fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by marko1olo · Pull Request #5619 · nodejs/undici · GitHub

Two independent MockAgent defects, one commit each.

ignoreTrailingSlash throws on a non-string path matcher

removeTrailingSlash() calls path.endsWith('/') unconditionally, but it is only reached on the ignoreTrailingSlash branch, where the argument is the registered matcher — documented in docs/docs/api/MockPool.md:97 as {string|RegExp|Function}. safeUrl() a few lines up gets this right with a typeof guard. So

const agent = new MockAgent({ ignoreTrailingSlash: true })
agent.get(origin).intercept({ path: /\/foo/, method: 'GET' }).reply(200, 'ok')

throws a TypeError instead of matching.

A DataView reply body is delivered as {}

getResponseData() checks for Buffer, then Uint8Array, then ArrayBuffer, and everything else that is an object falls to JSON.stringify. A DataView is none of the first three, so reply(200, someDataView) sent the two characters {}.

Measured through getResponseData() on main before the change:

body	returns	delivered
Buffer	object	9 bytes, correct
Uint8Array	object	3 bytes, correct
ArrayBuffer	object	6 bytes, correct
DataView	string, length 2	{}

The fix returns a Uint8Array over the same memory, and deliberately passes byteOffset and byteLength:

return new Uint8Array(data.buffer, data.byteOffset, data.byteLength)

A DataView is frequently a window into a larger buffer, so new Uint8Array(data.buffer) alone would send bytes the caller never offered. There is a test for exactly that case.

Tests

Added to test/mock-utils.js and test/mock-interceptor.js, in the style of the neighbours. Reverting lib/mock/mock-utils.js and keeping the tests:

test/mock-utils.js        36 pass / 0 fail  ->  31 pass / 5 fail
test/mock-interceptor.js  86 pass / 0 fail  ->  67 pass / 19 fail

  ✖ it should match a RegExp path with ignoreTrailingSlash
  ✖ it should match a function path with ignoreTrailingSlash
  ✖ it should return the bytes of a DataView
  ✖ it should return only the bytes a DataView covers

With both fixes in place: mock-agent.js 99/99, mock-utils.js 36/36, mock-interceptor.js 86/86, mock-pool.js 16/16, mock-client.js 18/18, mock-scope.js 5/5, mock-errors.js 2/2, mock-interceptor-unused-assertions.js 7/7, mock-call-history.js 46/46. eslint clean.

Possible drawbacks

ArrayBuffer.isView() widens the second fix past DataView to every non-Uint8Array typed array, and that is an observable behaviour change. reply(200, new Int32Array([1, 2])) previously delivered {"0":1,"1":2} and now delivers 8 raw bytes. I think the byte reading is obviously the intended one for a typed array, but anyone who was relying on the index-keyed JSON would notice. Say the word and I will narrow it to DataView only.

Related and worth knowing: content-length for a DataView reply also becomes correct as a side effect, because Uint8Array.length is the byte length where the old string had length 2.

Not exercised: no real socket — both changes are on the mock dispatch path, and getResponseData/removeTrailingSlash have no callers outside lib/mock/. Single local Node on Windows, so the CI matrix is untested from here, and test:typescript, test:fuzzing and test:wpt were not run.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.51%. Comparing base (c76fe46) to head (29d60a2).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5619      +/-   ##
==========================================
+ Coverage   93.49%   93.51%   +0.01%     
==========================================
  Files         110      110              
  Lines       38429    38461      +32     
==========================================
+ Hits        35931    35965      +34     
+ Misses       2498     2496       -2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ilingSlash getMockDispatch normalizes both sides of a path comparison before matching. On the ignoreTrailingSlash branch it calls removeTrailingSlash on the registered matcher, but that helper went straight to path.endsWith, so a matcher that was not a string threw "path.endsWith is not a function" out of the dispatch. The TypeError carries no code, so buildMockDispatch's catch rethrew it rather than falling back to net connect, and the caller saw a TypeError instead of either a match or a MockNotMatchedError. MockPool.intercept documents path as {string|RegExp|Function}, and safeUrl — the other normalizer applied on the same line — already returns non-strings untouched. removeTrailingSlash now does the same: a RegExp or function has no trailing slash to strip, so it is handed to matchValue unchanged and tested against the request path that has already had its own trailing slashes removed. That is the semantics ignoreTrailingSlash promises, so /^\/foo$/ now matches a request for /foo/ as well as /foo. The guard also covers the resolved request path, which getMockDispatch already allows to be a non-string. Signed-off-by: marko1olo <marko1olo@users.noreply.github.com>

getResponseData recognises Buffer, Uint8Array and ArrayBuffer as byte containers and passes them straight through; everything else that is typeof 'object' falls to JSON.stringify. A DataView is none of the three, so reply(200, dataView) serialized to the two characters "{}" and the mock delivered those instead of the body. JSON.stringify sees no own enumerable properties on a DataView, so the corruption is silent: a valid, parseable, empty JSON object rather than an error. The reply type is TData | Buffer | string with TData extends object, so TypeScript accepts a DataView and gives no warning either. Returning the DataView itself is not enough. handleReply wraps the result in Buffer.from(), and Buffer.from() of a DataView hits the fromObject path where length is undefined while buffer is an ArrayBuffer, which yields an empty buffer -- the body would still be lost, just as zero bytes rather than as "{}". So the new branch produces a Uint8Array over exactly the region the view covers, honouring byteOffset and byteLength; a view onto a slice of a larger ArrayBuffer sends its own bytes and not the whole backing store. The branch is keyed on ArrayBuffer.isView rather than an instanceof DataView check, which also covers Uint8ClampedArray, Int16Array and the rest. Those are byte containers too, and their current output -- {"0":1,"1":2} from index keys -- is no more useful than "{}". The branch sits after the existing Buffer, Uint8Array and ArrayBuffer cases so those keep returning the caller's exact object, unchanged and uncopied. Signed-off-by: marko1olo <marko1olo@users.noreply.github.com>

CI failures here are unrelated to this PR:

Node.js 24 ubuntu: test/http2-request-never-settles.js failed
Node.js 26 macOS: test/http2-pipelining-default.js:270 — 2 !== 1 assertion error

Both are h2 test flakes; this PR only touches lib/mock/mock-utils.js and its tests. The mock-specific test suite passes 185/185 locally on this branch.

Suggested change

      
              } else if (data && typeof data === 'object') {
          
              } else if (typeof data === 'object') {

Done in 29d60a2e. Thanks!

