chore: bump undici from 7.29.0 to 8.10.0

.github/workflows/check.yaml

@@ -73,18 +73,23 @@ jobs:
               run: pnpm run test:unit
 
     e2e:
-        name: E2E tests (Node.js 24)
+        name: E2E tests (Node.js ${{ matrix.node-version }})
         if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
         runs-on: ubuntu-24.04
 
+        strategy:
+            fail-fast: false
+            matrix:
+                node-version: [20, 24]
+
         steps:
             - name: Checkout repository
               uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-            - name: Use Node.js 24
+            - name: Use Node.js ${{ matrix.node-version }}
               uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
               with:
-                  node-version: 24
+                  node-version: ${{ matrix.node-version }}
 
             - name: Install pnpm and dependencies
               uses: apify/actions/pnpm-install@v1.1.2

package.json

@@ -101,7 +101,7 @@
         "typescript": "^6.0.3",
         "typescript-eslint": "^8.20.0",
         "underscore": "^1.13.1",
-        "undici": "^7.16.0",
+        "undici": "^8.10.0",
         "vitest": "^4.1.11",
         "ws": "^8.2.2"
     },

test/utils/http_client.ts

@@ -1,9 +1,10 @@
 import { Buffer } from 'node:buffer';
+import net from 'node:net';
 import type { Readable } from 'node:stream';
 import util from 'node:util';
 import zlib from 'node:zlib';
 
 import { Agent, Client, type Dispatcher, interceptors, ProxyAgent, request } from 'undici';
 
 // Stateless, so it is shared by every request.
 const REDIRECT_INTERCEPTOR = interceptors.redirect({ maxRedirections: 10 });
@@ -80,7 +81,18 @@
     if (new URL(opts.url).protocol === 'http:') {
         return new Client(proxy.origin, { connect: tls, connectTimeout }).compose(forwardToProxy(token));
     }
-    return new ProxyAgent({ uri: proxy.origin, token, connectTimeout, requestTls: tls, proxyTls: tls });
+
+    // `undici`'s WebSocket support rewrites ws(s): to http(s): before dispatching, so a `ws:`
+    // target looks like plain HTTP to `ProxyAgent` here. Since undici 8, `ProxyAgent` only
+    // tunnels plain-HTTP requests through CONNECT when `proxyTunnel` is set - otherwise it
+    // forwards them (no CONNECT), which breaks the Upgrade handshake through this proxy.
+    const proxyTunnel = true;
+    // undici passes the proxy's literal hostname as the TLS `servername` for the proxy
+    // connection; Node's TLS layer rejects an IP address there. Certificate validation is
+    // already disabled above when needed, so any non-IP placeholder is fine.
+    const proxyTls = net.isIP(proxy.hostname) ? { ...tls, servername: 'localhost-test' } : tls;
+
+    return new ProxyAgent({ uri: proxy.origin, token, connectTimeout, requestTls: tls, proxyTls, proxyTunnel });
 };
 
 /** Splits credentials out of the URL into a Basic header. */