummary","@forgerock/davinci-suites:e2e-ci--src/phone-number-field.test.ts",{"_179":177,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189},"taskName","runLinkId","SDe6zUys13","dteExecutionId","G1EpGvWRkO","agentName","job-6aa2eb199bbe3e60867af0af-0-agent-13","launchTemplates",[195],"taskTarget",{"_190":191,"_192":193,"_194":-5},"project","@forgerock/davinci-suites","target","e2e-ci--src/phone-number-field.test.ts","configuration","linux-medium-js","name","ForgeRock",["D",1637181514840],["D",1792659089293],"enabled","plan","TEAM","planActivationDate",["D",1756842180075],"paymentCollectionMethod","charge_automatically","isEligibleForProTrial","disabledReason","planLimits",{"_258":259,"_260":261,"_262":263,"_264":265,"_266":47,"_267":268,"_269":270,"_271":270,"_272":273},"isAiEnabled","allowedEmailDomains",[257],"currentPlanEndDate","hasDiscount","planTransitions",[250],"id","6195684a2f082e00055e3c09","memberships",[241,242,243],"privateCloudInstallationId","hasBillingInformation","hasLicense","isUnclaimed","isOnTrial","isHighPriority","vcsProfileLink","https://github.com/organizations/ForgeRock/settings/profile","vcsConfiguration",{"_236":237,"_238":239,"_240":197},"lastMembersSyncedAt","isAiBringYourOwnKey","enterpriseTrial","disabledReasonMessage","provider","GITHUB","vcsOrganizationId","2592818","vcsOrganizationName",{"_244":249,"_246":247},{"_244":248,"_246":247},{"_244":245,"_246":247},"userId","610d543e2bb0cf000594df47","role","admin","66abd4a0a91dbcda2bcf2b72","6195684a2f082e00055e3c08",{"_218":251,"_201":202,"_252":253,"_254":255,"_256":99},"audit:68b748c45e6eddbc6b58126f","date",["D",1756842180075],"reason","ORGANIZATION_PLAN_SWITCHED_TO_PRO_FOR_STARTUPS_BY_NRWL_ADMIN","source","pingidentity.com","baseIncludedCredits",50000,"additionalCredits",{},"discountedCreditsMaximum",0,"contributorLimit",5,"concurrentConnectionLimit","runsLimit",1000000,"adminUserLimit",9999,"workspaceLimit","modifiers",[274,275,276,277,278,279,280,281,282],{"_283":284,"_285":321,"_287":288,"_289":322,"_291":323,"_293":294,"_295":296,"_297":16},{"_283":284,"_285":318,"_287":288,"_289":319,"_291":320,"_293":294,"_295":301,"_297":16},{"_283":284,"_285":315,"_287":288,"_289":316,"_291":317,"_293":294,"_295":296,"_297":16},{"_283":284,"_285":312,"_287":288,"_289":313,"_291":314,"_293":294,"_295":308,"_297":16},{"_283":284,"_285":309,"_287":288,"_289":310,"_291":311,"_293":294,"_295":296,"_297":16},{"_283":284,"_285":305,"_287":288,"_289":306,"_291":307,"_293":294,"_295":308,"_297":16},{"_283":284,"_285":302,"_287":288,"_289":303,"_291":304,"_293":294,"_295":296,"_297":16},{"_283":284,"_285":298,"_287":288,"_289":299,"_291":300,"_293":294,"_295":301,"_297":16},{"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":16},"displayName","Achievement credit reward","description","Earn 10,000 credits by securing your workspace with caching strategies and CI tokens.","appliesTo","ALL_CREDITS","appliedAt",["D",1789069533914],"expiresAt",["D",1793491200000],"validationPeriod","BILLING_CYCLE","value",10000,"active","Invite 2 team members and receive 30,000 credits after they log in.",["D",1789069497047],["D",1793491200000],30000,"Authenticate the Nx CLI with `nx login` so your runs can read and write the shared cache under your own identity.",["D",1789069421568],["D",1793491200000],"Let Nx Cloud propose a fix when CI fails and apply it