Bump undici to 5.28.2 (#742)

Addresses low severity `npm audit` warning: GHSA-wqq4-5wpv-mx2g Fixes #607 Fixes #738
cloudflare · Jan 4, 2024 · bee57ff · bee57ff
1 parent a904927
commit bee57ff
Show file tree

Hide file tree

Showing 11 changed files with 56 additions and 43 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/cache/package.json b/packages/cache/package.json
@@ -38,7 +38,7 @@
  "@miniflare/core": "2.14.1",
  "@miniflare/shared": "2.14.1",
  "http-cache-semantics": "^4.1.0",
- "undici": "5.20.0"
+ "undici": "5.28.2"
  },
  "devDependencies": {
  "@miniflare/shared-test": "2.14.1",

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -46,7 +46,7 @@
  "dotenv": "^10.0.0",
  "kleur": "^4.1.4",
  "set-cookie-parser": "^2.4.8",
- "undici": "5.20.0",
+ "undici": "5.28.2",
  "urlpattern-polyfill": "^4.0.3"
  },
  "devDependencies": {

diff --git a/packages/core/src/standards/http.ts b/packages/core/src/standards/http.ts
@@ -796,14 +796,10 @@ class MiniflareDispatcher extends Dispatcher {
  options: Dispatcher.DispatchOptions,
  handler: Dispatcher.DispatchHandlers
  ): boolean {
+ // Remove any default fetch headers that the user didn't explicitly set,
+ // `headers` has the form `["key1", "value1", "key2", "value2", ...]`
  const headers = options.headers;
- if (headers) {
- // Note: I'm fully expecting this to break in future undici versions
- // and need to be updated, but that's why we pin our undici version and
- // have tests
- assert(Array.isArray(headers));
- // Remove any default fetch headers that the user didn't explicitly set,
- // `headers` has the form `["key1", "value1", "key2", "value2", ...]`
+ if (Array.isArray(headers)) {
  let i = 0;
  while (i < headers.length) {
  if (this.removeHeaders.includes(headers[i].toLowerCase())) {
@@ -812,6 +808,10 @@ class MiniflareDispatcher extends Dispatcher {
  i += 2;
  }
  }
+ } else if (headers != null) {
+ for (const key in headers) {
+ if (this.removeHeaders.includes(key.toLowerCase())) delete headers[key];
+ }
  }
  return this.inner.dispatch(options, handler);
  }

diff --git a/packages/durable-objects/package.json b/packages/durable-objects/package.json
@@ -38,7 +38,7 @@
  "@miniflare/core": "2.14.1",
  "@miniflare/shared": "2.14.1",
  "@miniflare/storage-memory": "2.14.1",
- "undici": "5.20.0"
+ "undici": "5.28.2"
  },
  "devDependencies": {
  "@miniflare/cache": "2.14.1",

diff --git a/packages/html-rewriter/package.json b/packages/html-rewriter/package.json
@@ -38,7 +38,7 @@
  "@miniflare/core": "2.14.1",
  "@miniflare/shared": "2.14.1",
  "html-rewriter-wasm": "^0.4.1",
- "undici": "5.20.0"
+ "undici": "5.28.2"
  },
  "devDependencies": {
  "@miniflare/shared-test": "2.14.1"

diff --git a/packages/http-server/package.json b/packages/http-server/package.json
@@ -40,7 +40,7 @@
  "@miniflare/web-sockets": "2.14.1",
  "kleur": "^4.1.4",
  "selfsigned": "^2.0.0",
- "undici": "5.20.0",
+ "undici": "5.28.2",
  "ws": "^8.2.2",
  "youch": "^2.2.2"
  },

diff --git a/packages/miniflare/package.json b/packages/miniflare/package.json
@@ -66,7 +66,7 @@
  "kleur": "^4.1.4",
  "semiver": "^1.1.0",
  "source-map-support": "^0.5.20",
- "undici": "5.20.0"
+ "undici": "5.28.2"
  },
  "devDependencies": {
  "@miniflare/shared-test": "2.14.1",

diff --git a/packages/r2/package.json b/packages/r2/package.json
@@ -37,7 +37,7 @@
  "dependencies": {
  "@miniflare/core": "2.14.1",
  "@miniflare/shared": "2.14.1",
- "undici": "5.20.0"
+ "undici": "5.28.2"
  },
  "devDependencies": {
  "@miniflare/shared-test": "2.14.1"

diff --git a/packages/vitest-environment-miniflare/package.json b/packages/vitest-environment-miniflare/package.json
@@ -41,7 +41,7 @@
  "@miniflare/queues": "2.14.1",
  "@miniflare/shared": "2.14.1",
  "@miniflare/shared-test-environment": "2.14.1",
- "undici": "5.20.0"
+ "undici": "5.28.2"
  },
  "peerDependencies": {
  "vitest": ">=0.23.0"

diff --git a/packages/web-sockets/package.json b/packages/web-sockets/package.json
@@ -37,7 +37,7 @@
  "dependencies": {
  "@miniflare/core": "2.14.1",
  "@miniflare/shared": "2.14.1",
- "undici": "5.20.0",
+ "undici": "5.28.2",
  "ws": "^8.2.2"
  },
  "devDependencies": {