chore(deps): (deps): bump the production group across 1 directory with 3 updates by dependabot[bot] · Pull Request #961 · tidev/titanium-cli

dependabot · 2026-07-15T02:44:55Z

Bumps the production group with 1 update in the / directory: undici.

Updates undici from 8.5.0 to 8.7.0

Release notes

v8.7.0

What's Changed

test: guard balanced-pool error port lookup by @mcollina in nodejs/undici#5463

perf: optimize http/2 request hot path by @mcollina in nodejs/undici#5483

fix: do not reject open-ended Range values in simpleRangeHeaderValue by @spokodev in nodejs/undici#5490

fix(eventsource): set use-URL-credentials flag by @Ram-blip in nodejs/undici#5489

test: deflake connect-timeout watchdog by @mcollina in nodejs/undici#5197

docs: correct npm script name and JSON syntax in examples by @lenoxfernando in nodejs/undici#5496

fix: reject non-ascii octets in validateCookiePath by @spokodev in nodejs/undici#5452

fix(readable): ignore late consume chunks by @marko1olo in nodejs/undici#5375

fix(h2): destroy the stream on abort instead of relying on close() by @staylor in nodejs/undici#5462

fix: ignore an unparseable Set-Cookie Expires attribute by @spokodev in nodejs/undici#5488

docs: add reproduction guide and update bug report template by @mcollina in nodejs/undici#5451

fix(h2): guard onResponse against a 'response' event delivered after completion by @staylor in nodejs/undici#5440

fix(h2): requeue request on GOAWAY'd session instead of crashing by @staylor in nodejs/undici#5453

fix: add static buildDispatch method to RedirectHandler type definition by @matthieusieben in nodejs/undici#5442

fix: auto-detect HTTP proxy tunneling by @mcollina in nodejs/undici#5116

New Contributors

@spokodev made their first contribution in nodejs/undici#5490

@lenoxfernando made their first contribution in nodejs/undici#5496

@staylor made their first contribution in nodejs/undici#5462

Full Changelog: nodejs/undici@v8.6.0...v8.7.0

v8.6.0

What's Changed

build(deps-dev): bump proxy from 4.0.0 to 4.1.0 by @dependabot[bot] in nodejs/undici#5433

update accept-encoding header in fetch by @KhafraDev in nodejs/undici#5439

fix: drop response chunks after the response stream is destroyed (#5356) by @cesarvspr in nodejs/undici#5357

fix: handle incomplete multi-byte UTF-8 sequences in setEncoding() by @joecwu in nodejs/undici#5003

fix(retry): keep flow-control wired to the active connection across resumes by @bogomya in nodejs/undici#5405

test: cover connect lookup option by @vibhor-aggr in nodejs/undici#5411

test: fail on unexpected reconnect disconnect by @vibhor-aggr in nodejs/undici#5412

build(deps-dev): bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in nodejs/undici#5419

fix(proxy): fail the request when the CONNECT tunnel drops instead of looping by @cesarvspr in nodejs/undici#5441

feat(docs): migrate to doc-kit by @avivkeller in nodejs/undici#5438

build(deps-dev): bump undici from 6.25.0 to 6.27.0 by @dependabot[bot] in nodejs/undici#5445

fetch: fix issue 4058 by @KhafraDev in nodejs/undici#5456

docs: add Interceptors API reference page by @enjoykumawat in nodejs/undici#5446

Document H1 keep-alive trust tradeoff by @mcollina in nodejs/undici#5457

fix(h2): deliver an early final response to an Expect: 100-continue request by @jeswr in nodejs/undici#5470

fix(types): correct deleteCookie attributes by @Ram-blip in nodejs/undici#5461

fix(h1): complete paused parser on socket end instead of crashing by @ronag in nodejs/undici#5474

build(deps): bump github/codeql-action/init from 4.36.1 to 4.36.2 by @dependabot[bot] in nodejs/undici#5476

build(deps): bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 by @dependabot[bot] in nodejs/undici#5481

build(deps): bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 by @dependabot[bot] in nodejs/undici#5480

build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in nodejs/undici#5478

build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in nodejs/undici#5482

build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @trivikr in nodejs/undici#5484

... (truncated)

Commits

cb4c2f1 Bumped v8.7.0 (#5501)
a8d1a95 fix: auto-detect HTTP proxy tunneling (#5116)
cb30e58 fix: add static buildDispatch method to RedirectHandler type definition (#5442)
0c08579 fix(h2): requeue request on GOAWAY'd session instead of crashing (#5453)
e5b3364 fix(h2): guard onResponse against a 'response' event delivered after completi...
c0007f4 docs: add reproduction guide and update bug report template (#5451)
e529cab fix: ignore an unparseable Set-Cookie Expires attribute (#5488)
754742c fix(h2): destroy the stream on abort instead of relying on close() (#5462)
db34f5f fix(readable): ignore late consume chunks (#5375)
4ea05a8 fix: reject non-ascii octets in validateCookiePath (#5452)
Additional commits viewable in compare view

Updates nanoid from 3.3.15 to 3.3.16

Release notes

Sourced from nanoid's releases.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

Changelog

Sourced from nanoid's changelog.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

Commits

9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
See full diff in compare view

Updates postcss from 8.5.16 to 8.5.19

Release notes

Sourced from postcss's releases.

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

Commits

9543b22 Release 8.5.19 version
3d13bf9 Fix CI on Windows too
00d0dd2 Keep explicitly set raws.before when inserting nodes into root (#2111)
7a05b33 Temporary fix CI
4c0d194 Release 8.5.18 version
92b4e78 Update dependencies
95663d3 Limit where source map can be loaded for security reasons
74e25ae Release 8.5.17 version
d1518af Fix Maximum call stack size exceeded error
2421312 Fix linter
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…h 3 updates Bumps the production group with 1 update in the / directory: [undici](https://github.com/nodejs/undici). Updates `undici` from 8.5.0 to 8.7.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.5.0...v8.7.0) Updates `nanoid` from 3.3.15 to 3.3.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.16) Updates `postcss` from 8.5.16 to 8.5.19 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.16...8.5.19) --- updated-dependencies: - dependency-name: undici dependency-version: 8.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: nanoid dependency-version: 3.3.16 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production - dependency-name: postcss dependency-version: 8.5.19 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-15T02:45:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	undici@8.7.0

View full report

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): (deps): bump the production group across 1 directory with 3 updates#961

chore(deps): (deps): bump the production group across 1 directory with 3 updates#961
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-c2e747362f

dependabot Bot commented on behalf of github Jul 15, 2026

Uh oh!

socket-security Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 15, 2026

v8.7.0

What's Changed

New Contributors

v8.6.0

What's Changed

3.3.16

3.3.16

8.5.19

8.5.18

8.5.17

8.5.19

8.5.18

8.5.17

Uh oh!

socket-security Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants