Skip to content

Bump undici from 7.16.0 to 7.17.0 #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dependabot wants to merge 1 commit into from
Closed

Bump undici from 7.16.0 to 7.17.0 #47

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 5, 2026

Bumps undici from 7.16.0 to 7.17.0.

Release notes

Sourced from undici's releases.

v7.17.0

What's Changed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump undici from 7.16.0 to 7.17.0
3d006b1 
Bumps [undici](https://github.com/nodejs/undici) from 7.16.0 to 7.17.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.17.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 5, 2026
@vercel
Copy link

vercel bot commented Jan 5, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
api Ready Ready Preview, Comment Jan 5, 2026 3:40pm

@claude
Copy link

claude bot commented Jan 5, 2026

Code Review: PR #47 - Bump undici from 7.16.0 to 7.17.0

Summary

This is a dependency bump for the undici HTTP client library from v7.16.0 to v7.17.0, a minor version update. The changes are minimal and affect only package.json and package-lock.json.

✅ Strengths

  1. Safe Version Bump: Minor version updates are backwards-compatible and should not introduce breaking changes.

  2. Well-Maintained Upstream: The undici project (Node.js HTTP client) is actively maintained by the Node.js team. The v7.17.0 release includes:

    • Performance improvements (e.g., "perf: use less promises in extractBody")
    • Bug fixes (proxy-agent fixes, promise chain integrity)
    • New features (deduplicate interceptor, H2 over unix domain sockets)
    • CI/infrastructure improvements

  3. Minimal Impact: Only dependency files are affected - no application code changes required.

  4. Dependabot Generated: Properly formatted PR with clear changelog and Dependabot integration.

🔍 Verification Recommendations

  1. CI Validation: Confirm this PR passes the existing lint and test workflows:

    • npm run lint checks TypeScript and Prettier formatting
    • Any additional test suites (if present) should pass

  2. Compatibility Check: Given your project uses undici as a transitive dependency, verify it's not directly imported anywhere:

    grep -r "undici" api/ --include="*.ts"

    If undici is only used transitively, this update is completely transparent.

  3. Performance Impact: The v7.17.0 release includes performance optimizations in body extraction, which should be neutral or beneficial with no breaking changes.

🚀 Performance & Security

  • Performance: This release includes performance improvements, particularly around promise handling and body extraction.
  • Security: No security vulnerabilities mentioned in the release notes, and this is a maintenance update from the official Node.js HTTP client maintainers.

📋 Test Coverage

  • No explicit test coverage changes: This is expected for a dependency bump.
  • Lint checks: The PR will be validated by your existing lint workflow (ESLint + Prettier).

✨ Recommendations

  1. Monitor the CI Run: Once CI passes, this is safe to merge.
  2. No Code Changes Needed: The version bump is self-contained.
  3. Release Notes: For future reference, the v7.17.0 changelog shows improvements worth noting in release notes if you track dependencies.

Final Assessment

✅ Ready to merge - This is a standard minor version bump from a well-maintained upstream library with positive improvements and no breaking changes.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 12, 2026

Superseded by #51.

@dependabot dependabot bot closed this Jan 12, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/undici-7.17.0 branch January 12, 2026 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant