chore(deps): bump undici from 7.28.0 to 7.29.0

[dependabot]

Bumps undici from 7.28.0 to 7.29.0.

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

[greptile-apps]

PR author is in the excluded authors list.

[macminisupport]

Dependabot triage tracking note for this cycle (2026-08-08) is posted on #269 (GitHub Issues are disabled on this repo) — covers this PR plus #271, #272, #273, #269. This PR: undici 7.28.0 → 7.29.0 (minor, root package.json — separate manifest from #273's /test-projects/expo-purchasely-test bump, not a duplicate), CI red on all 7 checks (the outlier of the batch — likely a more direct break from this bump). See #269 for the full table and next steps — nothing merges without a human go-ahead there.

---

Generated by Claude Code

[macminisupport]

Dependabot triage tracking note for this cycle (2026-08-09) is posted on #269 (GitHub Issues are still disabled on this repo) — covers this PR plus #271, #272, #273, #269. This PR: undici 7.28.0 → 7.29.0 (minor, root package.json — separate manifest from #273's /test-projects/expo-purchasely-test bump, not a duplicate). CI red on all 7 checks — the outlier of the batch, likely a more direct break tied to this bump itself. See #269 for the full table, risk assessment, and next steps — nothing merges without a human go-ahead there.

---

Generated by Claude Code

[macminisupport]

Dependabot triage tracking note for this cycle (2026-08-12) is posted on #271 (Issues are disabled on this repo; old host #269 was closed/superseded on 08-11, #271 is the new host) — covers this PR plus #272, #273, #275, #276, #277. This PR remains the outlier of the batch: all 7 checks still failing, unchanged since the 2026-08-04 run (no rebase/new commit since). Given it carries 5 real CVE fixes in undici 7.29.0, it's worth a fresh CI run to see whether it's just the same build-ios/Xcode-26 issue affecting the rest of the batch (root cause + fix now identified: open PR #278) or a separate regression. See #271 for the full table and next steps — nothing merges without a human go-ahead there.

---

Generated by Claude Code

[macminisupport]

Dependabot PR Review — 2026-08-29

Note: Issues are disabled on this repo, so this review is posted directly on each of the 6 currently-open Dependabot PRs instead of a shared tracking issue (the process used on Purchasely-Firebase-Extension#498 and purchasely-support-app#266). Nothing has been merged, approved, or closed — this PR will only be merged after an explicit human go-ahead comment on it.

#	Package	Version Change	Bump	CI	Mergeable	Action
#277	nanoid	3.3.11 → 3.3.18	patch	🔴 build-ios failing, other 6 green	blocked	CI Failing
#276	postcss (test-projects)	8.5.12 → 8.5.26	patch	🟢 Green (7/7)	blocked	Auto-merge candidate
#275	nanoid (test-projects)	3.3.11 → 3.3.18	patch	🔴 build-ios failing, other 6 green	blocked	CI Failing, same pattern as #277
#274 (this PR)	undici	7.28.0 → 7.29.0	minor	🔴 All 7 jobs failing	blocked (no conflict)	CI Failing — needs root cause
#273	undici (test-projects)	8.5.0 → 8.10.0	minor	🟢 Green (7/7)	was dirty — rebase requested this cycle	Auto-merge candidate once rebased
#272	fast-uri (test-projects)	4.1.1 → 4.1.2	patch	🟢 Green (7/7)	was dirty — rebase requested this cycle	Auto-merge candidate once rebased

On this PR: this undici bump carries upstream security fixes (cache-control parsing hardening, blob-body CRLF-injection guard, retry Content-Length/Content-Range consistency check, cookie attribute validation — 1 high + 4 medium severity advisories fixed in 7.29.0). Unlike #273 (the same undici line, bumped in /test-projects/expo-purchasely-test, which is fully green), every one of the 7 CI jobs fails here — lint, test, both Android builds, both iOS builds, and iOS unit tests. This is not the single-job build-ios flake seen on #277/#275; it looks like a real incompatibility or break tied to this bump landing at the repo root rather than in a test project. This is the one PR in this batch that needs an actual human look at the job logs before it can be considered, security fixes notwithstanding.

---

Generated by Claude Code

[macminisupport]

Dependabot PR Review — 2026-08-31

Note: Issues are disabled on this repo, so this review is posted directly on each of the 6 currently-open Dependabot PRs instead of a shared tracking issue. Nothing has been merged, approved, or closed — this PR will only be merged after an explicit human go-ahead comment on it.

#	Package	Version Change	Bump	CI	Mergeable	Action
#277	nanoid	3.3.11 → 3.3.18	patch	🔴 build-ios failing, other 6 green	blocked	CI Failing — unchanged
#276	postcss (test-projects)	8.5.12 → 8.5.26	patch	🟢 Green (7/7)	blocked	Auto-merge candidate — unchanged
#275	nanoid (test-projects)	3.3.11 → 3.3.18	patch	🔴 build-ios failing, other 6 green	blocked	CI Failing, same pattern as #277 — unchanged
#274 (this PR)	undici	7.28.0 → 7.29.0	minor	🔴 All 7 jobs failing	blocked (no conflict)	CI Failing — needs root cause, unchanged
#273	undici (test-projects)	8.5.0 → 8.10.0	minor	🟢 Green (7/7)	still dirty	Rebase re-requested this cycle in the correct (non-obfuscated) form — see below
#272	fast-uri (test-projects)	4.1.1 → 4.1.2	patch	🟢 Green (7/7)	still dirty	Rebase re-requested this cycle in the correct (non-obfuscated) form — see below

Correction on #273/#272: every prior rebase request on those two PRs (2026-08-27, 2026-08-29, 2026-08-30) was posted as ·@·d·ependabot r·ebase — obfuscated with dots, which Dependabot silently ignores. That is almost certainly why they've sat dirty for 4+ days despite "being rebased." Verbatim ·@·d·ependabot r·ebase was just posted on both.

On this PR: unchanged — all 7 CI jobs still fail (lint, test, both Android builds, both iOS builds, iOS unit tests), unlike #273 (same undici line, different manifest, fully green). This carries real security fixes (1 high + 4 medium severity advisories in 7.29.0) but needs an actual human look at the job logs before it can be considered — not the single-job build-ios flake seen on #277/#275.

---

Generated by Claude Code

[macminisupport]

Dependabot triage tracking note for this cycle (2026-09-02) is posted on #288 (new host — Issues are disabled on this repo) — covers this PR plus #287, #277, #276, #275, #273, #272. This PR: undici 7.28.0→7.29.0 (minor, root), all 7 CI jobs still failing, unchanged since 08-20. Carries real security fixes (1 high + 4 medium CVEs) but needs an actual human look at the job logs before it can move — not the single-job flake seen on #277/#275. See #288 for the full table.

---

Generated by Claude Code

[dependabot]

Looks like undici is up-to-date now, so this is no longer needed.