chore(deps): bump undici from 7.22.0 to 7.24.0 in /workspaces/orchestrator

[dependabot]

Bumps undici from 7.22.0 to 7.24.0.

Release notes

Sourced from undici's releases.

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

• GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
  Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

• GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
  Malicious WebSocket 64-bit frame length handling could crash the client.

• GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
  Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

• GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
  CRLF injection via the upgrade option.

• GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
  Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

• GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
  Unbounded memory consumption in WebSocket permessage-deflate decompression.

Affected and patched ranges

• CVE-2026-1525: affected 7.0.0 < 7.24.0, patched 7.24.0
• CVE-2026-1528: affected 7.0.0 < 7.24.0, patched 7.24.0
• CVE-2026-2581: affected >= 7.17.0 < 7.24.0, patched 7.24.0
• CVE-2026-1527: affected 7.0.0 < 7.24.0, patched 7.24.0
• CVE-2026-2229: affected 7.0.0 < 7.24.0, patched 7.24.0
• CVE-2026-1526: affected 7.0.0 < 7.24.0, patched 7.24.0

References

• GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories
• NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
• NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528
• NVD CVE-2026-2581: https://nvd.nist.gov/vuln/detail/CVE-2026-2581
• NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527
• NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229
• NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

v7.23.0

What's Changed

... (truncated)

Commits

• 07a3906 Bumped v7.24.0 (#4887)
• 74495c6 fix: reject duplicate content-length and host headers
• 84235c6 Fix websocket 64-bit length overflow
• 77594f9 fix: validate upgrade header to prevent CRLF injection
• cb79c57 fix: validate server_max_window_bits range in permessage-deflate
• 4147ce2 Merge commit '2ee00cb3'
• 2ee00cb fix(websocket): add maxDecompressedMessageSize limit for permessage-deflate
• 5890c7b fix(deduplicate): stream response chunks to waiting handlers
• fbda3c1 Bumped v7.23.0 (#4884)
• 07276c9 fix: remove unused kSocketPath symbol
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[rhdh-gh-app]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-orchestrator-backend-module-loki	workspaces/orchestrator/plugins/orchestrator-backend-module-loki	patch	v1.2.3

[christoph-jerolimov]

@dependabot rebase

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

[christoph-jerolimov]

https://github.com/dependabot recreate

[rhdh-qodo-merge]

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: Workspace orchestrator, Verify step

Failed stage: Verify lockfile duplicates [❌]

Failed test name: ""

Failure summary: The action failed during the Yarn install/link process because the workflow enforces a clean lockfile, and Yarn detected that yarn.lock would change due to required deduplication. - In the Deduplication step, Yarn reported duplicate versions (e.g., undici) and indicated that 2 packages can be deduped. - The job then failed with yarn.lock changes and suggested running yarn --cwd workspaces/orchestrator dedupe and committing the resulting lockfile updates. - Additional issues were reported earlier (not necessarily the direct failure cause): prettier@3.7.4 does not satisfy @spotify/prettier-config's requested ^2.0.0, and the workspace does not provide the peer dependency @typescript-eslint/parser required by @spotify/eslint-plugin.

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 150: �[94m➤�[39m �[90mYN0000�[39m: ┌ Post-resolution validation 151: ##[group]Post-resolution validation 152: �[93m➤�[39m YN0060: │ �[38;5;173mprettier�[39m is listed by your project with version �[38;5;111m3.7.4�[39m (�[38;5;111mpc2ecd8�[39m), which doesn't satisfy what �[38;5;166m@spotify/�[39m�[38;5;173mprettier-config�[39m and other dependencies request (�[38;5;37m^2.0.0�[39m). 153: �[93m➤�[39m YN0002: │ �[38;5;166m@redhat-developer/�[39m�[38;5;173mrhdh-plugins�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m doesn't provide �[38;5;166m@typescript-eslint/�[39m�[38;5;173mparser�[39m (�[38;5;111mp8d7c5c�[39m), requested by �[38;5;166m@spotify/�[39m�[38;5;173meslint-plugin�[39m. 154: �[93m➤�[39m YN0086: │ Some peer dependencies are incorrectly met by your project; run �[38;5;111myarn explain peer-requirements <hash>�[39m for details, where �[38;5;111m<hash>�[39m is the six-letter p-prefixed code. 155: �[93m➤�[39m YN0086: │ Some peer dependencies are incorrectly met by dependencies; run �[38;5;111myarn explain peer-requirements�[39m for details. 156: ##[endgroup] 157: �[94m➤�[39m �[90mYN0000�[39m: └ Completed 158: �[94m➤�[39m �[90mYN0000�[39m: ┌ Fetch step 159: ##[group]Fetch step 160: �[94m➤�[39m YN0013: │ �[38;5;220m1548�[39m packages were added to the project (�[38;5;160m+ 336.33 MiB�[39m). 161: ##[endgroup] 162: �[94m➤�[39m �[90mYN0000�[39m: └ Completed in 6s 75ms 163: �[94m➤�[39m �[90mYN0000�[39m: ┌ Link step 164: ##[group]Link step 165: �[94m➤�[39m YN0007: │ �[38;5;173mesbuild�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.21.5�[39m must be built because it never has been before or the last one failed 166: �[94m➤�[39m YN0007: │ �[38;5;166m@swc/�[39m�[38;5;173mcore�[39m�[38;5;111m@�[39m�[38;5;111mnpm:1.4.13 [366d3]�[39m must be built because it never has been before or the last one failed 167: �[94m➤�[39m YN0007: │ �[38;5;173mesbuild�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.23.1�[39m must be built because it never has been before or the last one failed 168: �[94m➤�[39m YN0007: │ �[38;5;173mesbuild�[39m�[38;5;111m@�[39m�[38;5;111mnpm:0.20.2�[39m must be built because it never has been before or the last one failed 169: �[94m➤�[39m YN0007: │ �[38;5;173mcore-js-pure�[39m�[38;5;111m@�[39m�[38;5;111mnpm:3.36.1�[39m must be built because it never has been before or the last one failed 170: �[94m➤�[39m YN0007: │ �[38;5;166m@redhat-developer/�[39m�[38;5;173mrhdh-plugins�[39m�[38;5;111m@�[39m�[38;5;111mworkspace:.�[39m must be built because it never has been before or the last one failed 171: ##[endgroup] ... 180: (Use `node --trace-deprecation ...` to show where the warning was created) 181: �[94m➤�[39m �[90mYN0000�[39m: ┌ Deduplication step 182: ##[group]Deduplication step 183: ************************************************************************************* 184: * You have duplicate versions of some packages in a yarn.lock file. * 185: * To solve this, run the following command from the project root and commit all * 186: �[94m➤�[39m YN0000: │ �[38;5;173mundici�[39m�[38;5;37m@�[39m�[38;5;37mnpm:^7.16.0�[39m can be deduped from �[38;5;173mundici�[39m�[38;5;111m@�[39m�[38;5;111mnpm:7.22.0�[39m to �[38;5;173mundici�[39m�[38;5;111m@�[39m�[38;5;111mnpm:7.25.0�[39m 187: �[94m➤�[39m YN0000: │ �[38;5;173mundici�[39m�[38;5;37m@�[39m�[38;5;37mnpm:^7.2.3�[39m can be deduped from �[38;5;173mundici�[39m�[38;5;111m@�[39m�[38;5;111mnpm:7.22.0�[39m to �[38;5;173mundici�[39m�[38;5;111m@�[39m�[38;5;111mnpm:7.25.0�[39m 188: �[94m➤�[39m YN0000: │ 2 packages can be deduped using the �[38;5;111mhighest�[39m strategy 189: ##[endgroup] 190: �[94m➤�[39m �[90mYN0000�[39m: └ Completed in 0s 293ms 191: ************************************************************************************* 192: * yarn.lock changes. * 193: * * 194: * yarn --cwd workspaces/orchestrator dedupe * 195: ##[error]Process completed with exit code 1. 196: Post job cleanup.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud