Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 5100614

Browse filesBrowse files
nodejs-github-botRafaelGSS
nodejs-github-bot
authored and
RafaelGSS
committed
deps: update undici to 7.18.2
PR-URL: #61283 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
1 parent c357a39 commit 5100614
Copy full SHA for 5100614

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree

77 files changed

+3902
-1812
lines changed
Open diff view settings
Collapse file

‎deps/undici/src/README.md‎

Copy file name to clipboardExpand all lines: deps/undici/src/README.md
+53-1Lines changed: 53 additions & 1 deletion
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,8 @@ Installing undici as a module allows you to use a newer version than what's bund
166166

167167
## Quick Start
168168

169+
### Basic Request
170+
169171
```js
170172
import { request } from 'undici'
171173

@@ -184,6 +186,50 @@ for await (const data of body) { console.log('data', data) }
184186
console.log('trailers', trailers)
185187
```
186188

189+
### Using Cache Interceptor
190+
191+
Undici provides a powerful HTTP caching interceptor that follows HTTP caching best practices. Here's how to use it:
192+
193+
```js
194+
import { fetch, Agent, interceptors, cacheStores } from 'undici';
195+
196+
// Create a client with cache interceptor
197+
const client = new Agent().compose(interceptors.cache({
198+
// Optional: Configure cache store (defaults to MemoryCacheStore)
199+
store: new cacheStores.MemoryCacheStore({
200+
maxSize: 100 * 1024 * 1024, // 100MB
201+
maxCount: 1000,
202+
maxEntrySize: 5 * 1024 * 1024 // 5MB
203+
}),
204+
205+
// Optional: Specify which HTTP methods to cache (default: ['GET', 'HEAD'])
206+
methods: ['GET', 'HEAD']
207+
}));
208+
209+
// Set the global dispatcher to use our caching client
210+
setGlobalDispatcher(client);
211+
212+
// Now all fetch requests will use the cache
213+
async function getData() {
214+
const response = await fetch('https://api.example.com/data');
215+
// The server should set appropriate Cache-Control headers in the response
216+
// which the cache will respect based on the cache policy
217+
return response.json();
218+
}
219+
220+
// First request - fetches from origin
221+
const data1 = await getData();
222+
223+
// Second request - served from cache if within max-age
224+
const data2 = await getData();
225+
```
226+
227+
#### Key Features:
228+
- **Automatic Caching**: Respects `Cache-Control` and `Expires` headers
229+
- **Validation**: Supports `ETag` and `Last-Modified` validation
230+
- **Storage Options**: In-memory or persistent SQLite storage
231+
- **Flexible**: Configure cache size, TTL, and more
232+
187233
## Global Installation
188234

189235
Undici provides an `install()` function to add all WHATWG fetch classes to `globalThis`, making them available globally:
@@ -472,7 +518,7 @@ Note that consuming the response body is _mandatory_ for `request`:
472518
```js
473519
// Do
474520
const { body, headers } = await request(url);
475-
await res.body.dump(); // force consumption of body
521+
await body.dump(); // force consumption of body
476522

477523
// Do not
478524
const { headers } = await request(url);
@@ -487,6 +533,12 @@ const { headers } = await request(url);
487533

488534
The [Fetch Standard](https://fetch.spec.whatwg.org) requires implementations to exclude certain headers from requests and responses. In browser environments, some headers are forbidden so the user agent remains in full control over them. In Undici, these constraints are removed to give more control to the user.
489535

536+
#### Content-Encoding
537+
538+
* https://www.rfc-editor.org/rfc/rfc9110#field.content-encoding
539+
540+
Undici limits the number of `Content-Encoding` layers in a response to **5** to prevent resource exhaustion attacks. If a server responds with more than 5 content-encodings (e.g., `Content-Encoding: gzip, gzip, gzip, gzip, gzip, gzip`), the fetch will be rejected with an error. This limit matches the approach taken by [curl](https://curl.se/docs/CVE-2022-32206.html) and [urllib3](https://github.com/advisories/GHSA-gm62-xv2j-4rw9).
541+
490542
#### `undici.upgrade([url, options]): Promise`
491543

492544
Upgrade to a different protocol. See [MDN - HTTP - Protocol upgrade mechanism](https://developer.mozilla.org/en-US/docs/Web/HTTP/Protocol_upgrade_mechanism) for more details.
Collapse file

‎deps/undici/src/build/wasm.js‎

Copy file name to clipboardExpand all lines: deps/undici/src/build/wasm.js
+3-4Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ const WASM_CC = process.env.WASM_CC || 'clang'
1515
let WASM_CFLAGS = process.env.WASM_CFLAGS || '--sysroot=/usr/share/wasi-sysroot -target wasm32-unknown-wasi'
1616
let WASM_LDFLAGS = process.env.WASM_LDFLAGS || ''
1717
const WASM_LDLIBS = process.env.WASM_LDLIBS || ''
18-
const WASM_OPT = process.env.WASM_OPT || './wasm-opt'
18+
const WASM_OPT = process.env.WASM_OPT || 'wasm-opt'
1919

2020
// For compatibility with Node.js' `configure --shared-builtin-undici/undici-path ...`
2121
const EXTERNAL_PATH = process.env.EXTERNAL_PATH
@@ -65,7 +65,7 @@ if (process.argv[2] === '--docker') {
6565
-t ${WASM_BUILDER_CONTAINER} node build/wasm.js`
6666
console.log(`> ${cmd}\n\n`)
6767
execSync(cmd, { stdio: 'inherit' })
68-
process.exit(0)
68+
process.exit(0) // eslint-disable-line n/no-process-exit
6969
}
7070

7171
const hasApk = (function () {
@@ -78,8 +78,7 @@ if (hasApk) {
7878
// Gather information about the tools used for the build
7979
const buildInfo = execSync('apk info -v').toString()
8080
if (!buildInfo.includes('wasi-sdk')) {
81-
console.log('Failed to generate build environment information')
82-
process.exit(-1)
81+
throw new Error('Failed to generate build environment information')
8382
}
8483
console.log(buildInfo)
8584
}
Collapse file

‎deps/undici/src/docs/docs/api/Client.md‎

Copy file name to clipboardExpand all lines: deps/undici/src/docs/docs/api/Client.md
+2-1Lines changed: 2 additions & 1 deletion
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,11 @@ Returns: `Client`
2626
* **maxResponseSize** `number | null` (optional) - Default: `-1` - The maximum length of response body in bytes. Set to `-1` to disable.
2727
* **pipelining** `number | null` (optional) - Default: `1` - The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Carefully consider your workload and environment before enabling concurrent requests as pipelining may reduce performance if used incorrectly. Pipelining is sensitive to network stack settings as well as head of line blocking caused by e.g. long running requests. Set to `0` to disable keep-alive connections.
2828
* **connect** `ConnectOptions | Function | null` (optional) - Default: `null`.
29-
* **strictContentLength** `Boolean` (optional) - Default: `true` - Whether to treat request content length mismatches as errors. If true, an error is thrown when the request content-length header doesn't match the length of the request body.
29+
