deps: update undici to 5.23.0

PR-URL: #49021
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Author: nodejs-github-bot

deps/undici/src/docs/api/ProxyAgent.md

@@ -19,7 +19,9 @@ Extends: [`AgentOptions`](Agent.md#parameter-agentoptions)
 * **uri** `string` (required) - It can be passed either by a string or a object containing `uri` as string.
 * **token** `string` (optional) - It can be passed by a string of token for authentication.
 * **auth** `string` (**deprecated**) - Use token.
-* **clientFactory** `(origin: URL, opts: Object) => Dispatcher` - Default: `(origin, opts) => new Pool(origin, opts)`
+* **clientFactory** `(origin: URL, opts: Object) => Dispatcher` (optional) - Default: `(origin, opts) => new Pool(origin, opts)`
+* **requestTls** `BuildOptions` (optional) - Options object passed when creating the underlying socket via the connector builder for the request. See [TLS](https://nodejs.org/api/tls.html#tlsconnectoptions-callback).
+* **proxyTls** `BuildOptions` (optional) - Options object passed when creating the underlying socket via the connector builder for the proxy server. See [TLS](https://nodejs.org/api/tls.html#tlsconnectoptions-callback).
 
 Examples:
 

deps/undici/src/lib/api/abort-signal.js

@@ -1,3 +1,4 @@
+const { addAbortListener } = require('../core/util')
 const { RequestAbortedError } = require('../core/errors')
 
 const kListener = Symbol('kListener')
@@ -29,11 +30,7 @@ function addSignal (self, signal) {
     abort(self)
   }
 
-  if ('addEventListener' in self[kSignal]) {
-    self[kSignal].addEventListener('abort', self[kListener])
-  } else {
-    self[kSignal].addListener('abort', self[kListener])
-  }
+  addAbortListener(self[kSignal], self[kListener])
 }
 
 function removeSignal (self) {

deps/undici/src/lib/api/readable.js

@@ -155,12 +155,13 @@ module.exports = class BodyReadable extends Readable {
     const abortFn = () => {
       this.destroy()
     }
+    let signalListenerCleanup
     if (signal) {
       if (typeof signal !== 'object' || !('aborted' in signal)) {
         throw new InvalidArgumentError('signal must be an AbortSignal')
       }
       util.throwIfAborted(signal)
-      signal.addEventListener('abort', abortFn, { once: true })
+      signalListenerCleanup = util.addAbortListener(signal, abortFn)
     }
     try {
       for await (const chunk of this) {
@@ -173,8 +174,10 @@ module.exports = class BodyReadable extends Readable {
     } catch {
       util.throwIfAborted(signal)
     } finally {
-      if (signal) {
-        signal.removeEventListener('abort', abortFn)
+      if (typeof signalListenerCleanup === 'function') {
+        signalListenerCleanup()
+      } else if (signalListenerCleanup) {
+        signalListenerCleanup[Symbol.dispose]()
       }
     }
   }

deps/undici/src/lib/core/util.js

@@ -422,6 +422,24 @@ function throwIfAborted (signal) {
   }
 }
 
+let events
+function addAbortListener (signal, listener) {
+  if (typeof Symbol.dispose === 'symbol') {
+    if (!events) {
+      events = require('events')
+    }
+    if (typeof events.addAbortListener === 'function' && 'aborted' in signal) {
+      return events.addAbortListener(signal, listener)
+    }
+  }
+  if ('addEventListener' in signal) {
+    signal.addEventListener('abort', listener, { once: true })
+    return () => signal.removeEventListener('abort', listener)
+  }
+  signal.addListener('abort', listener)
+  return () => signal.removeListener('abort', listener)
+}
+
 const hasToWellFormed = !!String.prototype.toWellFormed
 
 /**
@@ -469,6 +487,7 @@ module.exports = {
   isFormDataLike,
   buildURL,
   throwIfAborted,
+  addAbortListener,
   nodeMajor,
   nodeMinor,
   nodeHasAutoSelectFamily: nodeMajor > 18 || (nodeMajor === 18 && nodeMinor >= 13)

deps/undici/src/lib/fetch/body.js

@@ -105,7 +105,7 @@ function extractBody (object, keepalive = false) {
     // Set source to a copy of the bytes held by object.
     source = new Uint8Array(object.buffer.slice(object.byteOffset, object.byteOffset + object.byteLength))
   } else if (util.isFormDataLike(object)) {
-    const boundary = `----formdata-undici-${Math.random()}`.replace('.', '').slice(0, 32)
+    const boundary = `----formdata-undici-0${`${Math.floor(Math.random() * 1e11)}`.padStart(11, '0')}`
     const prefix = `--${boundary}\r\nContent-Disposition: form-data`
 
     /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */

deps/undici/src/lib/fetch/index.js

@@ -56,7 +56,7 @@ const {
 const { kHeadersList } = require('../core/symbols')
 const EE = require('events')
 const { Readable, pipeline } = require('stream')
-const { isErrored, isReadable, nodeMajor, nodeMinor } = require('../core/util')
+const { addAbortListener, isErrored, isReadable, nodeMajor, nodeMinor } = require('../core/util')
 const { dataURLProcessor, serializeAMimeType } = require('./dataURL')
 const { TransformStream } = require('stream/web')
 const { getGlobalDispatcher } = require('../global')
@@ -174,22 +174,22 @@ async function fetch (input, init = {}) {
   let controller = null
 
   // 11. Add the following abort steps to requestObject’s signal:
-  requestObject.signal.addEventListener(
-    'abort',
+  addAbortListener(
+    requestObject.signal,
     () => {
       // 1. Set locallyAborted to true.
       locallyAborted = true
 
-      // 2. Abort the fetch() call with p, request, responseObject,
+      // 2. Assert: controller is non-null.
+      assert(controller != null)
+
+      // 3. Abort controller with requestObject’s signal’s abort reason.
+      controller.abort(requestObject.signal.reason)
+
+      // 4. Abort the fetch() call with p, request, responseObject,
       //    and requestObject’s signal’s abort reason.
       abortFetch(p, request, responseObject, requestObject.signal.reason)
-
-      // 3. If controller is not null, then abort controller.
-      if (controller != null) {
-        controller.abort()
-      }
-    },
-    { once: true }
+    }
   )
 
   // 12. Let handleFetchDone given response response be to finalize and
@@ -319,7 +319,7 @@ function finalizeAndReportTiming (response, initiatorType = 'other') {
 // https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
 function markResourceTiming (timingInfo, originalURL, initiatorType, globalThis, cacheState) {
   if (nodeMajor > 18 || (nodeMajor === 18 && nodeMinor >= 2)) {
-    performance.markResourceTiming(timingInfo, originalURL, initiatorType, globalThis, cacheState)
+    performance.markResourceTiming(timingInfo, originalURL.href, initiatorType, globalThis, cacheState)
   }
 }
 
@@ -1986,7 +1986,7 @@ async function httpNetworkFetch (
             if (key.toLowerCase() === 'content-encoding') {
               // https://www.rfc-editor.org/rfc/rfc7231#section-3.1.2.1
               // "All content-coding values are case-insensitive..."
-              codings = val.toLowerCase().split(',').map((x) => x.trim())
+              codings = val.toLowerCase().split(',').map((x) => x.trim()).reverse()
             } else if (key.toLowerCase() === 'location') {
               location = val
             }
@@ -2007,7 +2007,14 @@ async function httpNetworkFetch (
             for (const coding of codings) {
               // https://www.rfc-editor.org/rfc/rfc9112.html#section-7.2
               if (coding === 'x-gzip' || coding === 'gzip') {
-                decoders.push(zlib.createGunzip())
+                decoders.push(zlib.createGunzip({
+                  // Be less strict when decoding compressed responses, since sometimes
+                  // servers send slightly invalid responses that are still accepted
+                  // by common browsers.
+                  // Always using Z_SYNC_FLUSH is what cURL does.
+                  flush: zlib.constants.Z_SYNC_FLUSH,
+                  finishFlush: zlib.constants.Z_SYNC_FLUSH
+                }))
               } else if (coding === 'deflate') {
                 decoders.push(zlib.createInflate())
               } else if (coding === 'br') {

deps/undici/src/lib/fetch/request.js

@@ -232,14 +232,18 @@ class Request {
         }
 
         // 3. If one of the following is true
-        // parsedReferrer’s cannot-be-a-base-URL is true, scheme is "about",
-        // and path contains a single string "client"
-        // parsedReferrer’s origin is not same origin with origin
+        // - parsedReferrer’s scheme is "about" and path is the string "client"
+        // - parsedReferrer’s origin is not same origin with origin
         // then set request’s referrer to "client".
-        // TODO
-
-        // 4. Otherwise, set request’s referrer to parsedReferrer.
-        request.referrer = parsedReferrer
+        if (
+          (parsedReferrer.protocol === 'about:' && parsedReferrer.hostname === 'client') ||
+          (origin && !sameOrigin(parsedReferrer, this[kRealm].settingsObject.baseUrl))
+        ) {
+          request.referrer = 'client'
+        } else {
+          // 4. Otherwise, set request’s referrer to parsedReferrer.
+          request.referrer = parsedReferrer
+        }
       }
     }
 
@@ -336,6 +340,8 @@ class Request {
 
     // 28. Set this’s signal to a new AbortSignal object with this’s relevant
     // Realm.
+    // TODO: could this be simplified with AbortSignal.any
+    // (https://dom.spec.whatwg.org/#dom-abortsignal-any)
     const ac = new AbortController()
     this[kSignal] = ac.signal
     this[kSignal][kRealm] = this[kRealm]
@@ -381,7 +387,7 @@ class Request {
           }
         } catch {}
 
