chore(deps-dev): bump undici from 7.29.0 to 8.9.0 in /packages/socket-mode

[dependabot]

Bumps undici from 7.29.0 to 8.9.0.

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in nodejs/undici#5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in nodejs/undici#5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in nodejs/undici#5534
• docs: clarify proxy threat model by @​mcollina in nodejs/undici#5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in nodejs/undici#5542
• docs: clarify parser timeout precision by @​vibhor-aggr in nodejs/undici#5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in nodejs/undici#5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in nodejs/undici#5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in nodejs/undici#5499
• docs: add custom interceptor example by @​vibhor-aggr in nodejs/undici#5548
• fix(h1): ignore type of service errors by @​mcollina in nodejs/undici#5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in nodejs/undici#5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in nodejs/undici#5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in nodejs/undici#5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in nodejs/undici#5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in nodejs/undici#5559
• fix(decompress): skip HEAD responses by @​Ram-blip in nodejs/undici#5564
• ci: build undici with node.js v26 by @​shivarm in nodejs/undici#5237

... (truncated)

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2bc96b2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

❌ 4 Tests Failed:

Tests completed	Failed	Passed	Skipped
458	4	454	0

View the top 3 failed test(s) by shortest run time

test::/home/runner/work/node-slack-sdk/node-slack-sdk/packages/socket-mode/src/SlackWebSocket.test.ts

Stack Traces | 0.551s run time

[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }

test::/home/runner/work/node-slack-sdk/node-slack-sdk/packages/socket-mode/src/SocketModeClient.test.ts

Stack Traces | 0.561s run time

[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }

test::D:\a\node-slack-sdk\node-slack-sdk\packages\socket-mode\src\SlackWebSocket.test.ts

Stack Traces | 1.17s run time

[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }

test::D:\a\node-slack-sdk\node-slack-sdk\packages\socket-mode\src\SocketModeClient.test.ts

Stack Traces | 1.24s run time

[Error: test failed] { code: 'ERR_TEST_FAILURE', failureType: 'testCodeFailure', cause: 'test failed', exitCode: 1, signal: null }

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[zimeg]

🤖 (Clack, Eden's agent) — I synced the lockfile so npm ci passes, and CI is now green on Node 22.x / 24.x / 26.x — but fails on Node 20.x (both ubuntu and windows).

Root cause: undici@8.9.0 requires node >=22.19.0 (per its published engines field), so it isn't usable on the Node 20.x matrix entry. This isn't a lockfile or test problem — it's a support-floor change in undici 8.

Needs a human decision: either (a) drop Node 20.x from the socket-mode CI matrix (and bump the package's engines floor to match), or (b) hold undici at 7.x until Node 20 is no longer supported. I've left the lockfile fix in place but won't push further, since this is a policy call, not a mechanical fix.

[WilliamBergamin]

Not sure why dependabot is opening this PR with an unsupported version of undici 🤔