docs(security): record the undici exact-pin rationale - #529
Conversation
undici is the only runtime HTTP dependency, drives the engines floor, and its dispatcher behavior is tested surface for the rotation proxy; the exact pin keeps version movement deliberate. Notes the undici 7.x deferral until Node 18 support is dropped. Audit roadmap 4.5.5. https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
Warning Review limit reached
More reviews will be available in 27 minutes and 56 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary
Documents the
undiciexact-pin rationale in SECURITY.md's Dependency and Release Hygiene section, in the same style as the existinghono/rollupentries — audit roadmap §4.5.5 (docs/audits/AUDIT_2026-06-10.md, PR #522).Changes
New "Runtime dependency pin rationale" entry explaining why
undiciis pinned exactly to6.25.0:ProxyAgentdispatch + local-bridge fetch fallback)engines.node >=18.17.0floor7.xis explicitly deferred until Node 18 support is dropped (7.x raises the floor to Node 20)Validation
npx vitest run test/documentation.test.ts— 25/25 (doc-integrity suite)Risk / Rollback
Docs-only. Related: #518 (engines floor), #523 (runtime-smoke job), #528 (
@types/nodepin) — this completes the floor-management story.https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB
Generated by Claude Code
note: greptile review for oc-chatgpt-multi-auth. cite files like
lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.Greptile Summary
docs-only change adding a
undiciexact-pin rationale toSECURITY.md's Dependency and Release Hygiene section, matching the existinghono/rollupstyle.dependencies(distinct from the existing "Security override rationale" underoverrides), explaining thatundiciis pinned to6.25.0because it is the sole runtime http dependency, it drives theengines.node >=18.17.0floor, and its dispatcher behavior is part of the tested rotation proxy surface — with migration to7.xdeferred until node 18 support is dropped.Confidence Score: 5/5
docs-only edit with no runtime or security surface changes — safe to merge as-is
the change is a single paragraph added to SECURITY.md; factual claims match the repo's established node floor, the undici version in package.json, and the rotation proxy test surface described in AGENTS.md. no code, no config, no token or windows-path handling touched.
no files require special attention
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart TD A[undici 6.25.0 exact pin] --> B{why exact pin?} B --> C[only runtime HTTP dep\nProxyAgent + fetch fallback] B --> D[drives engines.node >=18.17.0 floor] B --> E[dispatcher behavior = tested surface\nrotation proxy] E --> F[version bump must be deliberate\nnot silent range resolution] A --> G{upgrade to 7.x?} G -->|blocked| H[7.x raises floor to Node 20\ndeferred until Node 18 dropped]Reviews (1): Last reviewed commit: "docs(security): record the undici exact-..." | Re-trigger Greptile