Merge branch 'main' into event-loop-lag

.github/workflows/backport.yml

@@ -0,0 +1,29 @@
+name: Backport
+on:
+  pull_request_target:
+    types:
+      - closed
+      - labeled
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  backport:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.pull_request.merged
+      && (
+        github.event.action == 'closed'
+        || (
+          github.event.action == 'labeled'
+          && contains(github.event.label.name, 'backport')
+        )
+      )
+    name: Backport
+    steps:
+      - name: Backport
+        uses: tibdex/backport@v2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
+        uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
         with:
           egress-policy: audit
 
@@ -50,7 +50,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c # v2.3.3
+        uses: github/codeql-action/init@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v2.3.3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b611370bb5703a7efb587f9d136a52ea24c5c38c # v2.3.3
+        uses: github/codeql-action/autobuild@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v2.3.3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c # v2.3.3
+        uses: github/codeql-action/analyze@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v2.3.3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/nodejs-shared.yml

@@ -0,0 +1,102 @@
+name: Node.js compiled --shared-builtin-undici/undici-path CI
+
+on:
+  push:
+    branches:
+     - main
+     - current
+     - next
+     - 'v*'
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test-shared-builtin:
+    name: Test with Node.js ${{ matrix.version }} compiled --shared-builtin-undici/undici-path
+    strategy:
+      fail-fast: false
+      max-parallel: 0
+      matrix:
+        version: [20, 22]
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      # Checkout into a subdirectory otherwise Node.js tests will break due to finding Undici's package.json in a parent directory.
+      - name: Checkout
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          path: ./undici
+          persist-credentials: false
+
+      # Setup node, install deps, and build undici prior to building node with `--shared-builtin-undici/undici-path` and testing
+      - name: Setup Node.js@${{ inputs.version }}
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        with:
+          node-version: ${{ inputs.version }}
+
+      - name: Install dependencies
+        working-directory: ./undici
+        run: npm install
+
+      - name: Install wasi-libc
+        run: sudo apt-get install -y wasi-libc
+
+      - name: Build WASM
+        working-directory: ./undici
+        run: |
+          export EXTERNAL_PATH=${{ github.workspace }}/undici
+          export WASM_CC=clang
+          export WASM_CFLAGS='--target=wasm32-wasi --sysroot=/usr'
+          export WASM_LDFLAGS='-nodefaultlibs'
+          export WASM_LDLIBS='-lc'
+          node build/wasm.js
+
+      - name: Determine latest release
+        id: release
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          result-encoding: string
+          script: |
+            const req = await fetch('https://nodejs.org/download/release/index.json')
+            const releases = await req.json()
+
+            const latest = releases.find((r) => r.version.startsWith('v${{ matrix.version }}'))
+            return latest.version
+
+      - name: Download and extract source
+        run: curl https://nodejs.org/download/release/${{ steps.release.outputs.result }}/node-${{ steps.release.outputs.result }}.tar.xz | tar xfJ -
+
+      - name: Install ninja
+        run: sudo apt-get install ninja-build
+
+      - name: ccache
+        uses: hendrikmuhs/ccache-action@c92f40bee50034e84c763e33b317c77adaa81c92 #v1.2.13
+        with:
+          key: node(external_undici)${{ matrix.version }}
+
+      - name: Build node
+        working-directory: ./node-${{ steps.release.outputs.result }}
+        run: |
+          export CC="ccache gcc"
+          export CXX="ccache g++"
+          rm -rf deps/undici
+          ./configure --shared-builtin-undici/undici-path ${{ github.workspace }}/undici/loader.js --ninja --prefix=./final
+          make
+          make install
+          echo "$(pwd)/final/bin" >> $GITHUB_PATH
+
+      - name: Print version information
+        run: |
+          echo OS: $(node -p "os.version()")
+          echo Node.js: $(node --version)
+          echo npm: $(npm --version)
+          echo git: $(git --version)
+          echo external config: $(node -e "console.log(process.config)" | grep NODE_SHARED_BUILTIN_UNDICI_UNDICI_PATH)
+          echo Node.js built-in undici version: $(node -p "process.versions.undici") # undefined for external Undici
+
+      - name: Run tests
+        working-directory: ./node-${{ steps.release.outputs.result }}
+        run: tools/test.py -p dots --flaky-tests=dontcare
+

