chore(deps-dev): bump undici from 7.24.4 to 7.28.0

[dependabot]

Bumps undici from 7.24.4 to 7.28.0.

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	d0574cc4
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	ea8930cf

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
• Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

• f9eba0a Bumped v7.28.0 (#5430)
• a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
• 8cb10f9 websocket: limit the number of fragments in a message
• 04201f8 fix: honor requestTls when proxy is SOCKS5
• fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
• bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
• 9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
• 376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
• 3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
• 85a2405 fix(cache): trim qualified field names
• Additional commits viewable in compare view

[changeset-bot]

⚠️ No Changeset found

Latest commit: cc967a2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Cloudflare Pages Deployment

Event Name: pull_request
Environment: preview
Project: cloudflare-pages-action
Built with commit: 075fb9e
Preview URL: https://fd61a40a.cloudflare-pages-action-a5z.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-undi-tv9m.cloudflare-pages-action-a5z.pages.dev

Wrangler Output

⛅️ wrangler 4.86.0
───────────────────
Uploading... (3/3)
✨ Success! Uploaded 0 files (3 already uploaded) (0.66 sec)

✨ Uploading _headers
✨ Uploading Functions bundle
🌎 Deploying...
✨ Deployment complete! Take a peek over at https://fd61a40a.cloudflare-pages-action-a5z.pages.dev
✨ Deployment alias URL: https://dependabot-npm-and-yarn-undi-tv9m.cloudflare-pages-action-a5z.pages.dev

[github-actions]

Cloudflare Pages Deployment

Event Name: pull_request
Environment: preview
Project: cloudflare-pages-action
Built with commit: 023d701
Preview URL: https://9051b5e1.cloudflare-pages-action-a5z.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-undi-tv9m.cloudflare-pages-action-a5z.pages.dev

Wrangler Output

⛅️ wrangler 4.86.0
───────────────────
Uploading... (3/3)
✨ Success! Uploaded 0 files (3 already uploaded) (0.35 sec)

✨ Uploading _headers
✨ Uploading Functions bundle
🌎 Deploying...
✨ Deployment complete! Take a peek over at https://9051b5e1.cloudflare-pages-action-a5z.pages.dev
✨ Deployment alias URL: https://dependabot-npm-and-yarn-undi-tv9m.cloudflare-pages-action-a5z.pages.dev