Skip to content

Commit 2e6d039

Browse files
nodejs-github-botaduh95
authored andcommitted
deps: update undici to 8.4.0
PR-URL: #63779 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Matthew Aitken <maitken033380023@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent 5a17d5b commit 2e6d039

31 files changed

Lines changed: 625 additions & 121 deletions

deps/undici/src/README.md

Lines changed: 59 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -21,28 +21,65 @@ npm i undici
2121

2222
## Benchmarks
2323

24-
The benchmark is a simple getting data [example](https://github.com/nodejs/undici/blob/main/benchmarks/benchmark.js) using a
25-
50 TCP connections with a pipelining depth of 10 running on Node 22.11.0.
24+
The benchmark is a simple getting data [example](https://github.com/nodejs/undici/blob/main/benchmarks/benchmark.js) using
25+
50 TCP connections with a pipelining depth of 10 running on Node 24.14.1.
26+
27+
### HTTP/1.1
2628

2729
```
2830
┌────────────────────────┬─────────┬────────────────────┬────────────┬─────────────────────────┐
2931
│ Tests │ Samples │ Result │ Tolerance │ Difference with slowest │
3032
├────────────────────────┼─────────┼────────────────────┼────────────┼─────────────────────────┤
31-
│ 'axios' │ 15 │ '5708.26 req/sec' │ '± 2.91 %' │ '-' │
32-
│ 'http - no keepalive' │ 10 │ '5809.80 req/sec' │ '± 2.30 %' │ '+ 1.78 %'
33-
│ 'request' │ 30 │ '5828.80 req/sec' │ '± 2.91 %' │ '+ 2.11 %'
34-
│ 'undici - fetch' │ 40 │ '5903.78 req/sec' │ '± 2.87 %' │ '+ 3.43 %'
35-
│ 'node-fetch' │ 10 │ '5945.40 req/sec' │ '± 2.13 %' │ '+ 4.15 %'
36-
│ 'got' │ 35 │ '6511.45 req/sec' │ '± 2.84 %' │ '+ 14.07 %' │
37-
│ 'http - keepalive' │ 65 │ '9193.24 req/sec' │ '± 2.92 %' │ '+ 61.05 %' │
38-
│ 'superagent' │ 35 │ '9339.43 req/sec' │ '± 2.95 %' │ '+ 63.61 %' │
39-
│ 'undici - pipeline' │ 50 │ '13364.62 req/sec' │ '± 2.93 %' │ '+ 134.13 %' │
40-
│ 'undici - stream' │ 95 │ '18245.36 req/sec' │ '± 2.99 %' │ '+ 219.63 %' │
41-
│ 'undici - request' │ 50 │ '18340.17 req/sec' │ '± 2.84 %' │ '+ 221.29 %' │
42-
│ 'undici - dispatch' │ 40 │ '22234.42 req/sec' │ '± 2.94 %' │ '+ 289.51 %' │
33+
│ 'node-fetch' │ 50 │ '4711.86 req/sec' │ '± 2.92 %' │ '-' │
34+
│ 'undici - fetch' │ 75 │ '5438.50 req/sec' │ '± 2.97 %' │ '+ 15.42 %' │
35+
│ 'axios' │ 45 │ '5448.08 req/sec' │ '± 2.98 %' │ '+ 15.62 %' │
36+
│ 'request' │ 65 │ '5809.63 req/sec' │ '± 2.90 %' │ '+ 23.30 %' │
37+
│ 'http - no keepalive' │ 35 │ '5910.77 req/sec' │ '± 2.87 %' │ '+ 25.44 %' │
38+
│ 'got' │ 50 │ '6047.80 req/sec' │ '± 2.91 %' │ '+ 28.35 %' │
39+
│ 'superagent' │ 60 │ '7534.53 req/sec' │ '± 2.97 %' │ '+ 59.91 %' │
40+
│ 'http - keepalive' │ 75 │ '9343.41 req/sec' │ '± 2.90 %' │ '+ 98.30 %' │
41+
│ 'undici - pipeline' │ 65 │ '13470.70 req/sec' │ '± 2.93 %' │ '+ 185.89 %' │
42+
│ 'undici - request' │ 80 │ '16850.87 req/sec' │ '± 2.93 %' │ '+ 257.63 %' │
43+
│ 'undici - stream' │ 101 │ '18488.56 req/sec' │ '± 3.81 %' │ '+ 292.38 %' │
44+
│ 'undici - dispatch' │ 101 │ '20786.44 req/sec' │ '± 3.08 %' │ '+ 341.15 %' │
4345
└────────────────────────┴─────────┴────────────────────┴────────────┴─────────────────────────┘
4446
```
4547

