From adc03157d0ead14d2c173fe469379cf49dba1b1e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 19:53:24 +0000 Subject: [PATCH 1/3] chore: bump undici from 7.29.0 to 8.10.0 Bumps [undici](https://github.com/nodejs/undici) from 7.29.0 to 8.10.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v7.29.0...v8.10.0) --- updated-dependencies: - dependency-name: undici dependency-version: 8.10.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- package.json | 2 +- pnpm-lock.yaml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 4c707002..2b21b1e8 100644 --- a/package.json +++ b/package.json @@ -101,7 +101,7 @@ "typescript": "^6.0.3", "typescript-eslint": "^8.20.0", "underscore": "^1.13.1", - "undici": "^7.16.0", + "undici": "^8.10.0", "vitest": "^4.1.11", "ws": "^8.2.2" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0eddcd65..aff14214 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -94,8 +94,8 @@ importers: specifier: ^1.13.1 version: 1.13.8 undici: - specifier: ^7.16.0 - version: 7.29.0 + specifier: ^8.10.0 + version: 8.10.0 vitest: specifier: ^4.1.11 version: 4.1.11(@types/node@26.4.0)(@vitest/coverage-v8@4.1.11)(vite@8.2.2(@types/node@26.4.0)(esbuild@0.28.2)(tsx@4.23.12)) @@ -2125,9 +2125,9 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} - engines: {node: '>=20.18.1'} + undici@8.10.0: + resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} + engines: {node: '>=22.19.0'} unpipe@1.0.0: resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==} @@ -4368,7 +4368,7 @@ snapshots: undici-types@8.3.0: {} - undici@7.29.0: {} + undici@8.10.0: {} unpipe@1.0.0: {} From 597ec1ec149efc9a3c2fece0f0eb971abdbb848e Mon Sep 17 00:00:00 2001 From: Yurii Bliuchak <1957659+bliuchak@users.noreply.github.com> Date: Thu, 3 Sep 2026 11:19:12 +0200 Subject: [PATCH 2/3] fix(test): restore CONNECT tunneling for WebSocket tests under undici 8 undici 8's ProxyAgent only tunnels http:-scheme requests through CONNECT when proxyTunnel is set; WebSocket support rewrites ws(s): to http(s): before dispatching, so it was silently forwarded instead of tunneled, breaking the Upgrade handshake through the proxy under test. ProxyAgent also passes the proxy's literal hostname as the TLS servername for HTTPS main-proxy connections, which Node rejects for IP literals (the tests always address the main proxy by 127.0.0.1). Co-Authored-By: Claude Sonnet 5 --- test/utils/http_client.ts | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/test/utils/http_client.ts b/test/utils/http_client.ts index 17149424..d5528ce3 100644 --- a/test/utils/http_client.ts +++ b/test/utils/http_client.ts @@ -1,4 +1,5 @@ import { Buffer } from 'node:buffer'; +import net from 'node:net'; import type { Readable } from 'node:stream'; import util from 'node:util'; import zlib from 'node:zlib'; @@ -80,7 +81,18 @@ export const createDispatcher = (opts: ConnectionOpts): Dispatcher => { if (new URL(opts.url).protocol === 'http:') { return new Client(proxy.origin, { connect: tls, connectTimeout }).compose(forwardToProxy(token)); } - return new ProxyAgent({ uri: proxy.origin, token, connectTimeout, requestTls: tls, proxyTls: tls }); + + // `undici`'s WebSocket support rewrites ws(s): to http(s): before dispatching, so a `ws:` + // target looks like plain HTTP to `ProxyAgent` here. Since undici 8, `ProxyAgent` only + // tunnels plain-HTTP requests through CONNECT when `proxyTunnel` is set - otherwise it + // forwards them (no CONNECT), which breaks the Upgrade handshake through this proxy. + const proxyTunnel = true; + // undici passes the proxy's literal hostname as the TLS `servername` for the proxy + // connection; Node's TLS layer rejects an IP address there. Certificate validation is + // already disabled above when needed, so any non-IP placeholder is fine. + const proxyTls = net.isIP(proxy.hostname) ? { ...tls, servername: 'localhost-test' } : tls; + + return new ProxyAgent({ uri: proxy.origin, token, connectTimeout, requestTls: tls, proxyTls, proxyTunnel }); }; /** Splits credentials out of the URL into a Basic header. */ From c022bc4dffa9c39e37fa3cd4d10f326616d66c2b Mon Sep 17 00:00:00 2001 From: Yurii Bliuchak <1957659+bliuchak@users.noreply.github.com> Date: Sun, 6 Sep 2026 16:53:27 +0200 Subject: [PATCH 3/3] ci: run E2E tests on Node.js 20 in addition to 24 --- .github/workflows/check.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index ef959a4c..dd924717 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -73,18 +73,23 @@ jobs: run: pnpm run test:unit e2e: - name: E2E tests (Node.js 24) + name: E2E tests (Node.js ${{ matrix.node-version }}) if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }} runs-on: ubuntu-24.04 + strategy: + fail-fast: false + matrix: + node-version: [20, 24] + steps: - name: Checkout repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - name: Use Node.js 24 + - name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: - node-version: 24 + node-version: ${{ matrix.node-version }} - name: Install pnpm and dependencies uses: apify/actions/pnpm-install@v1.1.2