to get the pipeline green.",["D",1789069421550],["D",1793491200000],20000,"Let Nx Cloud surface tasks that pass and fail without input changes so you can stabilize them.",["D",1789069421550],["D",1793491200000],"Run CI with distributed task execution so work is spread across agents to cut wall-clock time.",["D",1789069421550],["D",1793491200000],"Create a CI access token and remove read-write default access so cache reads and writes are protected.",["D",1789069421550],["D",1793491200000],"Run CI with Nx Cloud connected and restore at least one task from the remote cache after claiming your workspace.",["D",1789069421550],["D",1793491200000],"Connect your workspace to a Git provider so Nx Cloud can attach runs to commits and pull requests.",["D",1789069421450],["D",1793491200000],"ciExecutionEnv",["D",1789061913614],["D",1789062085085],"completedAt",["D",1789062085085],"status","FAILED","agentCount","stopAgentsOnFailure","criticalErrorMessage","commandCount","stopAgentsAfter","e2e-ci","agents",[515,512,509,506,185,501,498,495,492,489,486,483,480,477,467],"closed","completedBy","STOP_AGENTS_ON_FAILURE","requireExplicitCompletion","linkedWorkflows",[579],"activeAgents",[],"assignmentRules",[],"schedulingConstraintsInput","agentsMetadata",{"_515":518,"_512":519,"_509":520,"_506":521,"_185":522,"_501":523,"_498":524,"_495":525,"_492":526,"_489":527,"_486":528,"_483":529,"_480":530,"_477":531,"_467":532},"agentInstances",{"_435":436,"_437":438,"_439":440,"_441":442,"_443":444,"_445":446,"_447":448,"_449":450,"_451":452,"_453":454,"_455":456,"_457":458,"_459":460,"_461":462,"_463":464},"stopAgentsAfterConditions",{"_336":433},"continuousAssignment","config",{"_359":360,"_324":-5},"sources",{"_361":362,"_363":364,"_365":366,"_367":368},"lifecycle",{"_422":423,"_424":425,"_426":427},"ai",{"_414":415,"_416":417},"dte",{"_376":377,"_378":379,"_347":380,"_381":382},"nxAgents",{"_369":370},"withEnvVars",[371],{"_372":373,"_295":374,"_324":-5},"kind","LEGACY",[375],"CODECOV_TOKEN","enabledByDefault",[413],"distributeOn",[395],[390],"schedulingConstraints",[383],{"_372":384,"_295":385,"_324":-5},"DEFAULT",{"_386":387,"_388":389},"_t","io.nrwl.models.SchedulingConstraintsInput.Inline","constraints",[],{"_372":384,"_295":391,"_324":-5},{"_386":392,"_393":394},"io.nrwl.models.AssignmentRulesInput.Inline","rules",[],{"_372":373,"_295":396,"_324":-5},{"_386":397,"_398":399,"_400":401,"_402":403},"io.nrwl.models.DistributeOnInput.FromFile","path",".nx/workflows/dynamic-changesets.yml","rawYaml","distribute-on:\n small-changeset: 3 linux-medium-js # Distribute on small if 1-25% of projects affected in PR\n medium-changeset: 6 linux-medium-js # Distribute on medium if 26-50% of projects affected in PR\n large-changeset: 10 linux-medium-js # Distribute on large if 51-75% of projects affected in PR\n extra-large-changeset: 15 linux-medium-js # Distribute on extra-large if 76-100% of projects affected in PR\n","parsed",{"_378":404},{"_405":406,"_407":408,"_409":410,"_411":412},"small-changeset","3 linux-medium-js","medium-changeset","6 linux-medium-js","large-changeset","10 linux-medium-js","extra-large-changeset","15 