* **strictContentLength** `Boolean` (optional) - Default: `true` - Whether to treat request content length mismatches as errors. If true, an error is thrown when the request content-length header doesn't match the length of the request body. **Security Warning:** Disabling this option can expose your application to HTTP Request Smuggling attacks, where mismatched content-length headers cause servers and proxies to interpret request boundaries differently. This can lead to cache poisoning, credential hijacking, and bypassing security controls. Only disable this in controlled environments where you fully trust the request source.
3030
* **autoSelectFamily**: `boolean` (optional) - Default: depends on local Node version, on Node 18.13.0 and above is `false`. Enables a family autodetection algorithm that loosely implements section 5 of [RFC 8305](https://tools.ietf.org/html/rfc8305#section-5). See [here](https://nodejs.org/api/net.html#socketconnectoptions-connectlistener) for more details. This option is ignored if not supported by the current Node version.
3131
* **autoSelectFamilyAttemptTimeout**: `number` - Default: depends on local Node version, on Node 18.13.0 and above is `250`. The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. See [here](https://nodejs.org/api/net.html#socketconnectoptions-connectlistener) for more details.
3232
* **allowH2**: `boolean` - Default: `false`. Enables support for H2 if the server has assigned bigger priority to it through ALPN negotiation.
33+
* **useH2c**: `boolean` - Default: `false`. Enforces h2c for non-https connections.
3334
* **maxConcurrentStreams**: `number` - Default: `100`. Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
3435

3536
> **Notes about HTTP/2**
Collapse file

‎deps/undici/src/docs/docs/api/DiagnosticsChannel.md‎

Copy file name to clipboardExpand all lines: deps/undici/src/docs/docs/api/DiagnosticsChannel.md
+57Lines changed: 57 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -254,3 +254,60 @@ diagnosticsChannel.channel('undici:websocket:pong').subscribe(({ payload, websoc
254254
console.log(websocket) // the WebSocket instance
255255
})
256256
```
257+
258+
## `undici:proxy:connected`
259+
260+
This message is published after the `ProxyAgent` establishes a connection to the proxy server.
261+
262+
```js
263+
import diagnosticsChannel from 'diagnostics_channel'
264+
265+
diagnosticsChannel.channel('undici:proxy:connected').subscribe(({ socket, connectParams }) => {
266+
console.log(socket)
267+
console.log(connectParams)
268+
// const { origin, port, path, signal, headers, servername } = connectParams
269+
})
270+
```
271+
272+
## `undici:request:pending-requests`
273+
274+
This message is published when the deduplicate interceptor's pending request map changes. This is useful for monitoring and debugging request deduplication behavior.
275+
276+
The deduplicate interceptor automatically deduplicates concurrent requests for the same resource. When multiple identical requests are made while one is already in-flight, only one request is sent to the origin server, and all waiting handlers receive the same response.
277+
278+
```js
279+
import diagnosticsChannel from 'diagnostics_channel'
280+
281+
diagnosticsChannel.channel('undici:request:pending-requests').subscribe(({ type, size, key }) => {
282+
console.log(type) // 'added' or 'removed'
283+
console.log(size) // current number of pending requests
284+
console.log(key) // the deduplication key for this request
285+
})
286+
```
287+
288+
### Event Properties
289+
290+
- `type` (`string`): Either `'added'` when a new pending request is registered, or `'removed'` when a pending request completes (successfully or with an error).
291+
- `size` (`number`): The current number of pending requests after the change.
292+
- `key` (`string`): The deduplication key for the request, composed of the origin, method, path, and request headers.
293+
294+
### Example: Monitoring Request Deduplication
295+
296+
```js
297+
import diagnosticsChannel from 'diagnostics_channel'
298+
299+
const channel = diagnosticsChannel.channel('undici:request:pending-requests')
300+
301+
channel.subscribe(({ type, size, key }) => {
302+
if (type === 'added') {
303+
console.log(`New pending request: ${key} (${size} total pending)`)
304+
} else {
305+
console.log(`Request completed: ${key} (${size} remaining)`)
306+
}
307+
})
308+
```
309+
310+
This can be useful for:
311+
- Verifying that request deduplication is working as expected
312+
- Monitoring the number of concurrent in-flight requests
313+
- Debugging deduplication behavior in production environments
Collapse file