.github/workflows/nodejs.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
+        uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
         with:
           egress-policy: audit
 
@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3
+        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
 
   lint:
     name: Lint

.github/workflows/scorecard.yml

@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -43,14 +43,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
+        uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15
         with:
           sarif_file: results.sarif

CONTRIBUTING.md

@@ -8,7 +8,7 @@
   * [Releases](#releases)
   * [Update `WPTs`](#update-wpts)
   * [Building for externally shared node builtins](#external-builds)
-  *  [Benchmarks](#benchmarks
+  *  [Benchmarks](#benchmarks)
   *  [Documentation](#documentation)
 * [Developer's Certificate of Origin 1.1](#developers-certificate-of-origin)
   * [Moderation Policy](#moderation-policy)
@@ -156,7 +156,8 @@ If you are packaging `undici` for a distro, this might help if you would like to
 an unbundled version instead of bundling one in `libnode.so`.
 
 To enable this, pass `EXTERNAL_PATH=/path/to/global/node_modules/undici` to `build/wasm.js`.
-You shall also pass this path to `--shared-builtin-undici/undici-path` in Node.js's `configure.py`.
+Pass this path with `loader.js` appended to `--shared-builtin-undici/undici-path` in Node.js's `configure.py`.
+If building on a non-Alpine Linux distribution, you may need to also set the `WASM_CC`, `WASM_CFLAGS`, `WASM_LDFLAGS` and `WASM_LDLIBS` environment variables before running `build/wasm.js`.
 
 <a id="benchmarks"></a>
 ### Benchmarks

README.md

@@ -259,13 +259,13 @@ await fetch('http://example.com', { method: 'POST', body })
 
 #### `request.duplex`
 
-- half
+- `'half'`
 
-In this implementation of fetch, `request.duplex` must be set if `request.body` is `ReadableStream` or `Async Iterables`, however, fetch requests are currently always full duplex. For more detail refer to the [Fetch Standard.](https://fetch.spec.whatwg.org/#dom-requestinit-duplex).
+In this implementation of fetch, `request.duplex` must be set if `request.body` is `ReadableStream` or `Async Iterables`, however, even though the value must be set to `'half'`, it is actually a _full_ duplex. For more detail refer to the [Fetch Standard.](https://fetch.spec.whatwg.org/#dom-requestinit-duplex).
 
