Skip to content

build(deps): bump undici and @nx/angular#22

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-1da08b39dd
Open

build(deps): bump undici and @nx/angular#22
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-1da08b39dd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 20, 2026

Copy link
Copy Markdown

Bumps undici to 6.27.0 and updates ancestor dependency @nx/angular. These dependencies need to be updated together.

Updates undici from 6.26.0 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

  • Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
  • Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

Updates @nx/angular from 22.7.5 to 23.0.0

Release notes

Sourced from @​nx/angular's releases.

23.0.0 (2026-06-16)

🚀 Features

  • ⚠️ angular: remove deprecated @​nx/angular/module-federation entry point (#35512)
  • ⚠️ angular: remove deprecated move generator (#35513)
  • ⚠️ angular: remove deprecated ngrx generator (#35567)
  • angular: deprecate convert-to-with-mf generator (#35862)
  • angular: deprecate SCAM generators (#35887)
  • ⚠️ bundling: drop legacy typescript plugin and align rollup buildLibsFromSource default (#35516)
  • ⚠️ bundling: remove SVGR option and provide withSvgr migration (#35611)
  • bundling: add Vite 7 -> 8 migrations (#35614)
  • core: add support for '...' as a spread token when merging target config (#34285)
  • core: show target uses task graph + filter broken dependsOn during normalization (#35367)
  • core: add --mode and --multi-major-mode flags to nx migrate (#35497)
  • core: support prompt field in migration entries (#35638)
  • core: rename nx watch --includeDependentProjects to --includeDependencies (#35699)
  • core: support filtered array-shape targetDefaults with projects and source (#35340)
  • core: enable native Node.js TypeScript stripping by default (#35608)
  • core: add shell tab-completion (bash, zsh, fish, powershell) (#34951)
  • core: add agentic mode to nx migrate --run-migrations (#35718)
  • core: add a migrate configuration section to nx.json (#35831)
  • core: feed migration docs to agents in nx migrate (#35835)
  • core: avoid redundant rematch in findMatchingConfigFiles (#35793, #35792)
  • ⚠️ core: rename CreateNodes V2 types to canonical OG names (#35386, #32951)
  • core: support prompt-only and hybrid migrations in Nx Console UI (#35822, #35718, #3153)
  • core: add JSON schema for migrations.json files (#35888)
  • core: add migrations for createNodesV2 -> createNodes rename (#35893, #35386)
  • core: extend nx migrate --include to any package that supports optional updates (#35905)
  • core: report analytics events for the nx migrate flow (#35937)
  • core: revert array-shape targetDefaults support pending redesign and reapplication (#36005, #35340, #35711, #35752, #35991)
  • ⚠️ detox: deprecate the @​nx/detox build and test executors (#35529)
  • devkit: migrate @nx/devkit/src/... deep imports (#35541, #34946)
  • ⚠️ devkit: deprecate the standalone parameter of addProjectConfiguration (#35883)
  • gradle: stream batch task results to nx as they finish (#35487)
  • js: support pnpm 11.2.2 (#35772)
  • linter: allow prompt-only entries in migration nx-plugin-checks (#35700, #35638)
  • linter: deprecate ESLint v8 support (#35819)
  • ⚠️ misc: remove Tailwind CSS setup-tailwind generators (#35049)
  • ⚠️ misc: remove deprecated stylesheet options from generators (#35103)
  • misc: drop Node 20 support and bump @​types/node (#35591)
  • ⚠️ misc: deprecate executors with inferred-plugin replacements (#35576, #35517)
  • ⚠️ misc: remove deprecated js option from component generators (#35616, #29111)
  • misc: convert prompt generator migrations to use prompt field (#35688)
  • ⚠️ misc: drop deprecated webpack plugin re-exports + v23 polish (#35659)
  • misc: add --trustThirdPartyPreset flag to skip confirmation prompt (#35827, #35826)
  • misc: remove migrations prior to v21 in preparation for v23 (#35909, #30839, #32904, #35900)
  • misc: multi-version support compliance for detox, expo, react-native, and remix (#35885)
  • misc: prompt analytics earlier in init flow (#35922)
  • module-federation: deprecate old generators and add new consumer/provider generators (#35825)

... (truncated)

Commits
  • 71bbc70 feat(core): revert array-shape targetDefaults support pending redesign and re...
  • 958e60a docs(core): rewrite targetDefaults reference and guide for array shape and vo...
  • aa9ce7a fix(misc): rename createNodesV2 value usages in v23 migration, not just impor...
  • 6598a0b chore(core): rename supportsOptionalUpdates to supportsOptionalMigrations (#3...
  • 27f9ae0 chore(repo): finish migrating builds off the workspace-root dist (#35915)
  • 38ca20b feat(core): extend nx migrate --include to any package that supports option...
  • 4bb6115 chore(repo)!: migrate remaining packages to local dist build (#35900)
  • 0596b18 chore(repo): update nx to 23.0.0-beta.24 (#35898)
  • 94d9358 feat(core): add migrations for createNodesV2 -> createNodes rename (#35893)
  • 3a33712 fix(repo)!: migrate remaining first-party plugins to local dist build (M2-M5)...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [undici](https://github.com/nodejs/undici) to 6.27.0 and updates ancestor dependency [@nx/angular](https://github.com/nrwl/nx/tree/HEAD/packages/angular). These dependencies need to be updated together.


Updates `undici` from 6.26.0 to 6.27.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.26.0...v6.27.0)

Updates `@nx/angular` from 22.7.5 to 23.0.0
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.0.0/packages/angular)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: indirect
- dependency-name: "@nx/angular"
  dependency-version: 23.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 20, 2026
@vercel

vercel Bot commented Jun 20, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
frontend-tools Ready Ready Preview, Comment Jun 20, 2026 10:48am

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants