Skip to content

deps: update undici to latest v7.x release only#62739

Open
mcollina wants to merge 1 commit intonodejs:v24.x-stagingfrom
mcollina:feat/undici-v7-filter
Open

deps: update undici to latest v7.x release only#62739
mcollina wants to merge 1 commit intonodejs:v24.x-stagingfrom
mcollina:feat/undici-v7-filter

Conversation

@mcollina
Copy link
Copy Markdown
Member

Modify update-undici.sh to fetch all releases and filter to only v7.x releases, then select the latest one. This ensures we stay on the v7.x line and don't accidentally upgrade to v8 or later.

@mcollina mcollina requested a review from a team April 14, 2026 15:48
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added tools Issues and PRs related to the tools directory. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Apr 14, 2026
});
if (v7Releases.length === 0) throw new Error('No v7.x releases found');
// Sort by tag_name (prefixed with 'v') in descending order to get the latest first
v7Releases.sort((a, b) => b.tag_name.localeCompare(a.tag_name));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That will report e.g. v7.2.0 to be more recent than v7.10.0

@mcollina mcollina force-pushed the feat/undici-v7-filter branch 2 times, most recently from 6d90a9b to 1d8ad4e Compare April 14, 2026 16:12
@mcollina
Copy link
Copy Markdown
Member Author

@aduh95 good catch, fixed.

Comment on lines +28 to +34
const v7Releases = releases.filter(r => {
const tag = r.tag_name.replace(/^v/, '');
return tag.startsWith('7.');
});
if (v7Releases.length === 0) throw new Error('No v7.x releases found');
// Sort by published_at (descending) to get the most recently published first
v7Releases.sort((a, b) => new Date(b.published_at) - new Date(a.published_at));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we switch to npm to get the last version number, from https://registry.npmjs.org/undici/seven? Would probably be less fragile

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It all comes from the same release pipeline. I didn't want to bring in semver as a dependency either.

Latest time on github seemed more final, given that the tag on npm can be changed at whim.

Copy link
Copy Markdown
Contributor

@aduh95 aduh95 Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not a dependency on semver, it's just an alternative source to get the version number.
It assumes the seven tag will be kept up-to-date on npm, but that seems like a reasonable assumption for a project we maintain ourselves. Worse that could happen is that the bot opens a PR for the wrong version, which should be easily catchable – especially given that we’ll have to run the workflow manually

Modify update-undici.sh to fetch all releases and filter to only v7.x
releases, then select the latest one. This ensures we stay on the v7.x
line and don't accidentally upgrade to v8 or later.
@mcollina mcollina force-pushed the feat/undici-v7-filter branch from 1d8ad4e to e0c73eb Compare April 14, 2026 16:29
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 14, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.08%. Comparing base (c989497) to head (e0c73eb).
⚠️ Report is 262 commits behind head on v24.x-staging.

Additional details and impacted files
@@                Coverage Diff                @@
##           v24.x-staging   #62739      +/-   ##
=================================================
+ Coverage          90.06%   90.08%   +0.01%     
=================================================
  Files                672      673       +1     
  Lines             201174   202277    +1103     
  Branches           39304    39571     +267     
=================================================
+ Hits              181197   182217    +1020     
- Misses             12240    12268      +28     
- Partials            7737     7792      +55     

see 145 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

tools Issues and PRs related to the tools directory. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants