RobinTail / express-zod-api / 39992943739

100%

push

github

chore(deps): update dependency undici to v8.12.2 (#3773)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [undici](https://undici.nodejs.org)
([source](https://redirect.github.com/nodejs/undici)) | [`8.12.1` →
`8.12.2`](https://renovatebot.com/diffs/npm/undici/8.12.1/8.12.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/undici/8.12.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/undici/8.12.1/8.12.2?slim=true)
|

---

### Release Notes

<details>
<summary>nodejs/undici (undici)</summary>

###
[`v8.12.2`](https://redirect.github.com/nodejs/undici/releases/tag/v8.12.2)

[Compare
Source](https://redirect.github.com/nodejs/undici/compare/v8.12.1...v8.12.2)

#### Security fixes

##### High severity

##### Denial of service via TLS 1.2 certificate-changing renegotiation

**CVE-2026-87018 ·
[GHSA-qrxm-fqhp-jwvm](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)**

A malicious or compromised HTTPS server could crash the Node.js process
by initiating TLS 1.2 renegotiation and presenting a different,
CA-trusted certificate whose hostname did not match the requested host.
The resulting socket error reached an assertion in undici's HTTP/1.1 and
HTTP/2 connection handling. This release handles post-connect
certificate errors without terminating the process.

##### TLS certificate validation bypass through dropped `Agent` options

**CVE-2026-109383 ·
[GHSA-2m5v-pch6-74hx](https://redirect.github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)**

`Agent` used a JSON-based clone for constructor options, which silently
removed function-valued TLS options such as `checkServerIdentity`.
Applications relying on custom certificate or public-key verification
could therefore accept a certificate that the callback was intended to
rejec... (continued)

1172 of 1220 branches covered (96.07%)

1678 of 1678 relevant lines covered (100.0%)

598.4 hits per line