[Security] Bump undici from 5.10.0 to 5.21.0

Bumps undici from 5.10.0 to 5.21.0. This update includes security fixes.

Vulnerabilities fixed

Regular Expression Denial of Service in Headers

Impact

The Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function.

Patches

This vulnerability was patched in v5.19.1.

Workarounds

There is no workaround. Please update to an unaffected version.

References

• https://hackerone.com/bugs?report_id=1784449

Credits

Carter Snook reported this vulnerability.

Patched versions: 5.19.1 Affected versions: < 5.19.1

CRLF Injection in Nodejs ‘undici’ via host

Impact

undici library does not protect host HTTP header from CRLF injection vulnerabilities.

Patches

This issue was patched in Undici v5.19.1.

Workarounds

Sanitize the headers.host string before passing to undici.

References

Reported at https://hackerone.com/reports/1820955.

Credits

Thank you to Zhipeng Zhang (@​timon8) for reporting this vulnerability.

Patched versions: 5.19.1 Affected versions: >= 2.0.0, < 5.19.1

Release notes

Sourced from undici's releases.

v5.21.0

What's Changed

• workflow: add scorecard.yml by @​RafaelGSS in nodejs/undici#1942
• ci: timeout CI jobs after 15 minutes by @​dominykas in nodejs/undici#1946
• test(wpt): respect variants by @​panva in nodejs/undici#1951
• fix: improve isFormDataLike compat by @​ronag in nodejs/undici#1953
• fix: flaky fetch tests by @​KhafraDev in nodejs/undici#1956
• test(wpt): include all testing files by @​KhafraDev in nodejs/undici#1954
• fix: remove unneeded fetch tests by @​KhafraDev in nodejs/undici#1960
• fix: use normal timers for delays < 1s by @​ronag in nodejs/undici#1961
• perf: optimize happy path by @​anonrig in nodejs/undici#1955
• fix: 🐛 add URL upstream variations in BalancedPool types by @​jimmy-guzman in nodejs/undici#1966
• test(wpt): handle uncaught exceptions by @​KhafraDev in nodejs/undici#1965
• Fix failing wpts by @​KhafraDev in nodejs/undici#1967
• test(wpt): add results to an existing WPT Report by @​panva in nodejs/undici#1944
• fix: strengthen isStream condition checking by @​debadree25 in nodejs/undici#1969
• fix: implement basic policy container by @​KhafraDev in nodejs/undici#1970
• TypeScript type fixes, for #1949 by @​joshxyzhimself in nodejs/undici#1968
• websocket: separate connection logic from websocket by @​KhafraDev in nodejs/undici#1973
• README: h3 not showing ### as a header by @​hilleer in nodejs/undici#1975
• wptrunner: expose gc by @​KhafraDev in nodejs/undici#1974
• perf: cork socket before writing by @​ronag in nodejs/undici#1982
• fix: fast timers and event loop lag by @​ronag in nodejs/undici#1977
• fix: correctly calculate resource timing duration by @​amilajack in nodejs/undici#1988
• wpt: update tests by @​KhafraDev in nodejs/undici#1984
• fix: undici stream throwOnError by @​dancastillo in nodejs/undici#1995
• fix: remove unnecessary WeakRef by @​ronag in nodejs/undici#2000
• Fix: websocket.d.ts - error TS2304: Cannot find name 'MessagePort' by @​ZaBlazzingZephyrus in nodejs/undici#1997
• feat: add abort signal to body.dump() by @​debadree25 in nodejs/undici#1993
• fix(fetch): third party abortcontrollers throwing errors by @​KhafraDev in nodejs/undici#2002
• Improve ProxyAgent example with autentication by @​egmen in nodejs/undici#2004
• Add clientFactory option to ProxyAgent by @​andrewfecenko in nodejs/undici#2003

New Contributors

• @​jimmy-guzman made their first contribution in nodejs/undici#1966
• @​hilleer made their first contribution in nodejs/undici#1975
• @​amilajack made their first contribution in nodejs/undici#1988
• @​ZaBlazzingZephyrus made their first contribution in nodejs/undici#1997
• @​egmen made their first contribution in nodejs/undici#2004
• @​andrewfecenko made their first contribution in nodejs/undici#2003

Full Changelog: https://github.com/nodejs/undici/compare/v5.20.0...v5.21.0

v5.20.0

What's Changed

• perf: improve cookie parsing performance by @​KhafraDev in nodejs/undici#1931
• fix: disable websocket wpts in ci :( by @​KhafraDev in nodejs/undici#1932
• fix: Allow “undefined“ as value in headers by @​pan93412 in nodejs/undici#1929
• feat: Support autoSelectFamily when connecting. by @​ShogunPanda in nodejs/undici#1914
• fix: copy cookies when cloning haders by @​KhafraDev in nodejs/undici#1936

... (truncated)

Commits

• 98b63b2 Bumped v5.21.0
• 90d45fa Add clientFactory option to ProxyAgent (#2003)
• 1bbcfa2 Improve ProxyAgent example with autentication (#2004)
• 06c6488 fix(fetch): third party abortcontrollers throwing errors (#2002)
• 65eea9b feat: add abort signal to body.dump() (#1993)
• 0d2f4f1 Add missing import (#1997)
• babed9c fix: remove unnecessary WeakRef (#2000)
• a0afde8 fix: undici stream throwOnError (#1995)
• 3606c35 wpt: update tests (#1984)
• 71c3605 fix: correctly calculate resource timing duration (#1988)
• Additional commits viewable in compare view

---

Dependabot commands

You can trigger Dependabot actions by commenting on this MR

• $dependabot rebase will rebase this MR
• $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts