chore(deps): bump undici and wrangler in /fingerprint-oss-demo by dependabot[bot] · Pull Request #84 · IntegerAlex/fingerprint-oss

dependabot · 2026-03-18T18:48:23Z

Bumps undici and wrangler. These dependencies needed to be updated together.
Updates undici from 5.29.0 to 7.24.4

Release notes

v7.24.4

What's Changed

fix(fetch): handle URL credentials in dispatch path extraction by @mcollina in nodejs/undici#4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @hxinhan in nodejs/undici#4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

fix fetch path logic by @KhafraDev in nodejs/undici#4890

remove maxDecompressedMessageSize by @KhafraDev in nodejs/undici#4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

fix: proto pollution by @rahulyadav5524 in nodejs/undici#4885

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.

GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)

... (truncated)

Commits

4991f3e Bumped v7.24.4
ea3a06d fix(fetch): preserve path for credentialed URLs (#4892)
9b96516 Bumped v7.24.3
7926660 Ignore .githuman
9eaa5af fix(h2): TypeError: Cannot read properties of null (reading 'push') in Reques...
a9bfe21 ignore .pi
f2e155b Bumped v7.24.2
4d2d1af remove maxDecompressedMessageSize (#4891)
3a05a4f fix fetch path logic (#4890)
23e3cd3 Bumped v7.24.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates wrangler from 4.68.0 to 4.75.0

Release notes

Sourced from wrangler's releases.

wrangler@4.75.0

Minor Changes

#12492 3b81fc6 Thanks @thomasgauvin! - feat: add wrangler tunnel commands for managing Cloudflare Tunnels

Adds a new set of commands for managing remotely-managed Cloudflare Tunnels directly from Wrangler:

wrangler tunnel create <name> - Create a new Cloudflare Tunnel

wrangler tunnel list - List all tunnels in your account

wrangler tunnel info <tunnel> - Display details about a specific tunnel

wrangler tunnel delete <tunnel> - Delete a tunnel (with confirmation)

wrangler tunnel run <tunnel> - Run a tunnel using cloudflared

wrangler tunnel quick-start <url> - Start a temporary tunnel (Try Cloudflare)

The run and quick-start commands automatically download and manage the cloudflared binary, caching it in ~/.wrangler/cloudflared/. Users are prompted before downloading and warned if their PATH-installed cloudflared is outdated. You can override the binary location with the CLOUDFLARED_PATH environment variable.

All commands are marked as experimental.

Patch Changes

#12927 c9b3184 Thanks @penalosa! - Bump undici from 7.18.2 to 7.24.4

#12875 13df6c7 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260312.1 1.20260316.1

#12935 df0d112 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260316.1 1.20260317.1

#12928 81ee98e Thanks @petebacondarwin! - Migrate chrome-devtools-patches deployment from Cloudflare Pages to Workers + Assets

The DevTools frontend is now deployed as a Cloudflare Workers + Assets project instead of a Cloudflare Pages project. This uses wrangler deploy for production deployments and wrangler versions upload for PR preview deployments.

The inspector proxy origin allowlists in both wrangler and miniflare have been updated to accept connections from the new workers.dev domain patterns, while retaining the legacy pages.dev patterns for backward compatibility.

#12835 c600ce0 Thanks @dario-piotrowicz! - Fix execution freezing on debugger statements when DevTools is not attached

Previously, wrangler always sent Debugger.enable to the runtime on connection, even when DevTools wasn't open. This caused scripts to freeze on debugger statements. Now Debugger.enable is only sent when DevTools is actually attached, and Debugger.disable is sent when DevTools disconnects to stop the runtime from performing debugging work.

#12894 f509d13 Thanks @gpanders! - Simplify description of --json option

... (truncated)

Commits

a671740 Version Packages (#12923)
e25bd0e Update prettier to 3.8.1 (#12939)
df0d112 Bump the workerd-and-workers-types group with 2 updates (#12935)
81ee98e [chrome-devtools-patches] Migrate deployment from Cloudflare Pages to Workers...
3b81fc6 feat(wrangler): add wrangler tunnel (#12492)
13df6c7 Bump the workerd-and-workers-types group with 2 updates (#12875)
0a7fef9 wrangler: reject cross-drive module paths (#11888)
f509d13 Remove superfluous adjective from --json description (#12894)
c600ce0 Fix execution freezing on debugger statements when DevTools is not attached...
2e6b4ab Version Packages (#12876)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Bump `undici` and `wrangler` dependencies in fingerprint-oss-demo

Updates package-lock.json to pull in newer versions of undici and wrangler in the fingerprint-oss-demo project.

^{Macroscope summarized 24da01d.}

Bumps [undici](https://github.com/nodejs/undici) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies needed to be updated together. Updates `undici` from 5.29.0 to 7.24.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.24.4) Updates `wrangler` from 4.68.0 to 4.75.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.75.0/packages/wrangler) --- updated-dependencies: - dependency-name: undici dependency-version: 7.24.4 dependency-type: indirect - dependency-name: wrangler dependency-version: 4.75.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

netlify · 2026-03-18T18:48:29Z

✅ Deploy Preview for clever-starlight-3034ea canceled.

Name	Link
🔨 Latest commit	`24da01d`
🔍 Latest deploy log	https://app.netlify.com/projects/clever-starlight-3034ea/deploys/69baf37b067afe00085afe06

netlify · 2026-03-18T18:48:30Z

✅ Deploy Preview for fingerprint-oss canceled.

Name	Link
🔨 Latest commit	`24da01d`
🔍 Latest deploy log	https://app.netlify.com/projects/fingerprint-oss/deploys/69baf37b68a17d00085a9df0

CLAassistant · 2026-03-18T19:08:16Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Copilot

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

fingerprint-oss-demo/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-20T14:11:48Z

fingerprint-oss-demo/package-lock.json

    "node_modules/undici": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.18.2.tgz",
-      "integrity": "sha512-y+8YjDFzWdQlSE9N5nzKMT3g4a5UBX1HKowfdXh0uvAnTaqqwqB92Jt4UXBAeKekDs5IaDKyJFR4X1gYVCgXcw==",
+      "version": "7.24.4",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.4.tgz",
+      "integrity": "sha512-BM/JzwwaRXxrLdElV2Uo6cTLEjhSb3WXboncJamZ15NgUURmvlXvxa6xkwIOILIjPNo9i8ku136ZvWV0Uly8+w==",


The PR description mentions bumping undici from 5.29.0, but in package-lock.json the prior version appears to be 7.18.2. The 5.29.0 pin still exists in pnpm-lock.yaml (and wrangler is pinned there too), so pnpm users won’t receive these updates unless that lockfile is updated as well (or the project standardizes on a single lockfile).

Copilot · 2026-03-20T14:11:48Z

fingerprint-oss-demo/package-lock.json

    "node_modules/undici": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.18.2.tgz",
-      "integrity": "sha512-y+8YjDFzWdQlSE9N5nzKMT3g4a5UBX1HKowfdXh0uvAnTaqqwqB92Jt4UXBAeKekDs5IaDKyJFR4X1gYVCgXcw==",
+      "version": "7.24.4",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.4.tgz",
+      "integrity": "sha512-BM/JzwwaRXxrLdElV2Uo6cTLEjhSb3WXboncJamZ15NgUURmvlXvxa6xkwIOILIjPNo9i8ku136ZvWV0Uly8+w==",
      "dev": true,
      "license": "MIT",
      "peer": true,


This update brings undici@7.24.4, which (per this lockfile’s engines field) requires Node >=20.18.1. That will break installs/runs of the demo on Node 18 and on older Node 20 minors; consider enforcing/documenting the demo’s Node requirement (e.g., package.json engines / .nvmrc) or pinning to a Node-18 compatible dependency set.

Copilot · 2026-03-20T14:11:49Z

fingerprint-oss-demo/package-lock.json

    "node_modules/wrangler": {
-      "version": "4.68.0",
-      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.68.0.tgz",
-      "integrity": "sha512-DCjl2ZfjwWV10iH4Zn+97isitPkb7BYxpbt4E/Okd/QKLFTp9xdwoa999UN9lugToqPm5Zz/UsRu6hpKZuT8BA==",
+      "version": "4.75.0",
+      "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.75.0.tgz",
+      "integrity": "sha512-Efk1tcnm4eduBYpH1sSjMYydXMnIFPns/qABI3+fsbDrUk5GksNYX8nYGVP4sFygvGPO7kJc36YJKB5ooA7JAg==",
      "dev": true,


wrangler@4.75.0 increases the Node engine requirement (lockfile shows node >=20.0.0). If the demo is expected to support Node 18 (or older Node 20 minors in some environments), this bump will be a breaking change; either enforce/document the Node >=20 requirement for the demo or keep wrangler pinned to a compatible major/minor.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 18, 2026

IntegerAlex requested a review from Copilot March 20, 2026 14:07

Copilot started reviewing on behalf of IntegerAlex March 20, 2026 14:07 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump undici and wrangler in /fingerprint-oss-demo#84

chore(deps): bump undici and wrangler in /fingerprint-oss-demo#84
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/fingerprint-oss-demo/multi-4ddf939ad5

dependabot bot commented on behalf of github Mar 18, 2026 •

edited by macroscopeapp bot

Loading

Uh oh!

netlify bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

netlify bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Mar 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 20, 2026

Uh oh!

Copilot AI Mar 20, 2026

Uh oh!

Copilot AI Mar 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 18, 2026 • edited by macroscopeapp bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.24.4

What's Changed

v7.24.3

What's Changed

v7.24.2

What's Changed

v7.24.1

What's Changed

v7.24.0

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

wrangler@4.75.0

Minor Changes

Patch Changes

Bump undici and wrangler dependencies in fingerprint-oss-demo

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for clever-starlight-3034ea canceled.

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for fingerprint-oss canceled.

Uh oh!

CLAassistant commented Mar 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Mar 18, 2026 •

edited by macroscopeapp bot

Loading

Bump `undici` and `wrangler` dependencies in fingerprint-oss-demo

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading