spmallette opened a new pull request, #3745: URL: https://github.com/apache/tinkerpop/pull/3745
Bump: undici 6.28.0 -> 6.29.1 (gremlin-javascript, npm) Why: Security - undici 6.29.x fixes multiple CVEs incl. CVE-2026-109383 (TLS cert-validation bypass via dropped Agent options); direct runtime dep of the JS driver's undici dispatcher Target: master only (undici is present only on master; absent from 3.7-dev / 3.8-dev) Tested: master - staged (`mvn clean install -DskipTests`: BUILD SUCCESS), then `mvn install -pl :gremlin-javascript`: BUILD SUCCESS - unit 23835 + 112 passing, 2 pending; integration 13161 steps (12950 passed, 211 skipped, docker-compose) LICENSE: n/a (ships in the gremlin npm package, not the Console/Server zips; not enumerated in the GLV LICENSE/NOTICE) Risk: Low - patch bump on a line we already ship, no API changes Verdict: TAKE (security - direct dep - low-risk - builds clean) Supersedes dependabot #3741. *🤖 Agent assisted PR.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