48+
### HTTP/1.1 over HTTPS
49+
50+
Using [benchmark-https.js](https://github.com/nodejs/undici/blob/main/benchmarks/benchmark-https.js) against an h1-over-TLS server (50 connections, pipelining depth 10, Node 24.14.1).
51+
52+
```
53+
┌────────────────────────┬─────────┬───────────────────┬────────────┬─────────────────────────┐
54+
│ Tests │ Samples │ Result │ Tolerance │ Difference with slowest │
55+
├────────────────────────┼─────────┼───────────────────┼────────────┼─────────────────────────┤
56+
│ 'https - no keepalive'│ 10 │ '1358.40 req/sec' │ '± 1.99 %' │ '-' │
57+
│ 'undici - fetch' │ 30 │ '3721.76 req/sec' │ '± 2.97 %' │ '+ 173.98 %' │
58+
│ 'https - keepalive' │ 35 │ '5633.91 req/sec' │ '± 2.84 %' │ '+ 314.75 %' │
59+
│ 'undici - pipeline' │ 15 │ '6254.05 req/sec' │ '± 2.80 %' │ '+ 360.40 %' │
60+
│ 'undici - request' │ 25 │ '6669.80 req/sec' │ '± 2.73 %' │ '+ 391.01 %' │
61+
│ 'undici - stream' │ 25 │ '7019.04 req/sec' │ '± 2.77 %' │ '+ 416.71 %' │
62+
│ 'undici - dispatch' │ 20 │ '7361.85 req/sec' │ '± 2.90 %' │ '+ 441.95 %' │
63+
└────────────────────────┴─────────┴───────────────────┴────────────┴─────────────────────────┘
64+
```
65+
66+
### HTTP/2
67+
68+
Using [benchmark-http2.js](https://github.com/nodejs/undici/blob/main/benchmarks/benchmark-http2.js) against an h2 server (50 connections, pipelining depth 10, Node 24.14.1).
69+
70+
```
71+
┌────────────────────────┬─────────┬───────────────────┬────────────┬─────────────────────────┐
72+
│ Tests │ Samples │ Result │ Tolerance │ Difference with slowest │
73+
├────────────────────────┼─────────┼───────────────────┼────────────┼─────────────────────────┤
74+
│ 'undici - fetch' │ 45 │ '3499.03 req/sec' │ '± 2.93 %' │ '-' │
75+
│ 'native - http2' │ 25 │ '4904.58 req/sec' │ '± 2.81 %' │ '+ 40.17 %' │
76+
│ 'undici - pipeline' │ 60 │ '5836.82 req/sec' │ '± 2.99 %' │ '+ 66.81 %' │
77+
│ 'undici - request' │ 65 │ '6831.25 req/sec' │ '± 2.83 %' │ '+ 95.23 %' │
78+
│ 'undici - stream' │ 55 │ '6874.30 req/sec' │ '± 2.91 %' │ '+ 96.46 %' │
79+
│ 'undici - dispatch' │ 55 │ '7791.23 req/sec' │ '± 2.96 %' │ '+ 122.67 %' │
80+
└────────────────────────┴─────────┴───────────────────┴────────────┴─────────────────────────┘
81+
```
82+
4683
## Undici vs. Fetch
4784

4885
### Overview
@@ -340,6 +377,9 @@ The `body` mixins are the most common way to format the request/response body. M
340377
> [!NOTE]
341378
> The body returned from `undici.request` does not implement `.formData()`.
342379
380+
> [!WARNING]
381+
> Calling `body.formData()` on a fetch response causes undici to buffer and parse the entire body. Since this is dictated by the spec, `body.formData()` must only be called on responses from trusted servers.
382+
343383
Example usage:
344384

345385
```js
@@ -740,10 +780,11 @@ and `undici.Agent`) which will enable the family autoselection algorithm when es
740780
Undici aligns with the Node.js LTS schedule. The following table shows the supported versions:
741781

742782
| Undici Version | Bundled in Node.js | Node.js Versions Supported | End of Life |
743-
|----------------|-------------------|----------------------------|-------------|
744-
| 5.x | 18.x | ≥14.0 (tested: 14, 16, 18) | 2024-04-30 |
745-
| 6.x | 20.x, 22.x | ≥18.17 (tested: 18, 20, 21, 22) | 2026-04-30 |
746-
| 7.x | 24.x | ≥20.18.1 (tested: 20, 22, 24) | 2027-04-30 |
783+
|----------------|--------------------|----------------------------|-------------|
784+
| 5.x | 18.x | ≥14.0 (tested: 14, 16, 18) | 2024-04-30 |
785+
| 6.x | 20.x, 22.x | ≥18.17 (tested: 18, 20, 21, 22) | 2027-04-30 |
786+
| 7.x | 24.x | ≥20.18.1 (tested: 20, 22, 24) | 2028-04-30 |
787+
| 8.x | 26.x | ≥22.19.0 (tested: 22, 24, 26) | 2029-04-30 |
747788

748789
## License
749790

deps/undici/src/SECURITY.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ meet the following criteria:
8181
**Undici trusts**:
8282

8383
* The application code that uses its APIs, including all configuration,
84-
options, and callbacks provided by the application.
84+
options, callbacks, and decisions about which body-consuming APIs to call.
8585
* The operating system and its network stack.
8686
* The Node.js runtime undici is running on.
8787
* Dependencies installed by the application.
@@ -142,6 +142,17 @@ lead to a loss of confidentiality, integrity, or availability.
142142
resources, that is not considered a vulnerability. Applications are
143143
responsible for setting appropriate limits on response sizes.
144144

145+
#### Calling `body.formData()` on untrusted responses
146+
147+
* `body.formData()` buffers and parses the entire response body. Multipart
148+
parsing has inherent security risks, especially when the body is supplied by
149+
an untrusted or user-controlled server. Applications must only call
150+
`body.formData()` on responses from trusted servers. For untrusted responses,
151+
applications should use a dedicated streaming multipart parser and enforce
152+
application-specific limits. Resource exhaustion or parser exposure caused by
153+
calling `body.formData()` on untrusted responses is considered an application
154+
responsibility, not a vulnerability in undici.
155+
145156
#### Application Misconfiguration
146157

147158
* Issues arising from incorrect or insecure use of undici APIs (such as

deps/undici/src/docs/docs/api/Agent.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Extends: [`PoolOptions`](/docs/docs/api/Pool.md#parameter-pooloptions)
2121
* **factory** `(origin: URL, opts: Object) => Dispatcher` - Default: `(origin, opts) => new Pool(origin, opts)`
2222
* **maxOrigins** `number` (optional) - Default: `Infinity` - Limits the total number of origins that can receive requests at a time, throwing an `MaxOriginsReachedError` error when attempting to dispatch when the max is reached. If `Infinity`, no limit is enforced.
2323

24+
> [!NOTE]
25+
> Like `Pool`, `Agent` inherits all [`ClientOptions`](/docs/docs/api/Client.md#parameter-clientoptions). `allowH2` defaults to `true` and `maxConcurrentStreams` to `100`. The per-origin `Pool` it creates uses the default unlimited `connections`, so concurrent requests to the same origin land on separate `Client` instances and separate TCP/TLS sockets — HTTP/2 multiplexing on a shared session does not apply unless `connections` is set to a small value. See [`PoolOptions`](/docs/docs/api/Pool.md#parameter-pooloptions).
26+
2427
## Instance Properties
2528

2629
### `Agent.closed`

deps/undici/src/docs/docs/api/Client.md

Lines changed: 43 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,16 @@ Returns: `Client`
2626
* **maxResponseSize** `number | null` (optional) - Default: `-1` - The maximum length of response body in bytes. Set to `-1` to disable.
2727
* **webSocket** `WebSocketOptions` (optional) - WebSocket-specific configuration options.
2828
* **maxPayloadSize** `number` (optional) - Default: `134217728` (128 MB) - Maximum allowed payload size in bytes for WebSocket messages. Applied to uncompressed messages, compressed frame payloads, and decompressed (permessage-deflate) messages. Set to 0 to disable the limit.
29-
* **pipelining** `number | null` (optional) - Default: `1` - The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Carefully consider your workload and environment before enabling concurrent requests as pipelining may reduce performance if used incorrectly. Pipelining is sensitive to network stack settings as well as head of line blocking caused by e.g. long running requests. Set to `0` to disable keep-alive connections.
30-
* **connect** `ConnectOptions | Function | null` (optional) - Default: `null`.
29+
* **pipelining** `number | null` (optional) - Default: `1` - The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Carefully consider your workload and environment before enabling concurrent requests as pipelining may reduce performance if used incorrectly. Pipelining is sensitive to network stack settings as well as head of line blocking caused by e.g. long running requests. Set to `0` to disable keep-alive connections. This option has no effect once HTTP/2 is negotiated — see `maxConcurrentStreams` for the h2 dispatch ceiling.
30+
* **connect** `ConnectOptions | Function | null` (optional) - Default: `null` - Configures how undici establishes TCP/TLS connections. Accepts two forms:
31+
* **Object (`ConnectOptions`)**: Options passed directly to the internal [`buildConnector()`](/docs/docs/api/Connector.md). This is the simplest way to customize TLS or socket behavior (e.g., setting `rejectUnauthorized`, `ca`, `socketPath`). See [`ConnectOptions`](#parameter-connectoptions) for available fields.
32+
* **Function**: A custom connector with the signature `(options, callback)`, where `options` contains `{ hostname, host, protocol, port, servername, localAddress, httpSocket }` and `callback` follows `(error, socket)`. Useful when you need full control over socket creation, such as adding custom validation or proxy logic. When a function is provided, undici wraps it to automatically inject `socketPath` and `allowH2` into the `options` argument if those values are set on the client.
3133
* **strictContentLength** `Boolean` (optional) - Default: `true` - Whether to treat request content length mismatches as errors. If true, an error is thrown when the request content-length header doesn't match the length of the request body. **Security Warning:** Disabling this option can expose your application to HTTP Request Smuggling attacks, where mismatched content-length headers cause servers and proxies to interpret request boundaries differently. This can lead to cache poisoning, credential hijacking, and bypassing security controls. Only disable this in controlled environments where you fully trust the request source.
3234
* **autoSelectFamily**: `boolean` (optional) - Default: depends on local Node version, on Node 18.13.0 and above is `false`. Enables a family autodetection algorithm that loosely implements section 5 of [RFC 8305](https://tools.ietf.org/html/rfc8305#section-5). See [here](https://nodejs.org/api/net.html#socketconnectoptions-connectlistener) for more details. This option is ignored if not supported by the current Node version.
3335
* **autoSelectFamilyAttemptTimeout**: `number` - Default: depends on local Node version, on Node 18.13.0 and above is `250`. The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. See [here](https://nodejs.org/api/net.html#socketconnectoptions-connectlistener) for more details.
3436
* **allowH2**: `boolean` - Default: `true`. Enables support for H2 if the server has assigned bigger priority to it through ALPN negotiation.
3537
* **useH2c**: `boolean` - Default: `false`. Enforces h2c for non-https connections.
36-
* **maxConcurrentStreams**: `number` - Default: `100`. Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
38+
* **maxConcurrentStreams**: `number` - Default: `100`. The maximum number of concurrent HTTP/2 streams per session. When `allowH2` negotiates h2, this — not `pipelining` (which is HTTP/1.1 only, per [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2)) — is the ceiling the Client uses to dispatch in-flight requests on a shared session. The same value is advertised to the server as `peerMaxConcurrentStreams`, capping how many streams the server may push back. The initial value is replaced by the server's `SETTINGS_MAX_CONCURRENT_STREAMS` whenever the server sends one, so a user-supplied value acts as a pre-`SETTINGS` default rather than a hard cap.
3739
* **initialWindowSize**: `number` (optional) - Default: `262144` (256KB). Sets the HTTP/2 stream-level flow-control window size (SETTINGS_INITIAL_WINDOW_SIZE). Must be a positive integer greater than 0. This default is higher than Node.js core's default (65535 bytes) to improve throughput, Node's choice is very conservative for current high-bandwith networks. See [RFC 7540 Section 6.9.2](https://datatracker.ietf.org/doc/html/rfc7540#section-6.9.2) for more details.
3840
* **connectionWindowSize**: `number` (optional) - Default `524288` (512KB). Sets the HTTP/2 connection-level flow-control window size using `ClientHttp2Session.setLocalWindowSize()`. Must be a positive integer greater than 0. This provides better flow control for the entire connection across multiple streams. See [Node.js HTTP/2 documentation](https://nodejs.org/api/http2.html#clienthttp2sessionsetlocalwindowsize) for more details.
3941
* **pingInterval**: `number` - Default: `60e3`. The time interval in milliseconds between PING frames sent to the server. Set to `0` to disable PING frames. This is only applicable for HTTP/2 connections. This will emit a `ping` event on the client with the duration of the ping in milliseconds.
@@ -72,9 +74,43 @@ import { Client } from 'undici'
7274
const client = new Client('http://localhost:3000')
7375
```
7476

