fix(deps): update dependency undici to v8.4.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	8.4.0 → 8.4.1

---

Release Notes

nodejs/undici (undici)

v8.4.1

Compare Source

What's Changed

• test: avoid localhost lookup in fetch cookies tests by @​mcollina in #​5363
• fix: prevent race condition between onEnd and onTrailers in HTTP/2 client (#​5216) by @​mcollina in #​5343
• fix(dns): skip requests without origin by @​marko1olo in #​5376
• docs: add Getting Started guide by @​AliMahmoudDev in #​5371
• docs: fix code examples that crash at runtime and other inaccuracies by @​AliMahmoudDev in #​5386
• fix: handle paused parser on socket end (issue #​5360) by @​mcollina in #​5389
• fix(client): reject pipelined TLS altname errors by @​marko1olo in #​5373
• docs: fix multiple inaccuracies in API documentation by @​AliMahmoudDev in #​5384
• docs: fix remaining broken links in API documentation by @​AliMahmoudDev in #​5342

New Contributors

• @​marko1olo made their first contribution in #​5376

Full Changelog: nodejs/undici@v8.4.0...v8.4.1

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: 23a81dc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@tailor-platform/sdk	Patch
@tailor-platform/create-sdk	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/@tailor-platform/create-sdk@23a81dc

pnpm add https://pkg.pr.new/@tailor-platform/sdk@23a81dc

commit: 23a81dc

[github-actions]

Code Metrics Report (packages/sdk)

	main (76f666f)	#1413 (e2b30cf)	+/-
Coverage	66.7%	66.7%	0.0%
Code to Test Ratio	1:0.4	1:0.4	0.0

Details

  |                    | main (76f666f) | #1413 (e2b30cf) | +/-  |
  |--------------------|----------------|-----------------|------|
  | Coverage           |          66.7% |           66.7% | 0.0% |
  |   Files            |            410 |             410 |    0 |
  |   Lines            |          13984 |           13984 |    0 |
  |   Covered          |           9335 |            9335 |    0 |
  | Code to Test Ratio |          1:0.4 |           1:0.4 |  0.0 |
  |   Code             |          93189 |           93189 |    0 |
  |   Test             |          40855 |           40855 |    0 |

SDK Configure Bundle Size

	main (76f666f)	#1413 (e2b30cf)	+/-
configure-index-size	19.73KB	19.73KB	0KB
dependency-chunks-size	47.63KB	47.63KB	0KB
total-bundle-size	67.36KB	67.36KB	0KB

Runtime Performance

	main (76f666f)	#1413 (e2b30cf)	+/-
Generate Median	2,821ms	2,734ms	-87ms
Generate Max	2,844ms	2,749ms	-95ms
Apply Build Median	2,883ms	2,796ms	-87ms
Apply Build Max	2,907ms	2,822ms	-85ms

Type Performance (instantiations)

	main (76f666f)	#1413 (e2b30cf)	+/-
tailordb-basic	36,066	36,066	0
tailordb-optional	3,841	3,841	0
tailordb-relation	5,921	5,921	0
tailordb-validate	2,566	2,566	0
tailordb-hooks	5,767	5,767	0
tailordb-object	12,136	12,136	0
tailordb-enum	2,462	2,462	0
resolver-basic	9,424	9,424	0
resolver-nested	26,111	26,111	0
resolver-array	18,187	18,187	0
executor-schedule	4,234	4,234	0
executor-webhook	873	873	0
executor-record	6,659	6,659	0
executor-resolver	4,369	4,369	0
executor-operation-function	868	868	0
executor-operation-gql	869	869	0
executor-operation-webhook	888	888	0
executor-operation-workflow	1,714	1,714	0

---

Reported by octocov

[github-actions]

🤖 Claude Dependency Review

📦 Update Summary

• Library: undici
• Version: 8.4.0 → 8.4.1
• Change Type: Patch

📝 Release Notes

https://github.com/nodejs/undici/releases/tag/v8.4.1

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found in either version. Both 8.4.0 and 8.4.1 are recent releases that include fixes for previously disclosed vulnerabilities (CVE-2026-22036, CVE-2026-1527, CVE-2026-2581) from earlier versions. No new vulnerabilities introduced in 8.4.1.
• Supply-chain notes: None. Undici is an official Node.js project maintained by the Node.js organization. No maintainer changes, no suspicious lifecycle scripts, and no unexpected new dependencies detected.

✨ Main Changes

This patch release focuses on bug fixes and documentation improvements:

🐛 Bug Fixes

• HTTP/2 Race Condition: Fixed race condition between onEnd and onTrailers events in HTTP/2 client (#5343)
• DNS Handling: Fixed DNS requests that lacked an origin value (#5376)
• Parser State: Fixed handling of paused parser states when sockets end (issue #5360) (#5389)
• TLS Certificate Errors: Enhanced rejection of pipelined TLS certificate name mismatch errors (#5373)

📚 Documentation

• Added comprehensive Getting Started guide (#5371)
• Fixed code examples that would crash at runtime (#5386)
• Fixed multiple API documentation inaccuracies (#5384)
• Repaired broken links throughout documentation (#5342)

🧪 Testing

• Improved fetch cookie tests to avoid localhost lookups (#5363)

🔍 Impact Analysis

📁 Usage Locations

undici is used in the following 2 files:

1. packages/sdk/src/cli/shared/client.ts

   import { getGlobalDispatcher } from "undici";

   • Feature used: Global HTTP connection pool dispatcher
   • Impact: The getGlobalDispatcher() function is used in the closeConnectionPool() function (line 617) to close undici's global HTTP connection pool, preventing a libuv UV_HANDLE_CLOSING assertion failure on Windows at process exit (Node.js 23.x+). The bug fixes in 8.4.1, particularly the HTTP/2 race condition and parser state handling, may improve stability when closing the connection pool.

2. packages/sdk/src/cli/commands/login.ts

   import {
     closeConnectionPool,
     fetchPlatformMachineUserToken,
     fetchUserInfo,
     initOAuth2Client,
   } from "@​/cli/shared/client";

   • Feature used: closeConnectionPool function (called at line 160)
   • Impact: Ensures proper cleanup of HTTP connections after login completes. The parser state fix (#5389) may prevent edge cases where the connection pool doesn't close cleanly.

Additional Context

The SDK uses undici indirectly through the global fetch() API in several locations:

• packages/sdk/src/cli/shared/client.ts - fetchUserInfo() (line 459) and fetchMachineUserToken() (line 574) use the global fetch() API, which is implemented by undici in Node.js
• packages/sdk/src/cli/crashreport/sender.ts - crash report uploads
• packages/sdk/src/cli/commands/api/api-call.ts - API calls
• packages/sdk/src/cli/commands/authconnection/authorize.ts - auth connection authorization

While these files don't directly import undici, they benefit from the bug fixes in 8.4.1 since Node.js's global fetch() is powered by undici. The HTTP/2 race condition fix and DNS handling improvements will enhance reliability across all fetch-based operations.

✅ Recommended Actions

None - This is a safe patch update with bug fixes and no breaking changes. The update should be merged to benefit from:

• Improved HTTP/2 client stability (race condition fix)
• Better DNS request handling
• More robust parser state management
• Enhanced TLS error handling

All changes are internal bug fixes that improve reliability without requiring any code modifications.

---