Summary

When Object.freeze(globalThis) is called before any undici-backed global (fetch, WebSocket, Response, etc.) is accessed for the first time, the lazy initialisation inside setGlobalDispatcher throws:

TypeError: Cannot define property Symbol(undici.globalDispatcher.2),
           object is not extensible

This is particularly problematic because the Node.js security best practices guide explicitly recommends Object.freeze(globalThis) as a defence against monkey-patching (CWE-349).

Root cause

setGlobalDispatcher unconditionally calls Object.defineProperty(globalThis, ...). When globalThis is not extensible the call throws instead of degrading gracefully.

This became observable after globals were made lazy-loaded in #45659.

Fix

Wrap the Object.defineProperty calls in setGlobalDispatcher with a try/catch. When globalThis is not extensible the dispatcher is stored in a module-level fallback variable. getGlobalDispatcher is updated to return globalThis[symbol] ?? fallbackDispatcher so the normal (extensible) path is unchanged.

deps/undici/undici.js (the bundled file) is updated to match the source change in deps/undici/src/lib/global.js.

Test

A new test test/parallel/test-undici-frozen-globalthis.js is added that:

1. Calls Object.freeze(globalThis) before any undici globals are touched
2. Asserts that fetch, WebSocket, Response, Request, Headers, and FormData are all accessible without throwing

Checklist

• make -j<N> build succeeds
• New test passes: ./node test/parallel/test-undici-frozen-globalthis.js
• Existing fetch/WebSocket tests pass
• Normal setGlobalDispatcher / getGlobalDispatcher behaviour is unchanged

Fixes #46788