chore(deps): bump undici from 8.7.0 to 8.9.0 in /.repos/effect-smol

[dependabot]

Bumps undici from 8.7.0 to 8.9.0.

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in nodejs/undici#5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in nodejs/undici#5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in nodejs/undici#5534
• docs: clarify proxy threat model by @​mcollina in nodejs/undici#5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in nodejs/undici#5542
• docs: clarify parser timeout precision by @​vibhor-aggr in nodejs/undici#5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in nodejs/undici#5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in nodejs/undici#5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in nodejs/undici#5499
• docs: add custom interceptor example by @​vibhor-aggr in nodejs/undici#5548
• fix(h1): ignore type of service errors by @​mcollina in nodejs/undici#5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in nodejs/undici#5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in nodejs/undici#5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in nodejs/undici#5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in nodejs/undici#5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in nodejs/undici#5559
• fix(decompress): skip HEAD responses by @​Ram-blip in nodejs/undici#5564
• ci: build undici with node.js v26 by @​shivarm in nodejs/undici#5237

... (truncated)

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[radroid]

Closing — this is noise, not a fix, and merging it would cost us on every sync.

.repos/effect-smol is a vendored reference subtree, not a workspace package:

• It is not matched by any glob in pnpm-workspace.yaml (apps/*, infra/*, oxlint-plugin-t3code, packages/*, scripts), so nothing here is ever installed, bundled or shipped. The advisory is not reachable from any artifact we build.
• ci.yml explicitly sparse-checks-out !/.repos/ — the code in this PR is not even present when CI runs.
• It is maintained by scripts/sync-reference-repos.ts as a git subtree pulled from the real upstream (added in chore: add vendored reference repo subtree sync tooling pingdotgg/t3code#2902 / chore: add Alchemy reference repo subtree pingdotgg/t3code#2918). A fork-local edit to a file inside the subtree diverges it from its source, so the next subtree pull conflicts — and the conflict lands in a ~30k-line lockfile.
• It sits inside the daily rebase-onto-upstream path, so the same hunk would be re-conflicted on every upstream sync.

The right place to fix this advisory is effect-smol upstream; it reaches us for free on the next subtree pull.

.github/dependabot.yml now ignores the vendored directories so this stops recurring.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.