fix(ci): bump undici to 8.12.2 for CVE-2026-109869 #229

Merged

peterswimm merged 1 commit from fix/undici-cve-2026-109869 into main

2026-10-24 20:23:01 +00:00

peterswimm commented

2026-10-24 19:15:30 +00:00

Owner

Scope

Fixes the red Trivy filesystem scan on main (run 1222, at e6e1f03).

The scan found one HIGH: CVE-2026-109869, a denial of service in undici caused by an unhandled stream error. The installed version is 8.10.2 and the fix is in 8.12.2. undici is a transitive dependency of jsdom 30.0.1 (which asks for ^8.9.0) in .forgejo/block-validation. This PR changes only the lockfile: the version, resolved URL and integrity hash of that one entry, the same kind of change as the earlier source-map-js fix (b028d98). package.json is untouched, and undici's engines (node >=22.19.0) and dependencies (none) are the same in both versions.

Nothing in this repo caused the failure. Run 1215 passed with the same lockfile, and the advisory reached trivy's DB afterwards.

Testing

Run locally against this branch and, as a control, against unpatched main:

trivy fs --exit-code 1 --severity HIGH,CRITICAL --scanners vuln,secret,misconfig . with trivy 0.72.0 (CI's pinned version):
- main @ e6e1f03: rc=1, undici 8.10.2 CVE-2026-109869 HIGH, the same result as the CI run.
- this branch: rc=0, 0 findings across the whole repo (counted from --format json).
In node:22-slim (the block-validation image): npm ci --no-audit --no-fund passes the integrity check and installs undici 8.12.2. validate-blocks.cjs over the same file set CI uses reports "31 file(s) validate", run against a local Toilville_Rituals checkout at 9fb32997.

Impact Statement

Existing features: No expected impact. undici is used only by jsdom inside the CI block validator.
Public APIs / contracts: None.
Schemas: None.
Data / artifacts: None. The CI-only node_modules gets a newer undici.
Integrations: None.
Mappings: None.
Backward compatibility: This is a minor-version bump inside jsdom's declared range, with the same engines constraint.

Docs

None needed.

## Scope Fixes the red `Trivy filesystem scan` on main ([run 1222](https://git.toilville.dev/Toilville/toilville-design/actions/runs/1222/jobs/0/attempt/1), at e6e1f03). The scan found one HIGH: **CVE-2026-109869**, a denial of service in **undici** caused by an unhandled stream error. The installed version is 8.10.2 and the fix is in 8.12.2. undici is a transitive dependency of `jsdom` 30.0.1 (which asks for `^8.9.0`) in `.forgejo/block-validation`. This PR changes only the lockfile: the version, resolved URL and integrity hash of that one entry, the same kind of change as the earlier source-map-js fix (b028d98). `package.json` is untouched, and undici's `engines` (`node >=22.19.0`) and dependencies (none) are the same in both versions. Nothing in this repo caused the failure. Run 1215 passed with the same lockfile, and the advisory reached trivy's DB afterwards. ## Testing Run locally against this branch and, as a control, against unpatched main: - `trivy fs --exit-code 1 --severity HIGH,CRITICAL --scanners vuln,secret,misconfig .` with trivy 0.72.0 (CI's pinned version): - main @ e6e1f03: rc=1, `undici 8.10.2 CVE-2026-109869 HIGH`, the same result as the CI run. - this branch: rc=0, 0 findings across the whole repo (counted from `--format json`). - In `node:22-slim` (the block-validation image): `npm ci --no-audit --no-fund` passes the integrity check and installs undici 8.12.2. `validate-blocks.cjs` over the same file set CI uses reports "31 file(s) validate", run against a local Toilville_Rituals checkout at 9fb32997. ## Impact Statement - Existing features: No expected impact. undici is used only by jsdom inside the CI block validator. - Public APIs / contracts: None. - Schemas: None. - Data / artifacts: None. The CI-only `node_modules` gets a newer undici. - Integrations: None. - Mappings: None. - Backward compatibility: This is a minor-version bump inside jsdom's declared range, with the same engines constraint. ## Docs None needed.

peterswimm added 1 commit

2026-10-24 19:15:30 +00:00

fix(ci): bump undici to 8.12.2 for CVE-2026-109869

PR policy check / policy-gate (pull_request) Successful in 1s

Details

Test Generator / lint-workflows (pull_request) Successful in 36s

Details

Security Scans / Gitleaks secret scan (pull_request) Successful in 42s

Details

Security Scans / Trivy filesystem scan (pull_request) Successful in 44s

Details

Test Generator / lint-prose (pull_request) Successful in 46s

Details

Copy coverage / Design copy reaching rendered HTML (pull_request) Successful in 49s

Details

UDG dist drift gate / dist/ matches dtcg + udg sources (pull_request) Successful in 19s

Details

Block Validation / validate (pull_request) Successful in 1m40s

Details

Test Generator / test (pull_request) Successful in 4m16s

Details

de128581a4

trivy: CVE-2026-109869 (HIGH) in undici 8.10.2, a denial of service via
an unhandled stream error; fixed in 8.12.2. undici comes in through
jsdom 30.0.1 (^8.9.0), so this is a lockfile-only bump in
.forgejo/block-validation, the same shape as the source-map-js fix.

The lockfile did not change: the advisory landed in trivy's DB, which
turned the Trivy filesystem scan red on main at e6e1f03 (run 1222).

peterswimm merged commit 0767783fb7 into main

2026-10-24 20:23:01 +00:00

peterswimm deleted branch fix/undici-cve-2026-109869

2026-10-24 20:23:01 +00:00

peterswimm referenced this pull request from a commit

2026-10-24 20:23:03 +00:00

Merge pull request 'fix(ci): bump undici to 8.12.2 for CVE-2026-109869' (#229) from fix/undici-cve-2026-109869 into main