From 9e61e4bedab24ae12306ce0948423b186b7a409e Mon Sep 17 00:00:00 2001
From: RSI smoke <rsi-smoke@example.invalid>
Date: Fri, 23 Oct 2026 16:53:20 -0600
Subject: [PATCH] fix: update Undici security patch level

---
 package-lock.json                             |  8 +--
 package.json                                  |  2 +-
 .../__tests__/undici-security-version.test.ts | 49 +++++++++++++++++++
 3 files changed, 54 insertions(+), 5 deletions(-)
 create mode 100644 src/llm/__tests__/undici-security-version.test.ts

diff --git a/package-lock.json b/package-lock.json
index f546680..d103370 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,7 +19,7 @@
 				"simple-git": "^4.0.2",
 				"tsx": "^4.19.0",
 				"typescript": "^5.6.0",
-				"undici": "^8.10.0",
+				"undici": "^8.12.3",
 				"yaml": "^2.5.1",
 				"zod": "^4.6.6"
 			},
@@ -3124,9 +3124,9 @@
 			}
 		},
 		"node_modules/undici": {
-			"version": "8.11.2",
-			"resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
-			"integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
+			"version": "8.12.3",
+			"resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz",
+			"integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==",
 			"license": "MIT",
 			"engines": {
 				"node": ">=22.19.0"
diff --git a/package.json b/package.json
index 458f08d..bd55c2f 100644
--- a/package.json
+++ b/package.json
@@ -87,7 +87,7 @@
 		"simple-git": "^4.0.2",
 		"tsx": "^4.19.0",
 		"typescript": "^5.6.0",
-		"undici": "^8.10.0",
+		"undici": "^8.12.3",
 		"yaml": "^2.5.1",
 		"zod": "^4.6.6"
 	},
diff --git a/src/llm/__tests__/undici-security-version.test.ts b/src/llm/__tests__/undici-security-version.test.ts
new file mode 100644
index 0000000..3aad9da
--- /dev/null
+++ b/src/llm/__tests__/undici-security-version.test.ts
@@ -0,0 +1,49 @@
+import assert from "node:assert/strict"
+import { createServer } from "node:http"
+import { createRequire } from "node:module"
+import { Agent, fetch as undiciFetch } from "undici"
+
+function installedVersion(): string {
+	const require = createRequire(import.meta.url)
+	return require("undici/package.json").version as string
+}
+
+function assertSecurityFloor(version: string): void {
+	const [major, minor, patch] = version.split(".").map(Number)
+	assert.equal(major, 8, `Expected Undici 8.x, got ${version}`)
+	assert.ok(
+		minor > 12 || (minor === 12 && patch >= 2),
+		`Undici ${version} is below the security floor`,
+	)
+}
+
+async function verifyLocalAgentFetch(): Promise<void> {
+	const server = createServer((_request, response) => response.end("ok"))
+	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve))
+	const address = server.address()
+	assert.ok(address && typeof address !== "string")
+	const dispatcher = new Agent()
+	try {
+		const url = `http://127.0.0.1:${address.port}/health`
+		const response = await undiciFetch(url, { dispatcher })
+		assert.equal(response.status, 200)
+		assert.equal(await response.text(), "ok")
+	} finally {
+		await dispatcher.close()
+		await new Promise<void>((resolve, reject) => {
+			server.close((error) => error ? reject(error) : resolve())
+		})
+	}
+}
+
+async function main(): Promise<void> {
+	const version = installedVersion()
+	assertSecurityFloor(version)
+	await verifyLocalAgentFetch()
+	console.log(`Undici ${version} security floor and Agent/fetch smoke passed`)
+}
+
+main().catch((error) => {
+	console.error(error)
+	process.exit(1)
+})