chore(deps): bump undici and @redocly/cli

[dependabot]

Bumps undici to 7.28.0 and updates ancestor dependency @redocly/cli. These dependencies need to be updated together.

Updates undici from 7.25.0 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	d0574cc4
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	ea8930cf

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
• Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

• f9eba0a Bumped v7.28.0 (#5430)
• a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
• 8cb10f9 websocket: limit the number of fragments in a message
• 04201f8 fix: honor requestTls when proxy is SOCKS5
• fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
• bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
• 9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
• 376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
• 3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
• 85a2405 fix(cache): trim qualified field names
• Additional commits viewable in compare view

Updates @redocly/cli from 2.31.2 to 2.39.0

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.39.0

Minor Changes

• Added support for AsyncAPI 3.1.0 descriptions.
• Fixed the struct rule to validate the contents of AsyncAPI protocol-specific bindings. Added typed definitions for the sns, sqs, ibmmq, googlepubsub, pulsar and ros2 bindings.

Patch Changes

• Updated @​redocly/openapi-core to v2.39.0.

@​redocly/cli@​2.38.0

Minor Changes

• Added an experimental drift command that compares recorded HTTP traffic (HAR, Kong, Nginx/Apache JSON, NDJSON) against an OpenAPI description and reports undocumented endpoints, schema mismatches, and security findings.
• Added an experimental proxy command that captures live HTTP traffic through a reverse proxy into a HAR file and optionally validates it against an OpenAPI description in real time.

Patch Changes

• Updated @​redocly/openapi-core to v2.38.0.

@​redocly/cli@​2.37.0

Minor Changes

• Added experimental support for linting GraphQL SDL schema files (.graphql / .gql).

Patch Changes

• Updated @​redocly/openapi-core to v2.37.0.

@​redocly/cli@​2.36.0

Minor Changes

• Added a Subresource Integrity (SRI) hash to the Redoc standalone script tag in the HTML produced by build-docs, ensuring the script's integrity.

@​redocly/cli@​2.35.1

Patch Changes

• Updated undici to the 6.27.0 version.

@​redocly/cli@​2.35.0

Minor Changes

• Added support for validating Arazzo 1.1.0 descriptions syntax in the lint command.
• Added the spec-step-mutually-exclusive-fields Arazzo rule to flag steps that use more than one mutually exclusive operation field (operationId, operationPath, workflowId, channelPath, or x-operation).

@​redocly/cli@​2.34.0

Minor Changes

• Improved CLI install speed by bundling the CLI into a dependency-free package.

... (truncated)

Commits

• f4592cb chore: 🔖 release new versions (#2942)
• f10449a chore: update redocly-config to v0.51.0 (#2948)
• d3f9dc9 chore: adjust codeowners for drift and proxy commands (#2944)
• 9d00c88 docs(contribution): add experimental features policy, clarify ai contribution...
• 4026840 feat: add AsyncAPI 3.1 support (#2929)
• 2054553 chore: add rules and skills for AI (#2935)
• 1192323 chore: 🔖 release new versions (#2939)
• 21475a7 chore: update redocly config version to 0.50.1 (#2941)
• 7faca0c feat: experimental traffic analysis (#2848)
• 51b1d15 docs: document --continue-on-deploy-failures option for push and push-status ...
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
undici	[>= 8.a, < 9]