Bump undici and @redocly/cli in /openapi

[dependabot]

Bumps undici to 7.28.0 and updates ancestor dependency @redocly/cli. These dependencies need to be updated together.

Updates undici from 7.25.0 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	d0574cc4
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	ea8930cf

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
• Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

• f9eba0a Bumped v7.28.0 (#5430)
• a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
• 8cb10f9 websocket: limit the number of fragments in a message
• 04201f8 fix: honor requestTls when proxy is SOCKS5
• fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
• bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
• 9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
• 376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
• 3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
• 85a2405 fix(cache): trim qualified field names
• Additional commits viewable in compare view

Updates @redocly/cli from 2.32.2 to 2.34.0

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.34.0

Minor Changes

• Improved CLI install speed by bundling the CLI into a dependency-free package.

  Warning: The published package no longer ships runtime dependencies in node_modules. Plugins that relied on importing packages hoisted from the CLI (such as @redocly/openapi-core) must now declare those packages as their own dependencies.

@​redocly/cli@​2.33.2

Patch Changes

• Fixed a path traversal in the split command that might have written files outside the chosen --outDir.
• Updated @​redocly/openapi-core to v2.33.2.

@​redocly/cli@​2.33.1

Patch Changes

• Updated @​redocly/openapi-core to v2.33.1.

@​redocly/cli@​2.33.0

Minor Changes

• Added the --component-names-strategy option to the bundle command. This option allows a choice of how inline Schema components are named: basename (default) or title (from each schema's title field).

Patch Changes

• Updated @​redocly/openapi-core to v2.33.0.

Commits

• 9df1224 chore: 🔖 release new versions (#2899)
• c6304a4 chore!: bundle CLI with esbuild (#2866)
• 7027460 chore: refactor file extension detection and export spec types (#2897)
• fb7c148 chore: 🔖 release new versions (#2896)
• 26a0f29 fix: path traversal in the split command (#2891)
• d32cd86 chore: 🔖 release new versions (#2892)
• 57ccaf9 chore: update opentelemetry dependencies (#2895)
• 2e7f3ff chore: bump js-yaml to v4.2.0 (#2893)
• 4dfc176 chore: add comment of perf benchmark results to the external PR's (#2871)
• 44887ee chore: refactor async3 types (#2880)
• Additional commits viewable in compare view