linux-medium-js",{"_372":384,"_295":16,"_324":-5},"fixTasksPatterns",[420],"autoApplyPatterns",[418],{"_372":384,"_295":419,"_324":-5},[],{"_372":384,"_295":421,"_324":-5},[],"failAfter",[431],"heartbeat",[430],"stopAfter",[428],{"_372":373,"_295":429,"_324":-5},[336],{"_372":373,"_295":16,"_324":-5},{"_372":373,"_295":432,"_324":-5},1,{"_434":183},"executionId","job-6aa2eb199bbe3e60867af0af-0-agent-6-4lqbh",{"_465":435,"_466":515,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":516,"_475":517},"job-6aa2eb199bbe3e60867af0af-0-agent-3-4dgfv",{"_465":437,"_466":512,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":513,"_475":514},"job-6aa2eb199bbe3e60867af0af-0-agent-11-7zn5g",{"_465":439,"_466":509,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":510,"_475":511},"job-6aa2eb199bbe3e60867af0af-0-agent-5-8jmj7",{"_465":441,"_466":506,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":507,"_475":508},"job-6aa2eb199bbe3e60867af0af-0-agent-13-m4lrh",{"_465":443,"_466":185,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":504,"_475":505},"job-6aa2eb199bbe3e60867af0af-0-agent-14-wbf6b",{"_465":445,"_466":501,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":502,"_475":503},"job-6aa2eb199bbe3e60867af0af-0-agent-10-2qgnc",{"_465":447,"_466":498,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":499,"_475":500},"job-6aa2eb199bbe3e60867af0af-0-agent-8-cpzpp",{"_465":449,"_466":495,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":496,"_475":497},"job-6aa2eb199bbe3e60867af0af-0-agent-12-2fkg5",{"_465":451,"_466":492,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":493,"_475":494},"job-6aa2eb199bbe3e60867af0af-0-agent-7-pw565",{"_465":453,"_466":489,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":490,"_475":491},"job-6aa2eb199bbe3e60867af0af-0-agent-9-nfffn",{"_465":455,"_466":486,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":487,"_475":488},"job-6aa2eb199bbe3e60867af0af-0-agent-1-9sfrj",{"_465":457,"_466":483,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":484,"_475":485},"job-6aa2eb199bbe3e60867af0af-0-agent-2-cpq7k",{"_465":459,"_466":480,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":481,"_475":482},"job-6aa2eb199bbe3e60867af0af-0-agent-4-8xch7",{"_465":461,"_466":477,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":478,"_475":479},"job-6aa2eb199bbe3e60867af0af-0-agent-0-8mvd8",{"_465":463,"_466":467,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":474,"_475":476},"agentInstanceName","agentDisplayName","job-6aa2eb199bbe3e60867af0af-0-agent-0","launchTemplate","artifactId","systemInfo","aggregatedMetrics","isMetricsCollectionEnabled","onlineAt",["D",1789061998298],"offlineAt",["D",1789062057555],"job-6aa2eb199bbe3e60867af0af-0-agent-4",["D",1789061993848],["D",1789062057894],"job-6aa2eb199bbe3e60867af0af-0-agent-2",["D",1789061989280],["D",1789062061879],"job-6aa2eb199bbe3e60867af0af-0-agent-1",["D",1789061988384],["D",1789062058469],"job-6aa2eb199bbe3e60867af0af-0-agent-9",["D",1789061982441],["D",1789062058717],"job-6aa2eb199bbe3e60867af0af-0-agent-7",["D",1789061982393],["D",1789062059457],"job-6aa2eb199bbe3e60867af0af-0-agent-12",["D",1789061980684],["D",1789062058422],"job-6aa2eb199bbe3e60867af0af-0-agent-8",["D",1789061978145],["D",1789062061393],"job-6aa2eb199bbe3e60867af0af-0-agent-10",["D",1789061977778],["D",1789062060777],"job-6aa2eb199bbe3e60867af0af-0-agent-14",["D",1789061977607],["D",1789062059186],["D",1789061976975],["D",1789062084971],"job-6aa2eb199bbe3e60867af0af-0-agent-5",["D",1789061976474],["D",1789062057952],"job-6aa2eb199