[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
react (source)	19.3.0 → 19.3.1
react-dom (source)	19.3.0 → 19.3.1
undici@>=7.0.0 <7.29.0 (source)	[8.11.2 → 8.12.1](https://renovatebot.com/diffs/npm/undici@>=7.0.0 <7.29.0/8.11.2/8.12.1)

---

Release Notes

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

nodejs/undici (undici@>=7.0.0 <7.29.0)

v8.12.1

Compare Source

What's Changed

• fix: restore build:wasm npm script by @​mcollina in #​6009
• test: add unexpected disconnect guards to http2-body-delete.js by @​Kesavamoorthig06 in #​5970

New Contributors

• @​Kesavamoorthig06 made their first contribution in #​5970

Full Changelog: nodejs/undici@v8.12.0...v8.12.1

v8.12.0

Compare Source

What's Changed

• fix(cookies): ignore a numeric expires outside the Date range by @​xia-chao in #​5832
• fix(http2): pause bodyTimeout while applying backpressure by @​jasnell in #​5884
• fix(cache): track cached response abort state by @​mcollina in #​5820
• fix(deduplicate): make terminal callbacks exception-safe by @​mcollina in #​5838
• fix(decompress): stop inflating compress and x-compress by @​luantaraschi in #​5665
• fix(cache): evict least recently used entries in MemoryCacheStore by @​jasnell in #​5869
• fix(eventsource): fix redirect targets in eventsource by @​jasnell in #​5878
• fix(redirect): fix throwOnMaxRedirect edge by @​jasnell in #​5879
• fix: normalize HTTP/2 headers for legacy dispatch handlers by @​Knowzzz in #​5867
• fix(session cache): fix bug in tls session caching by @​jasnell in #​5882
• docs: fix relative links broken by the README move by @​v1teka in #​5843
• fix(redirect): add error code to max redirects error by @​mcollina in #​5895
• fix(eventsource): fix retry wrap bug by @​jasnell in #​5875
• fix(retry): keep request headers when resuming a download by @​jasnell in #​5870
• fix(proxyagent): correct handling of the host header by @​jasnell in #​5868
• fix(http1): fix handling of 204/304 responses by @​jasnell in #​5864
• test: add unexpected disconnect guards to two more h2 tests by @​zeexzeex in #​5825
• fix(cache): preserve 304 response event order with async stores by @​marcopiraccini in #​5797
• fix(dns): handle a null pick, and stop failing over to an expired record by @​datrixlab in #​5791
• fix: keep a header named proto across features by @​luantaraschi in #​5688
• ci: exclude tests from CodeQL analysis by @​mcollina in #​5905
• fix(pool): ensure that removed clients don't pick up requests by @​jasnell in #​5881
• feat: Added @​perseveranza-pets/milo as alternative experimental HTTP parser by @​ShogunPanda in #​5492
• extractBody fixes 2 by @​KhafraDev in #​5926
• reenable cachestorage wpts by @​KhafraDev in #​5907
• fix(fetch): parse language tag in filename* parameters by @​fallintoplace in #​5908
• fix(client): preserve tracked response header field boundaries by @​ronag in #​5940
• fix(http1): fixup strictContentLength handling by @​jasnell in #​5897
• feat(cache): compress big sqlite cache entries with zstd by @​mcollina in #​5744
• fix(eventsource): enforce maxEventSize on unterminated lines by @​mcollina in #​5814
• limit zstd window size to 8 MB by @​KhafraDev in #​5955
• test: add unexpected disconnect guards to http2-body.js by @​GhostCoder6969 in #​5914
• test: fix "specifiy" typo in cache interceptor test by @​ump45nose in #​5922
• Wpt/wpt runner fixes by @​KhafraDev in #​5959
• fix(h2): unref a session detached by GOAWAY with no open streams by @​kjsik11 in #​5960
• feat: Throw an error when WebAssembly is not available. by @​ShogunPanda in #​5966
• chore: Vendor milo 0.9.0. by @​ShogunPanda in #​5954
• build(deps-dev): bump ws from 8.21.3 to 8.22.0 by @​dependabot[bot] in #​5968
• build(deps-dev): bump undici from 6.28.0 to 6.29.0 by @​dependabot[bot] in #​5933
• fix(typemap): .md -> .html by @​avivkeller in #​5602
• build(deps): bump js-yaml from 4.1.1 to 4.3.2 by @​dependabot[bot] in #​5810
• build(deps): bump brace-expansion by @​dependabot[bot] in #​5934
• build(deps-dev): bump fast-check from 4.10.1 to 4.10.2 by @​dependabot[bot] in #​5921
• test(fetch): settle h2 internal stream errors by @​Yahiro025 in #​5927
• docs(errors): clarify timeout error codes and related options by @​theamodhshetty in #​4856
• fix(interceptor): limit response error body size by @​mcollina in #​5942
• build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @​dependabot[bot] in #​5946
• build(deps): bump hendrikmuhs/ccache-action from 1.2.23 to 1.2.24 by @​dependabot[bot] in #​5951
• build(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5952
• build(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5950
• build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5948
• build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @​dependabot[bot] in #​5947
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​5630
• fix(http1): reset connections for no-body transfer encoding by @​mcollina in #​5941
• fix: exclude experimental milo from node.js core bundle by @​mcollina in #​5935
• test: re-enable HTTP/2 churn test on Node.js 26 by @​mcollina in #​5961
• test: keep the h2c unix socket path within sun_path limits by @​mcollina in #​5978
• fix(cache): preserve abort reasons after completion by @​domenic in #​5958
• test: update milo paths in bundle-parser test by @​mcollina in #​5979
• fix(cache): always treat zero-lifetime entries as stale by @​mcollina in #​5980
• build(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @​dependabot[bot] in #​5949
• fix(websocket,eventsource): keep receive limits behind dispatcher wrappers by @​jasnell in #​5896
• fix(http2): enforce max concurrent streams by @​jasnell in #​5885
• docs: sync WG collaborators with nodejs/undici team by @​mcollina in #​5991
• build(deps-dev): bump @​fastify/busboy from 3.2.2 to 3.2.3 by @​dependabot[bot] in #​6005
• fix: ignore missing release ref during cleanup by @​mcollina in #​5891
• fix: reject unsupported FormData request bodies by @​mcollina in #​5913
• split wpt out of npm test by @​mcollina in #​5588

New Contributors

• @​xia-chao made their first contribution in #​5832
• @​jasnell made their first contribution in #​5884
• @​Knowzzz made their first contribution in #​5867
• @​v1teka made their first contribution in #​5843
• @​datrixlab made their first contribution in #​5791
• @​fallintoplace made their first contribution in #​5908
• @​GhostCoder6969 made their first contribution in #​5914
• @​ump45nose made their first contribution in #​5922

Full Changelog: nodejs/undici@v8.11.2...v8.12.0

---

Configuration

📅 Schedule: (in timezone Europe/Istanbul)

• Branch creation
  • Between 12:00 AM and 05:59 AM (* 0-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.