chore(deps): bump undici from 6.23.0 to 6.24.0 in /libs/driver-adapters/executor

[dependabot]

Bumps undici from 6.23.0 to 6.24.0.

Release notes

Sourced from undici's releases.

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

• GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
  Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

• GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
  Malicious WebSocket 64-bit frame length handling could crash the client.

• GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
  CRLF injection via the upgrade option.

• GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
  Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

• GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
  Unbounded memory consumption in WebSocket permessage-deflate decompression.

Not applicable to v6

• GHSA-phc3-fgpg-7m6h / CVE-2026-2581 affects >= 7.17.0 < 7.24.0 only.

Affected and patched ranges (v6)

• CVE-2026-1525: affected < 6.24.0, patched 6.24.0
• CVE-2026-1528: affected >= 6.0.0 < 6.24.0, patched 6.24.0
• CVE-2026-1527: affected < 6.24.0, patched 6.24.0
• CVE-2026-2229: affected < 6.24.0, patched 6.24.0
• CVE-2026-1526: affected < 6.24.0, patched 6.24.0

References

• GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories
• NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
• NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528
• NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527
• NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229
• NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

Commits

• 8873c94 Bumped v6.24.0
• 411bd01 test(websocket): use node:assert for Node 18 compatibility
• 844bf59 test: fix http2 lint regressions in backport
• a444e4f test: stabilize h2 and tls-cert-leak under current test runner
• dc032a1 fix: h2 CI (#4395)
• 4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
• 7df6442 fix: adapt websocket frame-limit handling for v6 parser
• 4e0179a fix: reject duplicate content-length and host headers
• 5a97f08 Fix websocket 64-bit length overflow
• e43e898 fix: validate upgrade header to prevent CRLF injection
• Additional commits viewable in compare view

[codspeed-hq]

Merging this PR will not alter performance

✅ 11 untouched benchmarks
⏩ 11 skipped benchmarks¹

---

_{Comparing dependabot/npm_and_yarn/libs/driver-adapters/executor/undici-6.24.0 (60a0ca0) with main (7b80cc5)}

Footnotes

1. 11 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[github-actions]

Wasm Query Compiler File Size

Engine	This PR	Base branch	Diff
Postgres	3.505MiB	3.505MiB	0.000B
Postgres (gzip)	1.142MiB	1.142MiB	-3.000B
Postgres (size-optimized)	1.766MiB	1.766MiB	0.000B
Postgres (size-optimized, gzip)	694.904KiB	694.995KiB	-93.000B
Mysql	3.458MiB	3.458MiB	0.000B
Mysql (gzip)	1.127MiB	1.127MiB	0.000B
Mysql (size-optimized)	1.736MiB	1.736MiB	0.000B
Mysql (size-optimized, gzip)	684.227KiB	684.225KiB	2.000B
Sqlite	3.376MiB	3.376MiB	0.000B
Sqlite (gzip)	1.098MiB	1.098MiB	-7.000B
Sqlite (size-optimized)	1.692MiB	1.692MiB	0.000B
Sqlite (size-optimized, gzip)	667.291KiB	667.292KiB	-2.000B
SQL Server	3.593MiB	3.593MiB	0.000B
SQL Server (gzip)	1.160MiB	1.160MiB	-2.000B
SQL Server (size-optimized)	1.765MiB	1.765MiB	0.000B
SQL Server (size-optimized, gzip)	698.005KiB	698.004KiB	1.000B
CockroachDB	3.555MiB	3.555MiB	0.000B
CockroachDB (gzip)	1.160MiB	1.160MiB	0.000B
CockroachDB (size-optimized)	1.791MiB	1.791MiB	0.000B
CockroachDB (size-optimized, gzip)	705.223KiB	705.229KiB	-6.000B