lgtm

Bumps [undici](https://github.com/nodejs/undici) from 8.5.0 to 8.10.0. Release notes *Sourced from [undici's releases](https://github.com/nodejs/undici/releases).* > v8.10.0 > ------- > > What's Changed > -------------- > > * feat: namespace h2 options by [`@metcoder95`](https://github.com/metcoder95) in [nodejs/undici#5498](https://redirect.github.com/nodejs/undici/pull/5498) > * test: update WPT expectations by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5587](https://redirect.github.com/nodejs/undici/pull/5587) > * test: add cache/dedupe + dns re-dispatch integration tests by [`@GiHoon1123`](https://github.com/GiHoon1123) in [nodejs/undici#5535](https://redirect.github.com/nodejs/undici/pull/5535) > * fix(websocket): support process.unref by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5578](https://redirect.github.com/nodejs/undici/pull/5578) > * fix(h2): ensure every request settles by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5603](https://redirect.github.com/nodejs/undici/pull/5603) > * fix(readable): consume a body whose end has already been emitted by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5617](https://redirect.github.com/nodejs/undici/pull/5617) > * fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5610](https://redirect.github.com/nodejs/undici/pull/5610) > * fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by [`@marceli1404`](https://github.com/marceli1404) in [nodejs/undici#5606](https://redirect.github.com/nodejs/undici/pull/5606) > * fix(env-http-proxy-agent): match bare IPv6 addresses in no\_proxy by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5623](https://redirect.github.com/nodejs/undici/pull/5623) > * test: handle aggregate balanced pool errors by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5377](https://redirect.github.com/nodejs/undici/pull/5377) > * fix(readable): keep body bytes that arrive after setEncoding() by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5620](https://redirect.github.com/nodejs/undici/pull/5620) > * fix(socks5): evict unused origin pools by [`@Kkartik14`](https://github.com/Kkartik14) in [nodejs/undici#5595](https://redirect.github.com/nodejs/undici/pull/5595) > * fix: skip deduplication for upgrade requests by [`@Ram-blip`](https://github.com/Ram-blip) in [nodejs/undici#5593](https://redirect.github.com/nodejs/undici/pull/5593) > * fix(retry): forward informational responses by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5625](https://redirect.github.com/nodejs/undici/pull/5625) > * fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5619](https://redirect.github.com/nodejs/undici/pull/5619) > * fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5628](https://redirect.github.com/nodejs/undici/pull/5628) > * build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [`@dependabot`](https://github.com/dependabot)[bot] in [nodejs/undici#5633](https://redirect.github.com/nodejs/undici/pull/5633) > * build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by [`@dependabot`](https://github.com/dependabot)[bot] in [nodejs/undici#5634](https://redirect.github.com/nodejs/undici/pull/5634) > * build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [`@dependabot`](https://github.com/dependabot)[bot] in [nodejs/undici#5636](https://redirect.github.com/nodejs/undici/pull/5636) > * fix(mock): emit request body lifecycle hooks by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5367](https://redirect.github.com/nodejs/undici/pull/5367) > * fix(h2): detach upgrade close handler after GOAWAY by [`@pacocartones`](https://github.com/pacocartones) in [nodejs/undici#5641](https://redirect.github.com/nodejs/undici/pull/5641) > * fix: retry refused HTTP/2 streams by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5598](https://redirect.github.com/nodejs/undici/pull/5598) > * fix: preserve DNS origin hostname on sockets by [`@cyphercodes`](https://github.com/cyphercodes) in [nodejs/undici#5577](https://redirect.github.com/nodejs/undici/pull/5577) > > New Contributors > ---------------- > > * [`@marceli1404`](https://github.com/marceli1404) made their first contribution in [nodejs/undici#5606](https://redirect.github.com/nodejs/undici/pull/5606) > * [`@Kkartik14`](https://github.com/Kkartik14) made their first contribution in [nodejs/undici#5595](https://redirect.github.com/nodejs/undici/pull/5595) > * [`@pacocartones`](https://github.com/pacocartones) made their first contribution in [nodejs/undici#5641](https://redirect.github.com/nodejs/undici/pull/5641) > * [`@cyphercodes`](https://github.com/cyphercodes) made their first contribution in [nodejs/undici#5577](https://redirect.github.com/nodejs/undici/pull/5577) > > **Full Changelog**: <nodejs/undici@v8.9.0...v8.10.0> > > v8.9.0 > ------ > > ⚠️ Security fixes > ----------------- > > ### High severity > > * [GHSA-4cwx-7wf7-3272](GHSA-4cwx-7wf7-3272): malformed qualified `private` Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by [4fe5bc5f](nodejs/undici@4fe5bc5) with regression coverage in [9f09b49a](nodejs/undici@9f09b49). > > ### Medium severity > > * [GHSA-m8rv-5g2x-5cg5](GHSA-m8rv-5g2x-5cg5): a malicious `type` property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated `content-type` header. Undici now coerces and validates the value before adding it to the request. Fixed by [7d3cf924](nodejs/undici@7d3cf92). > * [GHSA-jr45-8vmc-qm54](GHSA-jr45-8vmc-qm54): optional whitespace around `=` in qualified `no-cache` and `private` directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by [c601fff1](nodejs/undici@c601fff). > * [GHSA-8xcm-r25x-g524](GHSA-8xcm-r25x-g524): the retry interceptor could expose a stale `Content-Length` after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose `Content-Length` is inconsistent with `Content-Range`. Fixed by [e11a68ed](nodejs/undici@e11a68e), with corrected fixtures in [2b3f7493](nodejs/undici@2b3f749). > * [GHSA-v3r7-h72x-cjcm](GHSA-v3r7-h72x-cjcm): unsanitized `domain` and `unparsed` values passed to `setCookie()` could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by [10d93fc3](nodejs/undici@10d93fc). > > Additional hardening > -------------------- ... (truncated) Commits * [`c8d80e6`](nodejs/undici@c8d80e6) Bumped v8.10.0 ([#5644](https://redirect.github.com/nodejs/undici/issues/5644)) * [`66923b4`](nodejs/undici@66923b4) fix: preserve DNS origin hostname on sockets ([#5577](https://redirect.github.com/nodejs/undici/issues/5577)) * [`3926499`](nodejs/undici@3926499) fix: retry refused HTTP/2 streams ([#5598](https://redirect.github.com/nodejs/undici/issues/5598)) * [`73d6e9e`](nodejs/undici@73d6e9e) fix(h2): detach upgrade close handler after GOAWAY ([#5641](https://redirect.github.com/nodejs/undici/issues/5641)) * [`b111adb`](nodejs/undici@b111adb) fix(mock): emit request body lifecycle hooks ([#5367](https://redirect.github.com/nodejs/undici/issues/5367)) * [`ae4a3e3`](nodejs/undici@ae4a3e3) build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 ([#5636](https://redirect.github.com/nodejs/undici/issues/5636)) * [`ec3fbf1`](nodejs/undici@ec3fbf1) build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 ([#5634](https://redirect.github.com/nodejs/undici/issues/5634)) * [`2151720`](nodejs/undici@2151720) build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 ([#5633](https://redirect.github.com/nodejs/undici/issues/5633)) * [`b96a116`](nodejs/undici@b96a116) fix(interceptors): allow interceptors without opts.origin ([#5628](https://redirect.github.com/nodejs/undici/issues/5628)) * [`a18ef2d`](nodejs/undici@a18ef2d) fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r... * Additional commits viewable in [compare view](nodejs/undici@v8.5.0...v8.10.0) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=undici&package-manager=npm\_and\_yarn&previous-version=8.5.0&new-version=8.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ArcadeData/arcadedb/network/alerts).