bbe3e60867af0af-0-agent-11",["D",1789061975253],["D",1789062058018],"job-6aa2eb199bbe3e60867af0af-0-agent-3",["D",1789061972711],["D",1789062058228],"job-6aa2eb199bbe3e60867af0af-0-agent-6",["D",1789061972239],["D",1789062077552],{"_533":576,"_468":195,"_473":577,"_475":578},{"_533":573,"_468":195,"_473":574,"_475":575},{"_533":570,"_468":195,"_473":571,"_475":572},{"_533":567,"_468":195,"_473":568,"_475":569},{"_533":564,"_468":195,"_473":565,"_475":566},{"_533":561,"_468":195,"_473":562,"_475":563},{"_533":558,"_468":195,"_473":559,"_475":560},{"_533":555,"_468":195,"_473":556,"_475":557},{"_533":552,"_468":195,"_473":553,"_475":554},{"_533":549,"_468":195,"_473":550,"_475":551},{"_533":546,"_468":195,"_473":547,"_475":548},{"_533":543,"_468":195,"_473":544,"_475":545},{"_533":540,"_468":195,"_473":541,"_475":542},{"_533":537,"_468":195,"_473":538,"_475":539},{"_533":534,"_468":195,"_473":535,"_475":536},"targets",[],["D",1789061998298],["D",1789062057555],[],["D",1789061993848],["D",1789062057894],[],["D",1789061989280],["D",1789062061879],[],["D",1789061988384],["D",1789062058469],[],["D",1789061982441],["D",1789062058717],[],["D",1789061982393],["D",1789062059457],[],["D",1789061980684],["D",1789062058422],[],["D",1789061978145],["D",1789062061393],[],["D",1789061977778],["D",1789062060777],[],["D",1789061977607],["D",1789062059186],[],["D",1789061976975],["D",1789062084971],[],["D",1789061976474],["D",1789062057952],[],["D",1789061975253],["D",1789062058018],[],["D",1789061972711],["D",1789062058228],[],["D",1789061972239],["D",1789062077552],{"_218":580,"_581":582,"_583":584},"6aa2eb199bbe3e60867af0af","type","AGENTS","workflowConfig","not-provided","branch","806",["D",1789061913614],["D",1789062085206],["D",1789062085085],"runGroups",[688],"vcsContext",{"_585":586,"_670":671,"_112":113,"_116":117,"_118":119,"_672":673,"_674":675,"_676":677,"_678":679,"_680":681,"_682":683,"_684":685,"_686":-5,"_687":-5,"_121":18,"_120":18},"cancellationRequested","affectedProjectRatio",100,"touchedProjects",[669,641],"affectedProjects",[641,642,643,644,191,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668],"criticalWorkflowErrors",[],"projectGraphSha","b1e09ae70e5b4ae3a21538e8d16c6589889942cbdf3e01d7b79e564621114079","fileMapSha","cacheEnabled","hashScope","UNPROTECTED","autoApplyFixes","selfHealing",{"_620":621,"_622":623,"_624":18},"selfHealingSkipInfo",{"_254":615,"_616":617,"_618":619},"cancellation","NO_FIXABLE_TASKS","message","No failed tasks found for this CI Pipeline Execution.","recordedAt",["D",1789062078610],"cliOverrides",{"_83":-5,"_609":-5},"workspaceConfigSnapshot",{"_200":16,"_625":16,"_626":18,"_627":16,"_628":16,"_629":630,"_631":-5,"_632":-5,"_633":634,"_635":636,"_637":638,"_639":-5},"isLongLivedBranch","commentNotificationEnabled","allowAnonymousExternalCommand","enableFlakyRerunsAutomatically","allowDraftPullRequests","protectedBranchPatterns",[],"selfHealingCISetupCompletedAt","fixPatterns","neverFixPatterns",[],"autoApplyIncludePatterns",[640],"autoApplyExcludePatterns",[],"formatCommand","e2e*","forgerock-verdaccio","@forgerock/sdk-request-middleware","@forgerock/davinci-client","@forgerock/davinci-app","@forgerock/journey-client","@forgerock/journey-suites","@forgerock/recognize-app","@forgerock/journey-app","scratchpad","@forgerock/oidc-client","@forgerock/oidc-app","@forgerock/iframe-manager","@forgerock/interface-mapping-validator","@forgerock/storage","@forgerock/sdk-logger","@forgerock/sdk-oidc","@forgerock/device-client","@forgerock/device-client-app","@forgerock/sdk-utilities","@forgerock/pingone-scripts","@forgerock/recognize","@forgerock/sdk-types","@forgerock/api-report","@forgerock/protect","@forgerock/mock-api-v2","@forgerock/oidc-suites","am-mock-api","@forgerock/local-release-tool","*","ref","renovate/undici-8.x","parentShas",[119],"commitLink","https://github.com/ForgeRock/ping-javascript-sdk/pull/806","author","renovate[bot]","authorEmail","29139614+renovate[bot]@users.noreply.github.com","authorUrl","https://github.com/apps/renovate","authorAvatarUrl","https://avatars.githubusercontent.com/in/2740?v=4","repositoryUrl","https://github.com/ForgeRock/ping-javascript-sdk","platformName","runnerProvider",{"_324":139,"_28":82,"_92":325,"_94":326,"_327":328,"_329":330,"_331":-5,"_332":16,"_333":-5,"_334":-5,"_335":336,"_337":338,"_339":16,"_340":341,"_342":18,"_343":689,"_345":346,"_347":348,"_349":-5,"_350":351,"_352":690,"_354":355,"_356":-5,"_357":358},[706],{"_435":691,"_437":692,"_439":693,"_441":694,"_443":695,"_445":696,"_447":697,"_449":698,"_451":699,"_453":700,"_455":701,"_457":702,"_459":703,"_461":704,"_463":705},{"_465":435,"_466":515,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":516,"_475":517},{"_465":437,"_466":512,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":513,"_475":514},{"_465":439,"_466":509,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":510,"_475":511},{"_465":441,"_466":506,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":507,"_475":508},{"_465":443,"_466":185,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":504,"_475":505},{"_465":445,"_466":501,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":502,"_475":503},{"_465":447,"_466":498,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":499,"_475":500},{"_465":449,"_466":495,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":496,"_475":497},{"_465":451,"_466":492,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":493,"_475":494},{"_465":453,"_466":489,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":490,"_475":491},{"_465":455,"_466":486,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":487,"_475":488},{"_465":457,"_466":483,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":484,"_475":485},{"_465":459,"_466":480,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":481,"_475":482},{"_465":461,"_466":477,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":478,"_475":479},{"_465":463,"_466":467,"_468":195,"_469":-5,"_470":-5,"_471":-5,"_472":-5,"_473":474,"_475":476},{"_218":580,"_581":582,"_583":584},"orgId","ping-javascript-sdk","installationSource","vcs-repository","idAccessLevel","READ_ONLY","patAccessLevel","showDteTerminalOutput","nxInitDate",["D",1734537985126],["D",1734537985126],"claimedAt",["D",1734537985126],"retryFlakyTasks","remoteSourceIntegrationType","GITHUB_EVENTLESS","flakyTaskConfiguration",{"_741":742,"_743":744},"showVcsStatusChecks","aiTaskFixingConfiguration",{"_200":16,"_625":16,"_626":18,"_627":16,"_628":16,"_629":737,"_632":-5,"_633":738,"_635":739,"_637":740},{"_236":237,"_731":732,"_733":734,"_735":736},"visibility","ALLOW_UNAUTHENTICATED","repositoryFullName","ForgeRock/ping-javascript-sdk","repositoryId","904926925","repositoryVisibility","PUBLIC",[],[],[640],[],"threshold","NORMAL","samplePeriodDays",28,"currentUser","currentHostname","cloud.nx.app","incident",["P",749],"notifications",["P",751],"showWorkersRenameNotice",["P",753],"showLearnNote",["P",755],"isSystemAdmin","isSingleTenant","isPATExpiryAfterLoginEnabled","isOrganizationAccessEnabled","isUserVcsIntegrationEnabled","isExecutiveReportDisabled","loginas","repositoryAccessProvidersToOffer",[],"redirectTo","/cipes/6aa2eb199bbe3e60867af058/timeline?runGroup=34509367574-1","deferredUserOrganizations",["P",768],"sidebarCollapsed","toast","currentUserId","currentUserEmail","signedInUser","isImpersonating","isBotRequest","ENV",{"_844":16,"_54":18,"_845":16,"_846":16,"_847":16,"_848":849,"_850":851,"_852":18,"_853":854,"_855":856,"_781":857},"posthogBootstrap",{"_811":812,"_813":814},"ultracacheUiEnabled","pylon",{"_803":804,"_805":806,"_196":807,"_808":-7,"_809":810},"requestInfo",{"_785":786,"_787":53,"_398":788,"_789":790,"_791":792},"hints",{"_796":799,"_801":802},"origin","/cipes/6aa2eb199bbe3e60867af058/timeline","url","https://cloud.nx.app/cipes/6aa2eb199bbe3e60867af058/timeline","userPreferences",{"_793":794},"theme",{"_196":795,"_796":797,"_798":799,"_800":799},"default","variant","system","resolvedVariant","light","clientColorScheme","timeZone","UTC","appId","a1074fe2-8172-4ebd-9889-879f8308a0a2","email","c5331e12-3c13-45cd-8fb4-341d3b3160f2@nxcloud.invalid","Anonymous Nx Cloud Visitor","avatarUrl","emailHash","6df4cc740514587dae960a963d2597ea768eb0b76347d68ba98794a4f1430bc9","distinctID","c5331e12-3c13-45cd-8fb4-341d3b3160f2","featureFlags",{"_815":16,"_816":16,"_817":200,"_818":16,"_819":16,"_820":16,"_821":16,"_822":18,"_823":16,"_824":18,"_825":826,"_827":828,"_829":16,"_830":16,"_831":832,"_833":16,"_834":16,"_835":200,"_836":18,"_837":16,"_838":18,"_839":16,"_840":16,"_841":18,"_842":16,"_843":16},"show_setup_self_healing_ci_alert","resource_addon_default","one_page_connect_workspace_gitlab","teams_minimum_spend","pylon_chat","new_access_control","config_yaml","new_layout","non_dte_resource_usage","cipe_execution_timeline","welcome_view_cnw_experiment","variant-2","cnw_empty_workspace_position","treatment","workspace_badges","workspace_continuous_assignment_toggle","one_page_connect_workspace_manual","test","survey-targeting-8e88152ae4-custom","automated_add_ons","one_page_connect_workspace_github","feature_activation_guide","resource_usage_toggle","workspace_packing_budgets_toggle","workspace_sandboxing_toggle","workspace_rewind","run_details_polling","survey-targeting-2f79618ac7-custom","demo-mode","isProduction","isAnalyticsEnabled","isPosthogEnabled","isPylonEnabled","privateCloud",{"_876":867,"_52":53},"auth0",{"_870":871,"_872":873,"_874":875},"e2eTestMode","rollbar",{"_862":863,"_864":865,"_200":16,"_866":867,"_868":16,"_869":16},"posthog",{"_858":859,"_860":861},{"_803":804},"apiKey","phc_eTmACxF0EKeNRjAZbfpdszbHYumyKhWqsIpMU4Wi53c","apiHost","https://pha-prx.ops.cloud.nx.app","accessToken","d0e4070ed1d54ed29429808f497ffbab3e77f1c74c2a9427fa5c5e418eea62ca96294bc716a7e8210acf93f0d37b6d29","environment","production","codeVersion","2610.27.0005.hotfix1","captureUncaught","captureUnhandledRejections","domain","auth.nx.app","clientId","Ron6k221B4IaH0QK9hmHuCneTovLLPpX","audience","https://api.nrwl.io/","containerVersionTimestamp"]