Jay
0912bde937
fix: support multiselect in form data ( #10676 )
2026-04-09 17:31:39 +02:00
Raashish Aggarwal
8b68491d04
fix(http): handle socket-only request errors without leaking keep-alive listeners ( #10576 )
...
* fix(http): handle request socket-only errors
* test(http): cover socket-only error handling cleanup
---------
Co-authored-by: Jason Saayman <jasonsaayman@gmail.com>
2026-04-08 22:03:30 +02:00
Darwin ❤️❤️❤️
62f6281660
fix(fetch): remove Content-Type without boundary for FormData ( #7314 )
...
* fix(fetch): remove Content-Type without boundary for FormData
When using the fetch adapter with FormData and manually setting
Content-Type to 'multipart/form-data' (without boundary), the
request would fail because the boundary is required.
This fix detects when Content-Type is set to multipart/form-data
without a boundary and removes it, allowing fetch to automatically
set the correct Content-Type header with the proper boundary.
Fixes #7054
* chore: update fixes
---------
Co-authored-by: Jason Saayman <jasonsaayman@gmail.com>
2026-04-08 21:07:51 +02:00
Jay
363185461b
fix: unrestricted cloud metadata exfiltration via header injection chain ( #10660 )
...
* fix: unrestricted cloud metadata exfiltration via header injection chain
* fix: address pattern issue highlighted by cubic
* fix: code ql feedback
* fix: code ql feedback
2026-04-06 14:01:54 +02:00
Jay
fb3befb6da
fix: no_proxy hostname normalization bypass leads to ssrf ( #10661 )
2026-04-06 13:47:03 +02:00
Kai Lee
947f7091d8
Fixes #10610 Deprecation Warning : url.parse() is deprecated in Node.… ( #10625 )
...
* Fixes #10610 Deprecation Warning : url.parse() is deprecated in Node.js v22 (via follow-redirects)
* Fixes #10610 Deprecation Warning : fixed again
* Apply suggestion from @cubic-dev-ai[bot]
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: tona jose <tona00jose@gmail.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-04-02 09:02:58 +02:00
Raashish Aggarwal
7173706380
test: add coverage for content-type header casing ( #10573 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-03-29 19:23:38 +02:00
Jay
4d8931ca8a
fix: formidable dependency vulnerable to arbitrary ( #7533 )
...
* fix: dependabot uses the correct labels
* fix: issue #7463
* fix: update to the latest version of formidable
2026-03-19 16:08:47 +02:00
Jay
9e705864d2
chore: migrate get stream to latest ( #7516 )
...
* build: bump get-stream to v9
* test: migrate helper buffer reads to get-stream v9 API
* fix: tests with sessions
* chore: update stream handler to better manage sessions
* chore: revert some changes
* chore: swap to buffer
* chore: add port for stream test
* chore: swap localhost
* chore: change timeout
* chore: update to stream type
* chore: try again
* chore: tests
* chore: updat tests/unit/adapters/http.test.js to check ipv4
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-03-16 20:38:14 +02:00
Old Autumn
94e1543576
fix(fetch): cancel ReadableStream body after request stream capability probe ( #7515 )
...
The module-level capability probe in the fetch adapter creates a
ReadableStream as a Request body to test for streaming support, but
never cancels it. The Request constructor sets up an internal pull
pipeline on the stream; since the stream is never consumed or
cancelled, the [[pullAlgorithm]] Promise remains pending indefinitely,
causing an async resource leak detectable by Node.js async_hooks and
Vitest --detect-async-leaks.
Extract the ReadableStream to a variable and call body.cancel() after
the probe completes to properly tear down the stream's internal
pipeline.
2026-03-16 09:12:42 +02:00
Jay
63e12ecb4f
refactor: migrate express test harness ( #7506 )
...
* chore(test): upgrade express and body-parser for adapter suites
* test(http): pin express 5 routes and body-parser 2 parsing expectations
* chore: attempt without ci
* revert: issue with ci
2026-03-15 14:30:15 +02:00
Jay
d905b7598d
refactor: refresh test suite to be modernised ( #7489 )
...
* chore: port karma tests
* chore: port karma tests
* chore: port karma tests
* chore: tests
* chore: tests
* chore: tests
* chore: fix issues with port collisions
* refactor: utils tests
* refactor: utils tests
* refactor: utils tests
* refactor: tests to vitests
* refactor: tests to vitests
* refactor: tests to vitests
* refactor: tests to vitests
* refactor: tests to vitests
* refactor: tests to vitests
* refactor: tests to vitests
* refactor: ci
* chore: install pw deps
* chore: fixx ai feedback
* chore: wip compatability tests
* chore: wip compatability tests
* chore: wip compatability tests
* refactor: wip smoke
* chore: smoke test run
* chore: update unzip
* chore: update testing
* chore: update testing
* chore: update testing
* chore: update testing
* chore: update testing
* chore: skip tests that cannot run on node 16 and lower
* chore: fix 16x under tests
* chore: rest of tests
* fix: functions and runs
* feat: added tests for esm smoke
* feat: added smoke
* chore: ignore ai gen plans
* chore: ci fixes
* chore: fix small p2s
2026-03-12 15:27:09 +02:00
Jay
fa337332b9
Update unit testing flows as part of migration to vitest ( #7484 )
...
* chore: small fixes to tests
* feat: transitional move to vitests
* feat: moving unit tests in progress
* feat: moving more unit tests over
* feat: more tests moved
* feat: updated more sections of the http test
* chore: wip http tests
* chore: wip http tests
* chore: more http tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: tests
* chore: remove un-needed docs
* chore: update package lock
* chore: update lock
2026-03-06 20:42:14 +02:00