75-
### Example - Custom connector
77+
### Example - Connect with TLS options (object form)
7678

77-
This will allow you to perform some additional check on the socket that will be used for the next request.
79+
Pass a `ConnectOptions` object to customize the TLS connection. The options are forwarded to the internal `buildConnector()`.
80+
81+
```js
82+
'use strict'
83+
import { Client } from 'undici'
84+
import fs from 'node:fs'
85+
86+
const client = new Client('https://localhost:3000', {
87+
connect: {
88+
rejectUnauthorized: false,
89+
ca: fs.readFileSync('./ca-cert.pem')
90+
}
91+
})
92+
```
93+
94+
### Example - Connect via Unix domain socket
95+
96+
Use the `socketPath` option to connect through an IPC endpoint instead of a TCP connection.
97+
98+
```js
99+
'use strict'
100+
import { Client } from 'undici'
101+
102+
const client = new Client('http://localhost:3000', {
103+
connect: {
104+
socketPath: '/var/run/docker.sock'
105+
}
106+
})
107+
```
108+
109+
### Example - Custom connector (function form)
110+
111+
Pass a function for full control over socket creation. This allows you to perform additional checks on the socket, use a proxy, or implement custom connection logic.
112+
113+
> **Note:** When a function is provided, undici wraps it to automatically inject `socketPath` and `allowH2` into the first argument (`options`) when those values are set on the client.
78114
79115
```js
80116
'use strict'
@@ -97,6 +133,8 @@ const client = new Client('https://localhost:3000', {
97133
})
98134
```
99135

136+
For more details on building custom connectors, see [Connector](/docs/docs/api/Connector.md).
137+
100138
## Instance Methods
101139

102140
### `Client.close([callback])`

0 commit comments

Comments
 (0)