net - chore: upgrade undici to 8 (breaking)

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage. — N/A: dependency-only upgrade with no source changes.

What kind of change does this PR introduce?

Maintenance (chore) — runtime phase, major upgrade of undici in @cacheable/net. The final dependency major of this pass. Marked (breaking) for the major bump; no code changes were needed.

Versions

• undici ^7.24.5 → ^8.6.0 (@cacheable/net, dependency)

Breaking notes

• No code changes required. @cacheable/net uses undici only for its types (RequestInit, Response) and re-exports RequestInit as FetchRequestInit; runtime fetching uses Node's global fetch (deliberately, to keep instanceof checks aligned with Node's bundled undici). net's source type-checks cleanly against undici 8 — verified with tsc --noEmit, since net builds with tsdown which doesn't type-check.
• @cacheable/net declares no engines field, so there's no engine-floor mismatch to reconcile.

Verification

• pnpm build + node scripts/test-build.mjs pass for all packages
• tsc --noEmit on @cacheable/net src is clean against undici 8
• pnpm test — @cacheable/net passes all 212 tests at 100% coverage; other packages unaffected (undici is net-only). The only repo-wide failures remain the 3 pre-existing sandbox-only ones (mockhttp.org:8080; two file-entry-cache chmod-under-root tests), which pass on GitHub CI.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	undici@​8.6.0

View full report

[gemini-code-assist]

Code Review

This pull request upgrades the undici dependency in packages/net/package.json from version ^7.24.5 to ^8.6.0, with corresponding updates made to the pnpm-lock.yaml file. I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3c9b7a2) to head (7e241ae).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1682   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           29        29           
  Lines         3504      3504           
  Branches       796       796           
=========================================
  Hits          3504      3504           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e241ae27b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Surface the transitive Node 22.19 requirement

With this dependency bump, the lockfile resolves undici@8.6.0 with engines: { node: '>=22.19.0' }, while @cacheable/net still declares no engines field. Projects installing @cacheable/net on Node 20 or Node 22.18 with engine-strict package managers can now fail during install even though this package does not advertise the new runtime floor; either keep the dependency on the Node-20-compatible undici line or add the matching engine requirement so consumers get a clear supported runtime.

Useful? React with 👍 / 👎.