From d96cf35552f7029adedd5dd1fbd7ce21e40cd87d Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Tue, 20 Oct 2026 14:17:05 +0000
Subject: [PATCH] fix: security - upgrade undici to 8.12.2 and 7.30.1

The direct dependency floor is now ^8.12.2. The 7.x override is now 7.30.1. miniflare pins undici 7.29.1, so that override stays.

Co-authored-by: Jared Wray <me@jaredwray.com>
---
 packages/net/package.json |  2 +-
 pnpm-lock.yaml            | 26 +++++++++++++-------------
 pnpm-workspace.yaml       |  8 ++++++--
 3 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/packages/net/package.json b/packages/net/package.json
index 5b28e5b8..64860602 100644
--- a/packages/net/package.json
+++ b/packages/net/package.json
@@ -44,7 +44,7 @@
 		"cacheable": "workspace:^",
 		"hookified": "^3.0.4",
 		"http-cache-semantics": "^4.2.0",
-		"undici": "^8.11.2"
+		"undici": "^8.12.2"
 	},
 	"keywords": [
 		"cacheable",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ae9f4b36..a1f26d06 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -165,7 +165,7 @@ settings:
 overrides:
   chokidar: 4.0.1
   proxy-addr: 2.0.8
-  undici@>=7.0.0 <8.0.0: 7.30.0
+  undici@>=7.0.0 <8.0.0: 7.30.1
   minimatch@>=10.0.0 <11.0.0: 10.2.6
   brace-expansion@>=1.0.0 <2.0.0: 1.1.21
   brace-expansion@>=2.0.0 <3.0.0: 2.1.7
@@ -433,8 +433,8 @@ importers:
         specifier: ^4.2.0
         version: 4.2.0
       undici:
-        specifier: ^8.11.2
-        version: 8.11.2
+        specifier: ^8.12.2
+        version: 8.12.2
     devDependencies:
       '@types/http-cache-semantics':
         specifier: ^4.2.0
@@ -4024,12 +4024,12 @@ packages:
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
-  undici@7.30.0:
-    resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==}
+  undici@7.30.1:
+    resolution: {integrity: sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==}
     engines: {node: '>=20.18.1'}
 
-  undici@8.11.2:
-    resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==}
+  undici@8.12.2:
+    resolution: {integrity: sha512-XtuDWVdqTLr3NAxm2ly9/hU6kUsJOgGh1RASzMBbsw6aWCOaQzHdW+QQDfdERjfJ2V5vL5pRPa4RetO9UfivDg==}
     engines: {node: '>=22.19.0'}
 
   unenv@2.0.0-rc.24:
@@ -4321,7 +4321,7 @@ snapshots:
       '@standard-schema/spec': 1.1.0
       '@workflow/serde': 4.1.0
       eventsource-parser: 3.0.8
-      undici: 7.30.0
+      undici: 7.30.1
       zod: 4.6.5
 
   '@ai-sdk/provider@4.0.19':
@@ -4422,7 +4422,7 @@ snapshots:
       cacheable: 2.5.0
       hookified: 1.15.1
       http-cache-semantics: 4.2.0
-      undici: 7.30.0
+      undici: 7.30.1
 
   '@cacheable/utils@2.5.0':
     dependencies:
@@ -5681,7 +5681,7 @@ snapshots:
       ipaddr.js: 2.5.0
       jiti: 2.7.0
       serve-handler: 6.1.7
-      undici: 8.11.2
+      undici: 8.12.2
       update-notifier: 7.3.1
       writr: 6.1.6(supports-color@10.2.2)
     transitivePeerDependencies:
@@ -6864,7 +6864,7 @@ snapshots:
     dependencies:
       '@cspotcode/source-map-support': 0.8.1
       sharp: 0.35.5(@types/node@24.19.0)
-      undici: 7.30.0
+      undici: 7.30.1
       workerd: 1.20261006.1
       ws: 8.21.0
       youch: 4.1.0-beta.10
@@ -7830,9 +7830,9 @@ snapshots:
 
   undici-types@7.24.6: {}
 
-  undici@7.30.0: {}
+  undici@7.30.1: {}
 
-  undici@8.11.2: {}
+  undici@8.12.2: {}
 
   unenv@2.0.0-rc.24:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index bb88d38a..4d1293a2 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -9,6 +9,8 @@ dangerouslyAllowAllBuilds: false
 trustPolicy: no-downgrade # fail if a later version has weaker trust evidence
 minimumReleaseAgeExclude:
   - '@babel/*'
+  # undici 7.30.1 and 8.12.2 fix the High advisories. Both releases are younger than 7 days.
+  - 'undici@7.30.1 || 8.12.2'
 allowBuilds:
   esbuild: true
   protobufjs: true
@@ -23,8 +25,10 @@ overrides:
   chokidar: 4.0.1
   # CVE-2026-90711. express accepts proxy-addr ^2.0.7.
   proxy-addr: 2.0.8
-  # CVE-2026-19534 and CVE-2026-84961. Direct undici 8.11.2 includes the 8.x fix.
-  "undici@>=7.0.0 <8.0.0": 7.30.0
+  # CVE-2026-19534 and CVE-2026-84961. miniflare pins undici 7.29.1.
+  # That pin cannot reach 7.30.1. The same pin covers AIKIDO-2026-846025,
+  # AIKIDO-2026-393834, and AIKIDO-2026-159850.
+  "undici@>=7.0.0 <8.0.0": 7.30.1
   # CVE-2026-27903 and CVE-2026-27904. minimatch 3.1.5 includes the 3.x fix.
   "minimatch@>=10.0.0 <11.0.0": 10.2.6
   # CVE-2026-102276, CVE-2026-102278, and the other brace-expansion DoS fixes.