spmallette opened a new pull request, #3744: URL: https://github.com/apache/tinkerpop/pull/3744
Bump: undici 6.28.0 -> 6.29.1 (gremlin-javascript, npm) Why: Security - fixes multiple undici CVEs (TLS 1.2 renegotiation DoS, dropped Agent TLS options, content-encoding/EventSource/WebSocket DoS); direct production dep of the JS driver Target: master only (undici does not exist on 3.7-dev / 3.8-dev - older lines unaffected, no backport) Builds: PASS master (mvn clean install -pl :gremlin-javascript -am -Dmaven.exec.skip=true, .glv touched; 23835 unit + 112 integration tests passing) LICENSE: n/a (ships in the gremlin-javascript npm package, not the Console/Server zips) Risk: Low - patch bump, direct dep, full JS unit + docker-compose integration suite green Verdict: TAKE (security - direct dep - low-risk - builds clean) Supersedes dependabot #3741. *🤖 Agent assisted PR.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