-        signal.addEventListener('abort', abort, { once: true })
+        util.addAbortListener(signal, abort)
         requestFinalizer.register(ac, { signal, abort })
       }
     }
@@ -729,12 +735,11 @@ class Request {
     if (this.signal.aborted) {
       ac.abort(this.signal.reason)
     } else {
-      this.signal.addEventListener(
-        'abort',
+      util.addAbortListener(
+        this.signal,
         () => {
           ac.abort(this.signal.reason)
-        },
-        { once: true }
+        }
       )
     }
     clonedRequestObject[kSignal] = ac.signal

deps/undici/src/lib/llhttp/llhttp-wasm.js

@@ -0,0 +1,32 @@
+alpine-baselayout-data-3.4.0-r0
+musl-1.2.3-r4
+busybox-1.35.0-r29
+busybox-binsh-1.35.0-r29
+alpine-baselayout-3.4.0-r0
+alpine-keys-2.4-r1
+ca-certificates-bundle-20220614-r4
+libcrypto3-3.0.8-r3
+libssl3-3.0.8-r3
+ssl_client-1.35.0-r29
+zlib-1.2.13-r0
+apk-tools-2.12.10-r1
+scanelf-1.3.5-r1
+musl-utils-1.2.3-r4
+libc-utils-0.7.2-r3
+libgcc-12.2.1_git20220924-r4
+libstdc++-12.2.1_git20220924-r4
+libffi-3.4.4-r0
+xz-libs-5.2.9-r0
+libxml2-2.10.4-r0
+zstd-libs-1.5.5-r0
+llvm15-libs-15.0.7-r0
+clang15-libs-15.0.7-r0
+libstdc++-dev-12.2.1_git20220924-r4
+clang15-15.0.7-r0
+lld-libs-15.0.7-r0
+lld-15.0.7-r0
+wasi-libc-0.20220525-r1
+wasi-libcxx-15.0.7-r0
+wasi-libcxxabi-15.0.7-r0
+wasi-compiler-rt-15.0.7-r0
+wasi-sdk-16-r0

deps/undici/src/lib/llhttp/llhttp.wasm

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "5.22.1",
+  "version": "5.23.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
@@ -86,7 +86,7 @@
     "husky": "^8.0.1",
     "import-fresh": "^3.3.0",
     "jest": "^29.0.2",
-    "jsdom": "^21.1.0",
+    "jsdom": "^22.1.0",
     "jsfuzz": "^1.0.15",
     "mocha": "^10.0.0",
     "p-timeout": "^3.2.0",

deps/undici/src/lib/llhttp/llhttp_simd-wasm.js

@@ -229,7 +229,7 @@ declare namespace Dispatcher {
     arrayBuffer(): Promise<ArrayBuffer>;
     blob(): Promise<Blob>;
     formData(): Promise<never>;
-    json(): Promise<any>;
+    json(): Promise<unknown>;
     text(): Promise<string>;
   }
 

deps/undici/src/lib/llhttp/llhttp_simd.wasm

@@ -18,7 +18,7 @@ declare class BodyReadable extends Readable {
   /** Consumes and returns the body as a JavaScript Object
    *  https://fetch.spec.whatwg.org/#dom-body-json
    */
-  json(): Promise<any>
+  json(): Promise<unknown>
 
   /** Consumes and returns the body as a Blob
    *  https://fetch.spec.whatwg.org/#dom-body-blob

deps/undici/src/lib/llhttp/wasm_build_env.txt

@@ -28,7 +28,7 @@ This a list of all the dependencies:
 * [openssl 3.0.8][]
 * [postject 1.0.0-alpha.6][]
 * [simdutf 3.2.14][]
-* [undici 5.22.1][]
+* [undici 5.23.0][]
 * [uvwasi 0.0.16][]
 * [V8 11.3.244.8][]
 * [zlib 1.2.13.1-motley-61dc0bd][]
@@ -291,7 +291,7 @@ The [postject](https://github.com/nodejs/postject) dependency is used for the
 The [simdutf](https://github.com/simdutf/simdutf) dependency is
 a C++ library for fast UTF-8 decoding and encoding.
 
-### undici 5.22.1
+### undici 5.23.0
 
 The [undici](https://github.com/nodejs/undici) dependency is an HTTP/1.1 client,
 written from scratch for Node.js..
@@ -345,7 +345,7 @@ performance improvements not currently available in standard zlib.
 [openssl 3.0.8]: #openssl-308
 [postject 1.0.0-alpha.6]: #postject-100-alpha6
 [simdutf 3.2.14]: #simdutf-3214
-[undici 5.22.1]: #undici-5221
+[undici 5.23.0]: #undici-5230
 [update-openssl-action]: ../../../.github/workflows/update-openssl.yml
 [uvwasi 0.0.16]: #uvwasi-0016
 [v8 11.3.244.8]: #v8-1132448

deps/undici/src/package.json

@@ -2,5 +2,5 @@
 // Refer to tools/update-undici.sh
 #ifndef SRC_UNDICI_VERSION_H_
 #define SRC_UNDICI_VERSION_H_
-#define UNDICI_VERSION "5.22.1"
+#define UNDICI_VERSION "5.23.0"
 #endif  // SRC_UNDICI_VERSION_H_