…p ci] Bumps [undici](https://github.com/nodejs/undici) from 8.5.0 to 8.10.0. Release notes *Sourced from [undici's releases](https://github.com/nodejs/undici/releases).* > v8.10.0 > ------- > > What's Changed > -------------- > > * feat: namespace h2 options by [`@metcoder95`](https://github.com/metcoder95) in [nodejs/undici#5498](https://redirect.github.com/nodejs/undici/pull/5498) > * test: update WPT expectations by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5587](https://redirect.github.com/nodejs/undici/pull/5587) > * test: add cache/dedupe + dns re-dispatch integration tests by [`@GiHoon1123`](https://github.com/GiHoon1123) in [nodejs/undici#5535](https://redirect.github.com/nodejs/undici/pull/5535) > * fix(websocket): support process.unref by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5578](https://redirect.github.com/nodejs/undici/pull/5578) > * fix(h2): ensure every request settles by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5603](https://redirect.github.com/nodejs/undici/pull/5603) > * fix(readable): consume a body whose end has already been emitted by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5617](https://redirect.github.com/nodejs/undici/pull/5617) > * fix(retry): skip the content-length checkpoint for HEAD and for a 206 without content-range by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5610](https://redirect.github.com/nodejs/undici/pull/5610) > * fix: revert idle socket validation to setTimeout(0) to prevent stall on idle event loop by [`@marceli1404`](https://github.com/marceli1404) in [nodejs/undici#5606](https://redirect.github.com/nodejs/undici/pull/5606) > * fix(env-http-proxy-agent): match bare IPv6 addresses in no\_proxy by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5623](https://redirect.github.com/nodejs/undici/pull/5623) > * test: handle aggregate balanced pool errors by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5377](https://redirect.github.com/nodejs/undici/pull/5377) > * fix(readable): keep body bytes that arrive after setEncoding() by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5620](https://redirect.github.com/nodejs/undici/pull/5620) > * fix(socks5): evict unused origin pools by [`@Kkartik14`](https://github.com/Kkartik14) in [nodejs/undici#5595](https://redirect.github.com/nodejs/undici/pull/5595) > * fix: skip deduplication for upgrade requests by [`@Ram-blip`](https://github.com/Ram-blip) in [nodejs/undici#5593](https://redirect.github.com/nodejs/undici/pull/5593) > * fix(retry): forward informational responses by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5625](https://redirect.github.com/nodejs/undici/pull/5625) > * fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5619](https://redirect.github.com/nodejs/undici/pull/5619) > * fix(interceptors): cache() and deduplicate() silently inert on Client/Pool without opts.origin by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5628](https://redirect.github.com/nodejs/undici/pull/5628) > * build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [`@dependabot`](https://github.com/dependabot)[bot] in [nodejs/undici#5633](https://redirect.github.com/nodejs/undici/pull/5633) > * build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 by [`@dependabot`](https://github.com/dependabot)[bot] in [nodejs/undici#5634](https://redirect.github.com/nodejs/undici/pull/5634) > * build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [`@dependabot`](https://github.com/dependabot)[bot] in [nodejs/undici#5636](https://redirect.github.com/nodejs/undici/pull/5636) > * fix(mock): emit request body lifecycle hooks by [`@marko1olo`](https://github.com/marko1olo) in [nodejs/undici#5367](https://redirect.github.com/nodejs/undici/pull/5367) > * fix(h2): detach upgrade close handler after GOAWAY by [`@pacocartones`](https://github.com/pacocartones) in [nodejs/undici#5641](https://redirect.github.com/nodejs/undici/pull/5641) > * fix: retry refused HTTP/2 streams by [`@mcollina`](https://github.com/mcollina) in [nodejs/undici#5598](https://redirect.github.com/nodejs/undici/pull/5598) > * fix: preserve DNS origin hostname on sockets by [`@cyphercodes`](https://github.com/cyphercodes) in [nodejs/undici#5577](https://redirect.github.com/nodejs/undici/pull/5577) > > New Contributors > ---------------- > > * [`@marceli1404`](https://github.com/marceli1404) made their first contribution in [nodejs/undici#5606](https://redirect.github.com/nodejs/undici/pull/5606) > * [`@Kkartik14`](https://github.com/Kkartik14) made their first contribution in [nodejs/undici#5595](https://redirect.github.com/nodejs/undici/pull/5595) > * [`@pacocartones`](https://github.com/pacocartones) made their first contribution in [nodejs/undici#5641](https://redirect.github.com/nodejs/undici/pull/5641) > * [`@cyphercodes`](https://github.com/cyphercodes) made their first contribution in [nodejs/undici#5577](https://redirect.github.com/nodejs/undici/pull/5577) > > **Full Changelog**: <nodejs/undici@v8.9.0...v8.10.0> > > v8.9.0 > ------ > > ⚠️ Security fixes > ----------------- > > ### High severity > > * [GHSA-4cwx-7wf7-3272](GHSA-4cwx-7wf7-3272): malformed qualified `private` Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by [4fe5bc5f](nodejs/undici@4fe5bc5) with regression coverage in [9f09b49a](nodejs/undici@9f09b49). > > ### Medium severity > > * [GHSA-m8rv-5g2x-5cg5](GHSA-m8rv-5g2x-5cg5): a malicious `type` property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated `content-type` header. Undici now coerces and validates the value before adding it to the request. Fixed by [7d3cf924](nodejs/undici@7d3cf92). > * [GHSA-jr45-8vmc-qm54](GHSA-jr45-8vmc-qm54): optional whitespace around `=` in qualified `no-cache` and `private` directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by [c601fff1](nodejs/undici@c601fff). > * [GHSA-8xcm-r25x-g524](GHSA-8xcm-r25x-g524): the retry interceptor could expose a stale `Content-Length` after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose `Content-Length` is inconsistent with `Content-Range`. Fixed by [e11a68ed](nodejs/undici@e11a68e), with corrected fixtures in [2b3f7493](nodejs/undici@2b3f749). > * [GHSA-v3r7-h72x-cjcm](GHSA-v3r7-h72x-cjcm): unsanitized `domain` and `unparsed` values passed to `setCookie()` could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by [10d93fc3](nodejs/undici@10d93fc). > > Additional hardening > -------------------- ... (truncated) Commits * [`c8d80e6`](nodejs/undici@c8d80e6) Bumped v8.10.0 ([#5644](https://redirect.github.com/nodejs/undici/issues/5644)) * [`66923b4`](nodejs/undici@66923b4) fix: preserve DNS origin hostname on sockets ([#5577](https://redirect.github.com/nodejs/undici/issues/5577)) * [`3926499`](nodejs/undici@3926499) fix: retry refused HTTP/2 streams ([#5598](https://redirect.github.com/nodejs/undici/issues/5598)) * [`73d6e9e`](nodejs/undici@73d6e9e) fix(h2): detach upgrade close handler after GOAWAY ([#5641](https://redirect.github.com/nodejs/undici/issues/5641)) * [`b111adb`](nodejs/undici@b111adb) fix(mock): emit request body lifecycle hooks ([#5367](https://redirect.github.com/nodejs/undici/issues/5367)) * [`ae4a3e3`](nodejs/undici@ae4a3e3) build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 ([#5636](https://redirect.github.com/nodejs/undici/issues/5636)) * [`ec3fbf1`](nodejs/undici@ec3fbf1) build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 ([#5634](https://redirect.github.com/nodejs/undici/issues/5634)) * [`2151720`](nodejs/undici@2151720) build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 ([#5633](https://redirect.github.com/nodejs/undici/issues/5633)) * [`b96a116`](nodejs/undici@b96a116) fix(interceptors): allow interceptors without opts.origin ([#5628](https://redirect.github.com/nodejs/undici/issues/5628)) * [`a18ef2d`](nodejs/undici@a18ef2d) fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r... * Additional commits viewable in [compare view](nodejs/undici@v8.5.0...v8.10.0) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=undici&package-manager=npm\_and\_yarn&previous-version=8.5.0&new-version=8.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ArcadeData/arcadedb/network/alerts).

marko1olo added 2 commits July 29, 2026 23:06

fix(mock): handle null gracefully in getResponseData

825a739

marko1olo force-pushed the fix/mock-utils-bytes-and-matchers branch from 4d66958 to 825a739 Compare July 30, 2026 07:28

metcoder95 reviewed Jul 30, 2026

View reviewed changes

fix(mock): address review feedback for getResponseData

29d60a2

metcoder95 approved these changes Jul 31, 2026

View reviewed changes

mcollina approved these changes Jul 31, 2026

View reviewed changes

mcollina merged commit a18ef2d into nodejs:main Jul 31, 2026
36 of 38 checks passed

github-actions Bot mentioned this pull request Aug 3, 2026

[Release] v8.10.0 #5644

Merged

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by marko1olo · Pull Request #5619 · nodejs/undici · GitHub

Uh oh!

Uh oh!

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies - #5619

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies#5619
mcollina merged 4 commits into
nodejs:mainfrom
marko1olo:fix/mock-utils-bytes-and-matchers

marko1olo commented Jul 29, 2026

Uh oh!

codecov-commenter commented Jul 29, 2026 •
edited
Loading

Uh oh!

Uh oh!

marko1olo commented Jul 29, 2026

Uh oh!

metcoder95 Jul 30, 2026

Uh oh!

marko1olo Jul 31, 2026

Uh oh!

mcollina left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	} else if (data && typeof data === 'object') {
	} else if (typeof data === 'object') {

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies by marko1olo · Pull Request #5619 · nodejs/undici · GitHub

Uh oh!

Uh oh!

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies - #5619

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies#5619mcollina merged 4 commits intonodejs:mainnodejs/undici:mainfrom marko1olo:fix/mock-utils-bytes-and-matchersmarko1olo/undici:fix/mock-utils-bytes-and-matchersCopy head branch name to clipboard

Conversation

marko1olo commented Jul 29, 2026

ignoreTrailingSlash throws on a non-string path matcher

A DataView reply body is delivered as {}

Tests

Possible drawbacks

Uh oh!

codecov-commenter commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

marko1olo commented Jul 29, 2026

Uh oh!

metcoder95 Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

marko1olo Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView reply bodies#5619
mcollina merged 4 commits into
nodejs:mainfrom
marko1olo:fix/mock-utils-bytes-and-matchers

codecov-commenter commented Jul 29, 2026 •
edited
Loading