From fa4f953f9650771859dc7fd4dff3d0270ec4316e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 1 Nov 2026 13:38:43 +0000
Subject: [PATCH] fix(deps): require undici 8.12.3 for security fixes

undici 8.0.0 - 8.12.1 has high-severity advisories (TLS validation bypass in
ProxyAgent/BalancedPool, header and cookie injection, response desync and
several DoS issues). Raise the floor to 8.12.3 and refresh the lockfile,
which also picks up tmp 0.2.7 (GHSA-ph9p-34f9-6g65) under the noble HCI
socket's patch-package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LzktUt9rqfrSfRydbWruTR
---
 package-lock.json | 16 ++++++++--------
 package.json      |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 65c77d6a..97fb623a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6,11 +6,11 @@
   "packages": {
     "": {
       "name": "node-switchbot",
-      "version": "5.2.0",
+      "version": "6.0.2",
       "license": "MIT",
       "dependencies": {
         "@stoprocent/noble": "^2.4.0",
-        "undici": "^8.0.2"
+        "undici": "^8.12.3"
       },
       "devDependencies": {
         "@antfu/eslint-config": "^8.1.1",
@@ -7753,9 +7753,9 @@
       }
     },
     "node_modules/tmp": {
-      "version": "0.2.5",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
-      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
+      "integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==",
       "license": "MIT",
       "engines": {
         "node": ">=14.14"
@@ -7929,9 +7929,9 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.0.2.tgz",
-      "integrity": "sha512-B9MeU5wuFhkFAuNeA19K2GDFcQXZxq33fL0nRy2Aq30wdufZbyyvxW3/ChaeipXVfy/wUweZyzovQGk39+9k2w==",
+      "version": "8.12.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz",
+      "integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==",
       "license": "MIT",
       "engines": {
         "node": ">=22.19.0"
diff --git a/package.json b/package.json
index c8df0c80..a7ba8c20 100644
--- a/package.json
+++ b/package.json
@@ -64,7 +64,7 @@
   "readmeFilename": "README.md",
   "dependencies": {
     "@stoprocent/noble": "^2.4.0",
-    "undici": "^8.0.2"
+    "undici": "^8.12.3"
   },
   "optionalDependencies": {
     "@stoprocent/bluetooth-hci-socket": "^2.2.5"