Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: node-modules/urllib
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v2.44.0
Choose a base ref
...
head repository: node-modules/urllib
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v2.44.1
Choose a head ref
  • 4 commits
  • 13 files changed
  • 3 contributors

Commits on Jun 13, 2026

  1. ci: two-stage release with manual approval (2.x) (#815) 

    Brings the 2.x maintenance branch onto the same release flow as master
(#814), so every line releases the same way.

**Flow:** run **Prepare Release** (manual, with a version) -> it opens a
`release/vX.Y.Z` PR -> merge it -> **Release** checks the version
against npm, pushes an approval request to DingTalk, waits on the
`release` environment gate, then publishes and creates the GitHub
Release.

**2.x specifics:**
- Publishes under dist-tag `latest-2` (never `latest`).
- Publishes `lib/` directly (no build step).
- Replaces the previous shared `node-release` reusable workflow.
- npm auth via OIDC trusted publishing (`id-token: write`).

Requires the repo `release` environment (required reviewers) and npm
trusted-publisher config to allow this branch's workflow. DingTalk
secrets are already set repo-wide.
    @fengmk2
    fengmk2 authored Jun 13, 2026
    Configuration menu
    Copy the full SHA
    8575e80 View commit details
    Browse the repository at this point in the history

  2. ci: use Node 24 in release for npm 11 OIDC trusted publishing 

    Node 24 bundles npm 11.13.0 (>= 11.5.1 required for OIDC trusted
publishing), so the separate `npm install -g npm@latest` step is no
longer needed.
    @fengmk2
    fengmk2 committed Jun 13, 2026
    Configuration menu
    Copy the full SHA
    54a8384 View commit details
    Browse the repository at this point in the history

  3. fix: do not forward credential headers on cross-origin redirect (#813) 

    ## Problem

When following a redirect to a different origin, urllib reused the
caller's `args` verbatim, re-sending `Authorization`, `Cookie`, and
`Proxy-Authorization` headers (and re-applying the Basic `auth` option)
to the new origin. The only existing cleanup was the `Host` header.

## Fix

In `handleRedirect`, when the redirect target origin differs from the
current origin, strip those credential headers and clear
`auth`/`digestAuth` before following. Same-origin redirects are
unchanged; the caller's headers object is not mutated.

## Tests

New `test/redirect-cross-origin.test.js` with two local servers on
different ports: cross-origin strip (headers + `auth`) and same-origin
preserve. Verified the cross-origin cases fail without the fix.
    @fengmk2
    fengmk2 authored Jun 13, 2026
    Configuration menu
    Copy the full SHA
    7c86c46 View commit details
    Browse the repository at this point in the history

  4. release: v2.44.1 (#819) 

    Release urllib v2.44.1.

Merging this PR updates the version on `2.x` and triggers the release
workflow, which publishes to npm (dist-tag `latest-2`) and creates the
GitHub Release after manual approval.

## What's Changed

### Security

* Do not forward credential headers (`Authorization`, `Cookie`,
`Proxy-Authorization`) on cross-origin redirect, and clear
`auth`/`digestAuth` before following. Same-origin redirects are
unchanged and the caller's headers object is never mutated (#813).

### Internal

* Two-stage release workflow with manual approval, publishing the 2.x
line to the `latest-2` npm dist-tag (#815).
* Use Node 24 in the release workflow for npm 11 OIDC trusted
publishing.

---------

Co-authored-by: fengmk2 <156269+fengmk2@users.noreply.github.com>
Co-authored-by: MK <fengmk2@gmail.com>
    @github-actions @fengmk2
    3 people authored Jun 13, 2026
    Configuration menu
    Copy the full SHA
    98b76ab View commit details
    Browse the repository at this point in the history
Loading