build(deps): вдигане на undici override до ^7.29.0 - #282
Merged
Conversation
Five advisories were disclosed against undici 7.28.0 — GHSA-4cwx-7wf7-3272 (CVSS 7.4), GHSA-8xcm-r25x-g524, GHSA-jr45-8vmc-qm54, GHSA-m8rv-5g2x-5cg5 and GHSA-v3r7-h72x-cjcm — all fixed in 7.29.0. The `check` job's dependency audit fails on them, so main has been red since 3e76949 and nothing can merge. The existing `^7.28.0` range already admitted 7.29.0; the lockfile had simply never moved. Raise the floor to ^7.29.0 so it cannot silently fall back, and refresh the lock. The diff touches nothing but undici. Reached through wrangler→miniflare (local fetch), so it never ships to the Worker runtime — same standing as the other pins in this block.
Test coverage
✅ No workspace dropped below its baseline (tolerance 0.5pp). 📈 Coverage rose by more than 1pp — run |
midt-admin
approved these changes
Aug 4, 2026
lyubomir-bozhinov
added a commit
to lyubomir-bozhinov/sigma
that referenced
this pull request
Aug 4, 2026
…acbg gate midt-bg#281) Two commits landed on main while the midt-bg#226 sync was in flight — an undici override bump to ^7.29.0 and a cacbg completeness-gate fix (phantom rows / --limit). Clean merge; the surface is pnpm-workspace.yaml + scripts/cacbg, none of it inside the six measured workspaces, so the coverage baseline is untouched and the gate stays green. Verified against the merged tree: scripts tests 51 pass, cacbg pipeline tests 84 pass (run via the register-ts loader, as the CI job does), coverage ratchet green for all six workspaces.
LyuboslavLyubenov
added a commit
to LyuboslavLyubenov/sigma
that referenced
this pull request
Aug 5, 2026
Clean automatic merge: no conflicts. Upstream advanced 3 commits since the PR's previous rebase (related-persons midt-bg#226, undici bump midt-bg#282, cacbg fix midt-bg#281); none of those touch the PR's test-only surface (apps/web/test/integration/*, docs/spec/integration-testing.md, apps/web/vitest.integration.config.ts). The single auto-merged file is docs/README.md, which gained a new ADR entry in upstream (0032); the merge preserves the alphabetical/numerical ordering without re-flowing the PR's content. Verification (local): - pnpm typecheck → 7/7 packages clean - pnpm --filter @sigma/web test → 530 passing (52 files, 8 integration files, 41 integration tests, 0 .skip) - pnpm lint → (run separately)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Отпушва CI.
mainе червен от3e76949насам и нищо не може да се мърджне, включително #281.Одитът на зависимости в задачата
checkнамира пет уязвимости срещуundici@7.28.0-GHSA-4cwx-7wf7-3272(CVSS 7.4),GHSA-8xcm-r25x-g524,GHSA-jr45-8vmc-qm54,GHSA-m8rv-5g2x-5cg5,GHSA-v3r7-h72x-cjcm- всичките поправени в7.29.0.Съществуващият диапазон
^7.28.0вече допускаше7.29.0; заключващият файл просто не беше помръдвал. Вдигам долната граница на^7.29.0, за да не може да се върне тихо назад, и опреснявам lock-а.Дифът в
pnpm-lock.yamlне съдържа нищо освенundici. Пакетът се стига презwrangler→miniflare(локалният fetch) и никога не влиза в runtime-а на Worker-а, тоест има същия статут като останалите пинове в този блок.