[Security] Bump undici from 5.21.2 to 5.26.3

Bumps undici from 5.21.2 to 5.26.3. This update includes a security fix.

Vulnerabilities fixed

Undici's cookie header not cleared on cross-origin redirect in fetch

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

Patched versions: 5.26.2 Affected versions: < 5.26.2

Release notes

Sourced from undici's releases.

v5.26.3

No release notes provided.

v5.26.2

Security Release, CVE-2023-45143.

v5.26.1

What's Changed

• Fix publish undici-types once and for all! by @​Ethan-Arrowood in nodejs/undici#2338
• Fix node detection omfg by @​KhafraDev in nodejs/undici#2341

Full Changelog: https://github.com/nodejs/undici/compare/v5.26.0...v5.26.1

v5.26.0

What's Changed

• use npm install instead of npm ci by @​Ethan-Arrowood in nodejs/undici#2309
• change default header to node by @​Ethan-Arrowood in nodejs/undici#2310
• chore: change order of the pseudo-headers by @​kyrylodolynskyi in nodejs/undici#2308
• fix: Agent.Options.factory should accept URL object or string as parameter by @​nicole0707 in nodejs/undici#2295
• build(deps-dev): bump sinon from 15.2.0 to 16.1.0 by @​dependabot in nodejs/undici#2312
• test: handle npm ignore-scripts settings by @​panva in nodejs/undici#2313
• feat: respect --max-http-header-size Node.js flag by @​balazsorban44 in nodejs/undici#2234
• fix(#2311): End stream after body sent by @​metcoder95 in nodejs/undici#2314
• disallow setting host header in fetch by @​KhafraDev in nodejs/undici#2322
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in nodejs/undici#2325
• fix fetch with coverage enabled by @​KhafraDev in nodejs/undici#2330
• Fix stuck when using http2 POST Buffer by @​binsee in nodejs/undici#2336
• fix: 🏷️ add allowH2 to BuildOptions by @​binsee in nodejs/undici#2334
• fix: 🐛 fix process http2 header by @​binsee in nodejs/undici#2332

New Contributors

• @​kyrylodolynskyi made their first contribution in nodejs/undici#2308
• @​nicole0707 made their first contribution in nodejs/undici#2295
• @​balazsorban44 made their first contribution in nodejs/undici#2234
• @​binsee made their first contribution in nodejs/undici#2336

Full Changelog: https://github.com/nodejs/undici/compare/v5.23.4...v5.26.0

v5.25.3

What's Changed

• perf: improve parse-url implementation by @​anonrig in nodejs/undici#2286
• test: enable websockets inclusion in WPTReport by @​panva in nodejs/undici#2284
• remove npm run test from pre-commit hook by @​dancastillo in nodejs/undici#2296
• perf: use @​fastify/busboy by @​gurgunday in nodejs/undici#2211
• Disable finalizationregistry if node code cov by @​mcollina in nodejs/undici#2298

New Contributors

• @​gurgunday made their first contribution in nodejs/undici#2211

... (truncated)

Commits

• 227b9be 5.26.3
• 5351f1f include esbuild script in files
• 12a6218 Bumped v5.26.2
• e041de3 Merge pull request from GHSA-wqq4-5wpv-mx2g
• c8c80b1 5.26.1
• 7bcb80c Fix node detection omfg (#2341)
• 69ea7b9 hopefully this fixes it for good (#2338)
• 4006aaf Bumped v5.26.0
• df97958 fix: 🐛 fix process http2 header (#2332)
• b9d8368 fix: 🏷️ add allowH2 to BuildOptions (#2334)
• Additional commits viewable in compare view

---

Dependabot commands

You can trigger Dependabot actions by commenting on this MR

• $dependabot rebase will rebase this MR
• $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts