Bump undici from 7.16.0 to 7.18.2

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps undici from 7.16.0 to 7.18.2.

Release notes

Sourced from undici's releases.

v7.18.2

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @​mcollina in nodejs/undici#4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

What's Changed

• Test and Fix running without SSL by @​mcollina in nodejs/undici#4727
• docs: add security warning for strictContentLength option by @​mcollina in nodejs/undici#4726
• build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @​dependabot[bot] in nodejs/undici#4718
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in nodejs/undici#4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

What's Changed

• chore: extract infra and encoding methods by @​Uzlopak in nodejs/undici#4523
• ci: remove h2 by @​Uzlopak in nodejs/undici#4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @​Uzlopak in nodejs/undici#4535
• ci: fix nightly shared library case by @​Uzlopak in nodejs/undici#4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @​Uzlopak in nodejs/undici#4528
• docs: add Cache Interceptor example to README by @​tawseefnabi in nodejs/undici#4393
• test: remove node20 version check by @​Uzlopak in nodejs/undici#4544
• types: use MessagePort instance type in MessageEvent by @​Renegade334 in nodejs/undici#4546
• ci: set write permissions on job level by @​Uzlopak in nodejs/undici#4537
• lint: activate n/no-process-exit by @​Uzlopak in nodejs/undici#4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @​Uzlopak in nodejs/undici#4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @​Uzlopak in nodejs/undici#4547
• feat(H2): correct CONNECT behaviour by @​metcoder95 in nodejs/undici#4541
• test: fix plans by @​Uzlopak in nodejs/undici#4550
• feat: add runtime feature "detection" by @​Uzlopak in nodejs/undici#4545
• perf: use less promises in extractBody by @​Uzlopak in nodejs/undici#4458
• fix(proxy-agent): add missing return after callback-call by @​Uzlopak in nodejs/undici#4553
• fix: remove redundant line in retry-handler by @​Uzlopak in nodejs/undici#4554
• ci: add no-wasm-simd option by @​Uzlopak in nodejs/undici#4533
• fix: use lazyloaders for runtime feature detection by @​Uzlopak in nodejs/undici#4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @​Uzlopak in nodejs/undici#4556
• http2: refactor and split tests of http2.js into multiple files by @​Uzlopak in nodejs/undici#4561
• fix: dns-interceptor test should await plan to complete by @​Uzlopak in nodejs/undici#4560
• chore: remove istanbul instructions by @​Uzlopak in nodejs/undici#4559
• fix: keep promise chains intact by @​Uzlopak in nodejs/undici#4558

... (truncated)

Commits

• 7e5cb2d Bumped v7.18.2 (#4730)
• b04e3cb fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...
• 2bcb77b Bumped v7.18.1 (#4728)
• 58a12b7 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4719)
• 5fa2930 build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (#4718)
• fbbe283 docs: add security warning for strictContentLength option (#4726)
• ce12d9e fix: do not crash if Node.js is compiled without SSL (#4727)
• ebe3e33 Bumped v7.18.0 (#4725)
• 4e9b88b fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
• d560767 Bumped v7.17.0 (#4724)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
api	Ready	Preview, Comment	Jan 12, 2026 7:46pm

[claude]

PR Review: Bump undici from 7.16.0 to 7.18.2

Summary

This is a dependency update PR that bumps the undici HTTP client library from version 7.16.0 to 7.18.2 (a minor version update). The PR also includes some cleanup of peer dependency flags in the lock file.

✅ Positive Aspects

1. Security Fix Included: The update includes v7.18.2 which contains a critical fix: fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaustion (fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… nodejs/undici#4729). This prevents potential DoS attacks via decompression bombs.

2. Bug Fixes: Several important bug fixes are included:

   • Fixed Node.js crash when compiled without SSL (v7.18.1)
   • Fixed promise chain integrity issues
   • Fixed proxy-agent missing return statement

3. Compatible Version Range: The caret (^) in package.json allows this update within the minor version range, which is appropriate for a stable library like undici.

4. No Direct Code Changes Required: The update is backward compatible - no application code modifications are needed.

⚠️ Areas for Consideration

1. Peer Dependency Flag Changes: The lock file shows removal of "peer": true flags from several dev dependencies:

   • @types/node
   • @typescript-eslint/parser
   • acorn
   • eslint
   • typescript
   • zod

   This appears to be a side effect of the dependency resolution, which typically occurs when npm/node-modules resolves dependencies differently. This is normal but worth noting to ensure the dev environment still works correctly.

2. Testing Verification Needed: While this is a minor version update with good release notes, it would be prudent to:

   • Run the lint checks (npm run lint and npm run lint:fix)
   • Verify any HTTP client functionality in the codebase still works correctly
   • Check if there are any CI/CD tests that pass with the new version

3. Breaking Changes Check: While undici v7.17.0 → v7.18.2 is a minor version bump, the release notes mention some feature additions (e.g., "add runtime feature detection"). Ensure these don't affect the application.

🔒 Security Notes

The update includes an important security improvement:

• Resource Exhaustion Protection: The Content-Encoding chain is now limited to a maximum of 5 levels, preventing potential resource exhaustion attacks via compressed response headers.

This is a beneficial security update.

📋 Recommendations

1. Merge Confidence: This is a safe update with good security and bug fixes. Dependabot's compatibility score should indicate whether there are any known issues.

2. Post-Merge: After merging, consider:

   • Running the full lint and any integration tests
   • Monitoring for any unexpected behavior related to HTTP requests

3. Lock File Cleanup: The removal of peer dependency flags is normal behavior and shouldn't cause issues, but verify dev dependencies resolve correctly after merge.

✨ Final Assessment

This is a recommended update. It includes important security and bug fixes with no breaking changes to the public API. The update appears safe to merge once CI passes.