chore(deps): bump undici from 5.28.2 to 5.28.4

[dependabot]

Bumps undici from 5.28.2 to 5.28.4.

Release notes

Sourced from undici's releases.

v5.28.4

⚠️ Security Release ⚠️

• Fixes GHSA-m4v8-wqvr-p9f7 CVE-2024-30260
• Fixes GHSA-9qxr-qj54-h672 CVE-2024-30261

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

⚠️ Security Release ⚠️

Fixes:

• CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

Commits

• fb98306 Bumped v5.28.4
• 2b39440 Merge pull request from GHSA-9qxr-qj54-h672
• 64e3402 Merge pull request from GHSA-m4v8-wqvr-p9f7
• 723c4e7 Revert "build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 (#2389)"
• 0e9d54b skip failing test due to Node.js changes
• e71cb4c Bumped v5.28.3
• 20c65b8 Fix tests for Node.js v20.11.0 (#2618)
• 8ec52cd Fix tests for Node.js v21 (#2609)
• d3aa574 Merge pull request from GHSA-3787-6prv-h9w3
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

[puLL-Merge] - nodejs/[email protected]

Description

This PR introduces several changes and improvements to the undici library, focusing on enhancing security, performance, and code organization. The main changes include:

1. Improved handling of integrity checks for fetch requests
2. Optimization of header name processing
3. Updates to redirect handling, including removal of proxy-authorization header
4. Addition of new benchmarks and tests
5. Minor version bump from 5.28.2 to 5.28.4

Possible Issues

1. The change in formdata-node dependency version from ^6.0.3 to ^4.3.1 might cause compatibility issues with projects depending on newer versions.

Security Hotspots

1. The changes to integrity checking in lib/fetch/util.js should be carefully reviewed to ensure they don't introduce any vulnerabilities in the validation process.

Changes

Changes

1. benchmarks/fetch/bytes-match.mjs:

   • Added new benchmark for testing bytesMatch function with various hash algorithms and encodings.

2. lib/core/constants.js:

   • Added a new file with a comprehensive list of well-known HTTP header names and a record for case-insensitive lookup.

3. lib/core/util.js:

   • Added headerNameToString function for efficient header name processing.

4. lib/fetch/index.js:

   • Updated httpRedirectFetch to remove the 'proxy-authorization' header during redirects.

5. lib/fetch/util.js:

   • Significantly refactored and optimized the bytesMatch, parseMetadata, and related functions for improved performance and security in integrity checking.

6. lib/handler/RedirectHandler.js:

   • Updated shouldRemoveHeader function to use the new headerNameToString utility and include 'proxy-authorization' header removal.

7. package.json:

   • Updated version to 5.28.4
   • Changed formdata-node dependency from ^6.0.3 to ^4.3.1

8. test/fetch/integrity.js:

   • Added new tests for integrity checking with various hash algorithms and encodings.

9. test/fetch/redirect-cross-origin-header.js:

   • Updated test to check for removal of 'proxy-authorization' header during redirects.

10. test/fetch/util.js:

    • Added new tests for parseMetadata function.

11. test/redirect-cross-origin-header.js:

    • Added a new test file to verify cross-origin redirect behavior with headers.

These changes primarily focus on improving the security and performance of integrity checking and header handling in the undici library, while also adding more comprehensive tests and benchmarks.

[github-actions]

The security team is monitoring all repositories for certain keywords. This PR includes the word(s) "authorization" and so security team members have been added as reviewers to take a look.

No need to request a full security review at this stage, the security team will take a look shortly and either clear the label or request more information/changes.

Notifications have already been sent, but if this is blocking your merge feel free to reach out directly to the security team on Slack so that we can expedite this check.