[dependabot]

Bumps undici from 7.16.0 to 7.17.0.

Release notes

Sourced from undici's releases.

v7.17.0

What's Changed

• chore: extract infra and encoding methods by @​Uzlopak in nodejs/undici#4523
• ci: remove h2 by @​Uzlopak in nodejs/undici#4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @​Uzlopak in nodejs/undici#4535
• ci: fix nightly shared library case by @​Uzlopak in nodejs/undici#4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @​Uzlopak in nodejs/undici#4528
• docs: add Cache Interceptor example to README by @​tawseefnabi in nodejs/undici#4393
• test: remove node20 version check by @​Uzlopak in nodejs/undici#4544
• types: use MessagePort instance type in MessageEvent by @​Renegade334 in nodejs/undici#4546
• ci: set write permissions on job level by @​Uzlopak in nodejs/undici#4537
• lint: activate n/no-process-exit by @​Uzlopak in nodejs/undici#4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @​Uzlopak in nodejs/undici#4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @​Uzlopak in nodejs/undici#4547
• feat(H2): correct CONNECT behaviour by @​metcoder95 in nodejs/undici#4541
• test: fix plans by @​Uzlopak in nodejs/undici#4550
• feat: add runtime feature "detection" by @​Uzlopak in nodejs/undici#4545
• perf: use less promises in extractBody by @​Uzlopak in nodejs/undici#4458
• fix(proxy-agent): add missing return after callback-call by @​Uzlopak in nodejs/undici#4553
• fix: remove redundant line in retry-handler by @​Uzlopak in nodejs/undici#4554
• ci: add no-wasm-simd option by @​Uzlopak in nodejs/undici#4533
• fix: use lazyloaders for runtime feature detection by @​Uzlopak in nodejs/undici#4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @​Uzlopak in nodejs/undici#4556
• http2: refactor and split tests of http2.js into multiple files by @​Uzlopak in nodejs/undici#4561
• fix: dns-interceptor test should await plan to complete by @​Uzlopak in nodejs/undici#4560
• chore: remove istanbul instructions by @​Uzlopak in nodejs/undici#4559
• fix: keep promise chains intact by @​Uzlopak in nodejs/undici#4558
• build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @​dependabot[bot] in nodejs/undici#4567
• chore: remove tspl from eventsource by @​Uzlopak in nodejs/undici#4569
• chore: remove tspl from fetch by @​Uzlopak in nodejs/undici#4570
• feat: add getUpstream() method to BalancedPool by @​mcollina in nodejs/undici#4586
• fetch: handle invalid priority values properly by @​Uzlopak in nodejs/undici#4522
• ci: fix test coverage for codecov by @​Uzlopak in nodejs/undici#4520
• types: optional status in Response.redirect by @​gineika in nodejs/undici#4591
• docs: unix socket add-on by @​FelixVaughan in nodejs/undici#4587
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @​dependabot[bot] in nodejs/undici#4601
• build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @​dependabot[bot] in nodejs/undici#4600
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in nodejs/undici#4603
• build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @​dependabot[bot] in nodejs/undici#4604
• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in nodejs/undici#4602
• build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @​dependabot[bot] in nodejs/undici#4598
• build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @​dependabot[bot] in nodejs/undici#4599
• build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @​dependabot[bot] in nodejs/undici#4597
• fix: cacheStores types and usage in README by @​lucalooz in nodejs/undici#4605
• Feat dns interceptor storage by @​SuperOleg39 in nodejs/undici#4589
• docs: add crawling best practices by @​Uzlopak in nodejs/undici#4590
• fix: 304 not modified reply upon revalidation did not update cache. by @​daan944 in nodejs/undici#4617
• chore: use testcontext for test:infra by @​Uzlopak in nodejs/undici#4579
• fetch: improve regexes in data-uri.js by @​Uzlopak in nodejs/undici#4483
• perf: optimize validate http token by @​PandaWorker in nodejs/undici#4608

... (truncated)

Commits

• d560767 Bumped v7.17.0 (#4724)
• ec4a84e fix(test): remove hardcoded folder name in client-error-stack-trace test (#4707)
• 59fd5f4 chore: use testcontext for mock tests (#4582)
• b902551 feat: add deduplicate interceptor for request deduplication (#4679)
• 80756ca fix(docs): remove unused TypeScript example code block (#4701)
• e3fedb0 feat: support h2c over unix domain sockets (#4690)
• 5024d1b fix: snapshot url exclusion (#4670)
• e0700dd build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4682)
• fdafc2a Formdata ignore epilogue preamble (#4672)
• fbfac48 feat: Round robin pool (#4650)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
api	Ready	Preview, Comment	Jan 5, 2026 3:40pm

[claude]

Code Review: PR #47 - Bump undici from 7.16.0 to 7.17.0

Summary

This is a dependency bump for the undici HTTP client library from v7.16.0 to v7.17.0, a minor version update. The changes are minimal and affect only package.json and package-lock.json.

✅ Strengths

1. Safe Version Bump: Minor version updates are backwards-compatible and should not introduce breaking changes.

2. Well-Maintained Upstream: The undici project (Node.js HTTP client) is actively maintained by the Node.js team. The v7.17.0 release includes:

   • Performance improvements (e.g., "perf: use less promises in extractBody")
   • Bug fixes (proxy-agent fixes, promise chain integrity)
   • New features (deduplicate interceptor, H2 over unix domain sockets)
   • CI/infrastructure improvements

3. Minimal Impact: Only dependency files are affected - no application code changes required.

4. Dependabot Generated: Properly formatted PR with clear changelog and Dependabot integration.

🔍 Verification Recommendations

1. CI Validation: Confirm this PR passes the existing lint and test workflows:

   • npm run lint checks TypeScript and Prettier formatting
   • Any additional test suites (if present) should pass

2. Compatibility Check: Given your project uses undici as a transitive dependency, verify it's not directly imported anywhere:

   grep -r "undici" api/ --include="*.ts"

   If undici is only used transitively, this update is completely transparent.

3. Performance Impact: The v7.17.0 release includes performance optimizations in body extraction, which should be neutral or beneficial with no breaking changes.

🚀 Performance & Security

• Performance: This release includes performance improvements, particularly around promise handling and body extraction.
• Security: No security vulnerabilities mentioned in the release notes, and this is a maintenance update from the official Node.js HTTP client maintainers.

📋 Test Coverage

• No explicit test coverage changes: This is expected for a dependency bump.
• Lint checks: The PR will be validated by your existing lint workflow (ESLint + Prettier).

✨ Recommendations

1. Monitor the CI Run: Once CI passes, this is safe to merge.
2. No Code Changes Needed: The version bump is self-contained.
3. Release Notes: For future reference, the v7.17.0 changelog shows improvements worth noting in release notes if you track dependencies.

Final Assessment

✅ Ready to merge - This is a standard minor version bump from a well-maintained upstream library with positive improvements and no breaking changes.

[dependabot]

Superseded by #51.