GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Bump `undici` override to the latest `7.x` version by mbg · Pull Request #4268 · github/codeql-action

Conversation

@mbg

@mbg mbg commented Oct 26, 2026

Copy link
Copy Markdown
Member

Updates undici to a newer version, including the override. We have at least one dependency that is lagging behind with a 5.x requirement on undici that we can't shed.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
mbg added 2 commits October 26, 2026 13:00
@mbg
Bump undici override to the latest 7.x version
3911965
@mbg
Configure Dependabot to ignore undici for the moment
515fac0
@github-actions github-actions Bot added the size/XS Should be very easy to review label Oct 26, 2026
@mbg
Merge branch 'main' into mbg/deps/undici-7
d59d891
@mbg
mbg marked this pull request as ready for review October 27, 2026 12:07
@mbg
mbg requested a review from a team as a code owner October 27, 2026 12:07
Copilot AI max review requested due to automatic review settings October 27, 2026 12:07
Copilot started reviewing on behalf of mbg October 27, 2026 12:08
View session
henrymercer
henrymercer reviewed Oct 27, 2026
View reviewed changes
Comment thread package-lock.json
"license": "MIT",
"engines": {
"node": ">=18.17"
"node": ">=20.18.1"

@henrymercer henrymercer Oct 27, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you check that the >=20.18.1 Node version aligns with the runner versions we support (those shipped with the GHES versions we support)?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@mbg mbg Oct 27, 2026

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The oldest GHES we support is now 3.19 which ships with 20.19.4 so I think this is fine. (For the record, 3.18 before that shipped with 20.19.1 which would also have been fine).

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@cwinchesterii69-lang cwinchesterii69-lang Nov 2, 2026

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who keeps bumping him out it seems like he should of been bigger than a 3.19

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Copilot AI reviewed Oct 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The global override forces Undici 7 onto consumers declaring 5.x or 6.x requirements, and compatibility remains unverified.

No open issues 🎉

1 file not reviewed
  • lib/entry-points.js: Excluded by your content exclusion settings
What changed in this PR

Updates the CodeQL Action’s Undici dependency and global override, while shifting future Undici updates to manual maintenance.

Changes:

  • Upgrades Undici from 6.28.0 to 7.30.1 and updates the lockfile.
  • Adds a Dependabot ignore rule for Undici versions >=7.30.1, with comments explaining manual updates.
File Description
package.json Updates the direct Undici dependency and global override.
package-lock.json Records Undici 7.30.1 and its higher minimum Node.js requirement.
.github/​dependabot.yml Adds and documents the Undici update exclusion.

Review effort: Max

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
henrymercer
henrymercer approved these changes Oct 27, 2026
View reviewed changes
@mbg
mbg added this pull request to the merge queue Oct 27, 2026
Merged via the queue into main with commit c9d4295 Oct 27, 2026
229 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@mbg
mbg deleted the mbg/deps/undici-7 branch October 27, 2026 13:27
This was referenced Nov 3, 2026
Merge main into releases/v4 #4286
Merged
Merge releases/v4 into releases/v3 #4291
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@henrymercer henrymercer henrymercer approved these changes
+1 more reviewer
@cwinchesterii69-lang cwinchesterii69-lang cwinchesterii69-lang left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

size/XS Should be very easy to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@mbg @henrymercer @cwinchesterii69-lang
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.