‎deps/undici/src/docs/docs/api/Dispatcher.md‎

Copy file name to clipboardExpand all lines: deps/undici/src/docs/docs/api/Dispatcher.md
+86Lines changed: 86 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -1043,6 +1043,7 @@ The `dns` interceptor enables you to cache DNS lookups for a given duration, per
10431043
- The function should return a single record from the records array.
10441044
- By default a simplified version of Round Robin is used.
10451045
- The `records` property can be mutated to store the state of the balancing algorithm.
1046+
- `storage: DNSStorage` - Custom storage for resolved DNS records
10461047

10471048
> The `Dispatcher#options` also gets extended with the options `dns.affinity`, `dns.dualStack`, `dns.lookup` and `dns.pick` which can be used to configure the interceptor at a request-per-request basis.
10481049
@@ -1057,6 +1058,14 @@ It represents a map of DNS IP addresses records for a single origin.
10571058
- `4.ips` - (`DNSInterceptorRecord[] | null`) The IPv4 addresses.
10581059
- `6.ips` - (`DNSInterceptorRecord[] | null`) The IPv6 addresses.
10591060

1061+
**DNSStorage**
1062+
It represents a storage object for resolved DNS records.
1063+
- `size` - (`number`) current size of the storage.
1064+
- `get` - (`(origin: string) => DNSInterceptorOriginRecords | null`) method to get the records for a given origin.
1065+
- `set` - (`(origin: string, records: DNSInterceptorOriginRecords | null, options: { ttl: number }) => void`) method to set the records for a given origin.
1066+
- `delete` - (`(origin: string) => void`) method to delete records for a given origin.
1067+
- `full` - (`() => boolean`) method to check if the storage is full, if returns `true`, DNS lookup will be skipped in this interceptor and new records will not be stored.
1068+
10601069
**Example - Basic DNS Interceptor**
10611070

10621071
```js
@@ -1073,6 +1082,45 @@ const response = await client.request({
10731082
})
10741083
```
10751084

1085+
**Example - DNS Interceptor and LRU cache as a storage**
1086+
1087+
```js
1088+
const { Client, interceptors } = require("undici");
1089+
const QuickLRU = require("quick-lru");
1090+
const { dns } = interceptors;
1091+
1092+
const lru = new QuickLRU({ maxSize: 100 });
1093+
1094+
const lruAdapter = {
1095+
get size() {
1096+
return lru.size;
1097+
},
1098+
get(origin) {
1099+
return lru.get(origin);
1100+
},
1101+
set(origin, records, { ttl }) {
1102+
lru.set(origin, records, { maxAge: ttl });
1103+
},
1104+
delete(origin) {
1105+
lru.delete(origin);
1106+
},
1107+
full() {
1108+
// For LRU cache, we can always store new records,
1109+
// old records will be evicted automatically
1110+
return false;
1111+
}
1112+
}
1113+
1114+
const client = new Agent().compose([
1115+
dns({ storage: lruAdapter })
1116+
])
1117+
1118+
const response = await client.request({
1119+
origin: `http://localhost:3030`,
1120+
...requestOpts
1121+
})
1122+
```
1123+
10761124
##### `responseError`
10771125

10781126
The `responseError` interceptor throws an error for responses with status code errors (>= 400).
@@ -1165,6 +1213,44 @@ The `cache` interceptor implements client-side response caching as described in
11651213
- `cacheByDefault` - The default expiration time to cache responses by if they don't have an explicit expiration and cannot have an heuristic expiry computed. If this isn't present, responses neither with an explicit expiration nor heuristically cacheable will not be cached. Default `undefined`.
11661214
- `type` - The [type of cache](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Caching#types_of_caches) for Undici to act as. Can be `shared` or `private`. Default `shared`. `private` implies privately cacheable responses will be cached and potentially shared with other users of your application.
11671215

1216+
##### `Deduplicate Interceptor`
1217+
1218+
The `deduplicate` interceptor deduplicates concurrent identical requests. When multiple identical requests are made while one is already in-flight, only one request is sent to the origin server, and all waiting handlers receive the same response. This reduces server load and improves performance.
1219+
1220+
**Options**
1221+
1222+
- `methods` - The [**safe** HTTP methods](https://www.rfc-editor.org/rfc/rfc9110#section-9.2.1) to deduplicate. Default `['GET']`.
1223+
- `skipHeaderNames` - Header names that, if present in a request, will cause the request to skip deduplication entirely. Useful for headers like `idempotency-key` where presence indicates unique processing. Header name matching is case-insensitive. Default `[]`.
1224+
- `excludeHeaderNames` - Header names to exclude from the deduplication key. Requests with different values for these headers will still be deduplicated together. Useful for headers like `x-request-id` that vary per request but shouldn't affect deduplication. Header name matching is case-insensitive. Default `[]`.
1225+
1226+
**Usage**
1227+
1228+
```js
1229+
const { Client, interceptors } = require("undici");
1230+
const { deduplicate, cache } = interceptors;
1231+
1232+
// Deduplicate only
1233+
const client = new Client("http://example.com").compose(
1234+
deduplicate()
1235+
);
1236+
1237+
// Deduplicate with caching
1238+
const clientWithCache = new Client("http://example.com").compose(
1239+
deduplicate(),
1240+
cache()
1241+
);
1242+
```
1243+
1244+
Requests are considered identical if they have the same:
1245+
- Origin
1246+
- HTTP method
1247+
- Path
1248+
- Request headers (excluding any headers specified in `excludeHeaderNames`)
1249+
1250+
All deduplicated requests receive the complete response including status code, headers, and body.
1251+
1252+
For observability, request deduplication events are published to the `undici:request:pending-requests` [diagnostic channel](/docs/docs/api/DiagnosticsChannel.md#undicirequestpending-requests).
1253+
11681254
## Instance Events
11691255

11701256
### Event: `'connect'`
Collapse file

‎deps/undici/src/docs/docs/api/H2CClient.md‎

Copy file name to clipboardExpand all lines: deps/undici/src/docs/docs/api/H2CClient.md
+1-1Lines changed: 1 addition & 1 deletion
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ Returns: `H2CClient`
4949
- **maxConcurrentStreams**: `number` - Default: `100`. Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
5050
- **pipelining** `number | null` (optional) - Default to `maxConcurrentStreams` - The amount of concurrent requests sent over a single HTTP/2 session in accordance with [RFC-7540](https://httpwg.org/specs/rfc7540.html#StreamsLayer) Stream specification. Streams can be closed up by remote server at any time.
5151
- **connect** `ConnectOptions | null` (optional) - Default: `null`.
52-
- **strictContentLength** `Boolean` (optional) - Default: `true` - Whether to treat request content length mismatches as errors. If true, an error is thrown when the request content-length header doesn't match the length of the request body.
52+
- **strictContentLength** `Boolean` (optional) - Default: `true` - Whether to treat request content length mismatches as errors. If true, an error is thrown when the request content-length header doesn't match the length of the request body. **Security Warning:** Disabling this option can expose your application to HTTP Request Smuggling attacks, where mismatched content-length headers cause servers and proxies to interpret request boundaries differently. This can lead to cache poisoning, credential hijacking, and bypassing security controls. Only disable this in controlled environments where you fully trust the request source.
5353
- **autoSelectFamily**: `boolean` (optional) - Default: depends on local Node version, on Node 18.13.0 and above is `false`. Enables a family autodetection algorithm that loosely implements section 5 of [RFC 8305](https://tools.ietf.org/html/rfc8305#section-5). See [here](https://nodejs.org/api/net.html#socketconnectoptions-connectlistener) for more details. This option is ignored if not supported by the current Node version.
5454
- **autoSelectFamilyAttemptTimeout**: `number` - Default: depends on local Node version, on Node 18.13.0 and above is `250`. The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. See [here](https://nodejs.org/api/net.html#socketconnectoptions-connectlistener) for more details.
5555

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.