Skip to content

fix: backport safe main fixes to v7.x#5136

Merged
mcollina merged 22 commits into
v7.xfrom
backport-safe-main-fixes-to-v7.x
Apr 29, 2026
Merged

fix: backport safe main fixes to v7.x#5136
mcollina merged 22 commits into
v7.xfrom
backport-safe-main-fixes-to-v7.x

Conversation

@mcollina
Copy link
Copy Markdown
Member

Summary

Backport a set of low-risk fixes from main to v7.x.

This includes fixes for:

  • cache keying and sqlite cache behavior
  • fetch multipart/form-data handling
  • malformed request header validation
  • WebSocket stream parsing
  • SOCKS5 handling
  • H2C client connect option preservation
  • parser timeout callback reuse
  • TLS session cache bounds
  • mock call history filtering
  • WebIDL signed integer bounds

Also includes one small v7.x-specific follow-up commit to preserve allowH2 when wrapping a custom connect function, which was needed to keep the backported H2CClient fix working on the v7.x branch layout.

Testing

  • npm run test
  • ./node_modules/.bin/borp --timeout 180000 -p "test/h2c-client.js"

colinaaa and others added 21 commits April 28, 2026 09:48
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
(cherry picked from commit 5334fa6)
)

The condition in step 7 of fetchFinale checked
`fetchParams.request.mode !== 'navigator'`, but 'navigator' is not a
valid request mode — the spec value is 'navigate'. Because the typo
never matched, the guarded block always ran, setting responseStatus
and extracting the MIME type even for navigate-mode responses with
cross-origin redirects, which the spec requires to be skipped.

Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Nikita Skovoroda <chalkerx@gmail.com>
(cherry picked from commit a6f8644)
The signed integer lower bound was computed as `Math.pow(-2, bitLength) - 1`,
which evaluates to `(-2)^bitLength - 1` instead of the spec-required
`-2^(bitLength - 1)`. The step 11 overflow threshold similarly used
`2^bitLength - 1` instead of `2^(bitLength - 1)`, causing values in
`[2^(bitLength-1), 2^bitLength - 2]` to skip the signed wrap. Fix both
expressions and update the surrounding comments to match the WebIDL spec.

Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Nikita Skovoroda <chalkerx@gmail.com>
(cherry picked from commit d2e8178)
The `#deleteOldValuesQuery` used `ORDER BY cachedAt DESC` which deleted
the most recently cached entries instead of the oldest ones, inverting
the intended LRU-style eviction policy. Switch to `ASC` so that pruning
removes the oldest entries as expected.

Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Nikita Skovoroda <chalkerx@gmail.com>
(cherry picked from commit e0e61d3)
The previous implementation used `doubleColonIndex / 3` to map the
character offset of '::' to a parts-array index, which only works when
every group before '::' is exactly three characters wide. For typical
addresses like `2001:db8::1` or `fe80::1` the zero-fill gap was never
applied, producing a wrong 16-byte buffer and, in a SOCKS5 proxy
context, connections to unintended destinations.

Rewrite parseIPv6 to split around '::' and write the trailing groups
at their correct offsets from the end of the buffer.

Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Nikita Skovoroda <chalkerx@gmail.com>
(cherry picked from commit 838053d)
…5081)

makeCacheKey used pathHasQueryOrFragment(opts.path) to decide whether to
merge opts.query into the cached path, but opts.path can be undefined
when a caller supplies only origin+query at dispatch time. In that case
the check threw TypeError ("Cannot read properties of undefined (reading
'includes')"), so the query was never folded into the cache key and
requests with differing queries could collide or the key construction
itself could fail.

Check the already-defaulted fullPath ('/' when opts.path is missing)
instead, so the query is consistently serialised into key.path and
different query strings get separate cache entries regardless of how
path is supplied.

Refs #4209

Signed-off-by: Maruthan G <maruthang4@gmail.com>
(cherry picked from commit 1f57375)
…5045)

`makeFilterCalls` returned an arrow function whose `this` cannot be
rebound by `.call()`, so `handler.call({ logs: store }, criteria)` in
`handleFilterCallsWithOptions` always filtered against the full
`this.logs` instead of the narrowed `store`, causing AND to behave like
OR. Pass the source logs explicitly to the filter helpers and seed the
store with `this.logs` for AND so each criterion narrows the previous
result.

Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Nikita Skovoroda <chalkerx@gmail.com>
(cherry picked from commit 2a6f9c7)
Assisted-by: openai:gpt-5.4

Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
(cherry picked from commit 754a3d3)
Signed-off-by: Matteo Collina <hello@matteocollina.com>
@mcollina mcollina requested review from KhafraDev, ronag and trivikr April 28, 2026 08:58
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 28, 2026

Codecov Report

❌ Patch coverage is 94.48819% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.87%. Comparing base (12d9045) to head (b8c42de).

Files with missing lines Patch % Lines
lib/core/connect.js 81.25% 3 Missing ⚠️
lib/core/request.js 88.23% 2 Missing ⚠️
lib/dispatcher/client-h1.js 80.00% 1 Missing ⚠️
lib/web/fetch/index.js 80.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             v7.x    #5136      +/-   ##
==========================================
+ Coverage   92.85%   92.87%   +0.02%     
==========================================
  Files         112      112              
  Lines       35740    35785      +45     
==========================================
+ Hits        33185    33236      +51     
+ Misses       2555     2549       -6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
Copy link
Copy Markdown
Member

@trivikr trivikr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mcollina mcollina merged commit 301f347 into v7.x Apr 29, 2026
61 of 63 checks passed
@mcollina mcollina deleted the backport-safe-main-fixes-to-v7.x branch April 29, 2026 04:49
@github-actions github-actions Bot mentioned this pull request May 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants