[Snyk] Security upgrade undici from 6.2.1 to 6.6.1

[Johannestegner]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	481/1000 Why? Recently disclosed, Has a fix available, CVSS 3.9	Permissive Cross-domain Policy with Untrusted Domains SNYK-JS-UNDICI-6252336	No	No Known Exploit
	611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Denial of Service (DoS) SNYK-JS-UNDICI-6252341	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: undici

The new version differs by 103 commits.

• d36b19e Bumped v6.6.1
• 87a4811 Merge pull request from GHSA-9f24-jqhm-jfcw
• b9da3e4 Merge pull request from GHSA-3787-6prv-h9w3
• 5db527a perf: optimize Iterator (#2692)
• eb53b61 fix: ci pipeline warnings (#2685)
• 9d3ffdb build(deps): bump actions/dependency-review-action from 3.1.0 to 4.0.0 (#2689)
• d94baf1 build(deps): bump github/codeql-action from 3.22.12 to 3.23.2 (#2688)
• 0b6bc0f fix: flaky debug test (#2687)
• fa2d2d2 Bumped v6.6.0
• 9bcf6f8 fix: make ci less flaky (#2684)
• 0808a72 websocket: fix close when no closing code is received (#2680)
• 8220e7d implement spec changes from a while ago (#2676)
• f1d7ada chore: small perf improvements (#2661)
• 3e37392 chore: use optional chaining (#2666)
• ee35bb0 chore: remove this alias in agent.js (#2671)
• 82477d7 chore: fix various codesmells (#2669)
• 2144da4 remove timers/promises import (#2665)
• bed8489 build(deps-dev): bump cronometro from 1.2.0 to 2.0.2 (#2668)
• 30d167b build(deps-dev): bump husky from 8.0.3 to 9.0.7 (#2667)
• b04d65c chore: use 'node:'-prefix for requiring node core modules (#2662)
• 189e572 fix: typo clampAndCoarsenConnectionTimingInfo (#2653)
• 69c26b9 Support building for externally shared js builtins (#2643)
• d3ad54e fix: support deflate raw responses (#2650)
• d5ee723 refactor: use fromInnerResponse (#2635)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)