 #### `response.body`
 
-Nodejs has two kinds of streams: [web streams](https://nodejs.org/dist/latest-v16.x/docs/api/webstreams.html), which follow the API of the WHATWG web standard found in browsers, and an older Node-specific [streams API](https://nodejs.org/api/stream.html). `response.body` returns a readable web stream. If you would prefer to work with a Node stream you can convert a web stream using `.fromWeb()`.
+Nodejs has two kinds of streams: [web streams](https://nodejs.org/api/webstreams.html), which follow the API of the WHATWG web standard found in browsers, and an older Node-specific [streams API](https://nodejs.org/api/stream.html). `response.body` returns a readable web stream. If you would prefer to work with a Node stream you can convert a web stream using `.fromWeb()`.
 
 ```js
 import { fetch } from 'undici'

benchmarks/package.json

@@ -20,7 +20,7 @@
     "mitata": "^0.1.11",
     "node-fetch": "^3.3.2",
     "request": "^2.88.2",
-    "superagent": "^9.0.2",
+    "superagent": "^10.0.0",
     "wait-on": "^7.2.0"
   }
 }

build/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine3.19@sha256:67225d40d3fb36314e392846effda04b95c973bf52e44ea064a8e0015c83056e
+FROM node:22-alpine3.19@sha256:30c5be9215c0ab992925f025a388d41e9be66c159a6cefb8f132ba829874e7f7
 
 ARG UID=1000
 ARG GID=1000

build/wasm.js

@@ -15,6 +15,9 @@ let WASM_CFLAGS = process.env.WASM_CFLAGS || '--sysroot=/usr/share/wasi-sysroot
 let WASM_LDFLAGS = process.env.WASM_LDFLAGS || ''
 const WASM_LDLIBS = process.env.WASM_LDLIBS || ''
 
+// For compatibility with Node.js' `configure --shared-builtin-undici/undici-path ...`
+const EXTERNAL_PATH = process.env.EXTERNAL_PATH
+
 // These are relevant for undici and should not be overridden
 WASM_CFLAGS += ' -Ofast -fno-exceptions -fvisibility=hidden -mexec-model=reactor'
 WASM_LDFLAGS += ' -Wl,-error-limit=0 -Wl,-O3 -Wl,--lto-O3 -Wl,--strip-all'
@@ -59,7 +62,7 @@ if (process.argv[2] === '--prebuild') {
 }
 
 if (process.argv[2] === '--docker') {
-  let cmd = `docker run --rm -it --platform=${platform.toString().trim()}`
+  let cmd = `docker run --rm -t --platform=${platform.toString().trim()}`
   if (process.platform === 'linux') {
     cmd += ` --user ${process.getuid()}:${process.getegid()}`
   }
@@ -73,6 +76,9 @@ if (process.argv[2] === '--docker') {
 const hasApk = (function () {
   try { execSync('command -v apk'); return true } catch (error) { return false }
 })()
+const hasOptimizer = (function () {
+  try { execSync('./wasm-opt --version'); return true } catch (error) { return false }
+})()
 if (hasApk) {
   // Gather information about the tools used for the build
   const buildInfo = execSync('apk info -v').toString()
@@ -81,24 +87,38 @@ if (hasApk) {
     process.exit(-1)
   }
   console.log(buildInfo)
+}
 
-  // Build wasm binary
-  execSync(`${WASM_CC} ${WASM_CFLAGS} ${WASM_LDFLAGS} \
-  ${join(WASM_SRC, 'src')}/*.c \
-  -I${join(WASM_SRC, 'include')} \
-  -o ${join(WASM_OUT, 'llhttp.wasm')} \
-  ${WASM_LDLIBS}`, { stdio: 'inherit' })
+// Build wasm binary
+execSync(`${WASM_CC} ${WASM_CFLAGS} ${WASM_LDFLAGS} \
+${join(WASM_SRC, 'src')}/*.c \
+-I${join(WASM_SRC, 'include')} \
+-o ${join(WASM_OUT, 'llhttp.wasm')} \
+${WASM_LDLIBS}`, { stdio: 'inherit' })
 
+if (hasOptimizer) {
   execSync(`./wasm-opt ${WASM_OPT_FLAGS} -o ${join(WASM_OUT, 'llhttp.wasm')} ${join(WASM_OUT, 'llhttp.wasm')}`, { stdio: 'inherit' })
-  writeWasmChunk('llhttp.wasm', 'llhttp-wasm.js')
+}
+writeWasmChunk('llhttp.wasm', 'llhttp-wasm.js')
 
-  // Build wasm simd binary
-  execSync(`${WASM_CC} ${WASM_CFLAGS} -msimd128 ${WASM_LDFLAGS} \
-  ${join(WASM_SRC, 'src')}/*.c \
-  -I${join(WASM_SRC, 'include')} \
-  -o ${join(WASM_OUT, 'llhttp_simd.wasm')} \
-  ${WASM_LDLIBS}`, { stdio: 'inherit' })
+// Build wasm simd binary
+execSync(`${WASM_CC} ${WASM_CFLAGS} -msimd128 ${WASM_LDFLAGS} \
+${join(WASM_SRC, 'src')}/*.c \
+-I${join(WASM_SRC, 'include')} \
+-o ${join(WASM_OUT, 'llhttp_simd.wasm')} \
+${WASM_LDLIBS}`, { stdio: 'inherit' })
 
+if (hasOptimizer) {
   execSync(`./wasm-opt ${WASM_OPT_FLAGS} --enable-simd -o ${join(WASM_OUT, 'llhttp_simd.wasm')} ${join(WASM_OUT, 'llhttp_simd.wasm')}`, { stdio: 'inherit' })
-  writeWasmChunk('llhttp_simd.wasm', 'llhttp_simd-wasm.js')
+}
+writeWasmChunk('llhttp_simd.wasm', 'llhttp_simd-wasm.js')
+
+// For compatibility with Node.js' `configure --shared-builtin-undici/undici-path ...`
+if (EXTERNAL_PATH) {
+  writeFileSync(join(ROOT, 'loader.js'), `
+'use strict'
+globalThis.__UNDICI_IS_NODE__ = true
+module.exports = require('node:module').createRequire('${EXTERNAL_PATH}/loader.js')('./index-fetch.js')
+delete globalThis.__UNDICI_IS_NODE__
+`)
 }

docs/docs/api/RetryHandler.md

@@ -19,7 +19,7 @@ Extends: [`Dispatch.DispatchOptions`](Dispatcher.md#parameter-dispatchoptions).
 
 #### `RetryOptions`
 
-- **retry** `(err: Error, context: RetryContext, callback: (err?: Error | null) => void) => void` (optional) - Function to be called after every retry. It should pass error if no more retries should be performed.
+- **retry** `(err: Error, context: RetryContext, callback: (err?: Error | null) => void) => number | null` (optional) - Function to be called after every retry. It should pass error if no more retries should be performed.
 - **maxRetries** `number` (optional) - Maximum number of retries. Default: `5`
 - **maxTimeout** `number` (optional) - Maximum number of milliseconds to wait before retrying. Default: `30000` (30 seconds)
 - **minTimeout** `number` (optional) - Minimum number of milliseconds to wait before retrying. Default: `500` (half a second)

lib/core/request.js

@@ -183,7 +183,7 @@ class Request {
 
     validateHandler(handler, method, upgrade)
 
-    this.servername = servername || getServerName(this.host)
+    this.servername = servername || getServerName(this.host) || null
 
     this[kHandler] = handler
 

lib/web/fetch/response.js

@@ -34,8 +34,9 @@ const hasFinalizationRegistry = globalThis.FinalizationRegistry && process.versi
 let registry
 
 if (hasFinalizationRegistry) {
-  registry = new FinalizationRegistry((stream) => {
-    if (!stream.locked && !isDisturbed(stream) && !isErrored(stream)) {
+  registry = new FinalizationRegistry((weakRef) => {
+    const stream = weakRef.deref()
+    if (stream && !stream.locked && !isDisturbed(stream) && !isErrored(stream)) {
       stream.cancel('Response object has been garbage collected').catch(noop)
     }
   })
@@ -526,7 +527,12 @@ function fromInnerResponse (innerResponse, guard) {
   setHeadersGuard(response[kHeaders], guard)
 
   if (hasFinalizationRegistry && innerResponse.body?.stream) {
-    registry.register(response, innerResponse.body.stream)
+    // If the target (response) is reclaimed, the cleanup callback may be called at some point with
+    // the held value provided for it (innerResponse.body.stream). The held value can be any value:
+    // a primitive or an object, even undefined. If the held value is an object, the registry keeps
+    // a strong reference to it (so it can pass it to the cleanup callback later). Reworded from
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/FinalizationRegistry
+    registry.register(response, new WeakRef(innerResponse.body.stream))
   }
 
   return response