Co-authored-by: github-actions <github-actions@github.com>

* fix: validate EOF for chunked h1 responses (#5273)

(cherry picked from commit 13f6af6)
Signed-off-by: Matteo Collina <hello@matteocollina.com>

* test: restore websocket test compatibility on Node 18

- replace t.assert usage with node:assert in websocket tests so they work on Node 18\n- reduce the disabled-limit payload size in permessage-deflate-limit to avoid CI timeouts\n- remove an extra blank line in lib/dispatcher/agent.js to satisfy standard

Signed-off-by: Matteo Collina <hello@matteocollina.com>

---------

Signed-off-by: Matteo Collina <hello@matteocollina.com>

Co-authored-by: github-actions <github-actions@github.com>

* fix: guard idle socket validation to skip fresh sockets

References: GHSA-35p6-xmwp-9g52
Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>

* test: update issue 810 idle validation expectations

* test: stabilize idle validation coverage

* test: avoid issue 810 hangs on older Node.js

* test: stabilize parser error cleanup

* test: stabilize fetch encoding sockets

* test: use explicit loopback in fetch encoding

* test: use explicit loopback in fetch cookies

* test: use explicit loopback in fetch h2 cookies

---------

Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>

Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit 5655ea4)

* feat: add configurable maxPayloadSize for WebSocket (#4955)

(cherry picked from commit bd91f86)


* test: fix flaky permessage-deflate limit timeout (#5229)

(cherry picked from commit 9d82667)


* fix(websocket): enforce max payload size across fragments

Account for previously received fragment bytes when checking WebSocket payload size limits, so fragmented messages cannot exceed maxPayloadSize by splitting the payload across frames.

Add coverage for cumulative fragmented payload size enforcement.


(cherry picked from commit b4c287b)


* websocket: handle empty fragments and stream limits

Treat zero-byte frames as real fragments so fragmented messages can start
with an empty frame and empty continuations still count toward
maxFragments.

Pass dispatcher WebSocket limits through to WebSocketStream's parser, add
regression coverage for WebSocket and WebSocketStream fragment limits, make
the fragment close tests wait for both endpoints, and fix the Client docs
typo for maxFragments.


(cherry picked from commit c5ed787)


---------

Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Matthew Aitken <maitken033380023@gmail.com>
Co-authored-by: Luigi Pinca <luigipinca@gmail.com>
Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>

Co-authored-by: github-actions <github-actions@github.com>