@automattic/vip 4.1.4 → 4.1.6

package/node_modules/socket.io-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket.io-client",
-  "version": "4.8.3",
+  "version": "4.8.4",
   "description": "Realtime application framework client",
   "keywords": [
     "realtime",
@@ -55,7 +55,7 @@
     "test": "npm run format:check && npm run compile && if test \"$BROWSERS\" = \"1\" ; then npm run test:browser; else npm run test:node; fi",
     "test:node": "mocha --import=tsx --require test/support/hooks.ts --exit test/index.ts",
     "test:browser": "ts-node test/browser-runner.ts",
-    "test:types": "tsd",
+    "test:types": "exit 0",
     "build": "rollup -c support/rollup.config.umd.js && rollup -c support/rollup.config.esm.js && rollup -c support/rollup.config.umd.msgpack.js",
     "bundle-size": "node support/bundle-size.js",
     "format:check": "prettier --check \"*.js\" \"lib/**/*.ts\" \"test/**/*.ts\" \"support/**/*.js\"",

package/node_modules/string-argv/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+## v0.4.0 (2026-09-28)
+**Parsing Behavior Changes** (thanks to [@TooTallNate](https://github.com/TooTallNate) via [PR #24](https://github.com/mccormicka/string-argv/pull/24))
+- Rewrote the parser as a character-by-character state machine instead of the previous regex, so adjacent quoted and unquoted segments are treated as a single argument, matching bash word-splitting
+- Quote characters are now always stripped, including word-internal and `key=value` positions:
+  - `--foo="bar"'baz'` -> `--foo=barbaz`
+  - `a" b"` -> `a b`
+  - `"a"b` -> `ab`
+  - `run:silent["echo 1"]["echo 2"]` -> `run:silent[echo 1][echo 2]`
+  - `--name='Phil Taylor'` -> `--name=Phil Taylor`
+- Fixes [#20](https://github.com/mccormicka/string-argv/issues/20) (word-internal quotes were not stripped)
+- Fixes [#23](https://github.com/mccormicka/string-argv/issues/23) (unquoted tail after a quoted section was split into a separate argument)
+- Known differences from bash, unchanged by this release: backslash escapes are not processed, `$variables`/globs are left literal, and an unclosed quote consumes the rest of the input instead of raising an error
+- Security dependency bumps: minimatch 3.1.5 via [#25](https://github.com/mccormicka/string-argv/pull/25), brace-expansion 1.1.16 via [#27](https://github.com/mccormicka/string-argv/pull/27)
+**Build / Breaking Changes**
+- Update TypeScript to 7.0.2 (requires Node.js >=16.20)
+- Drop CommonJS support: the package is now ESM-only (`import` only). The `commonjs/` build, the `require` export condition, and the `module`/`main` CJS entry points have been removed — `main` and `exports` now point to the single ESM build (`./index.js`)
+- Consolidate to a single build: removed `tsconfig.base.json` and `tsconfig.commonjs.json`; `tsconfig.json` is now self-contained (`target` ES2022, `module` ESNext, `strict`, `declaration`) and `npm run build` runs a single `tsc -p .`. Note: TypeScript 7 no longer accepts the old `target` ES3 (hence the ES2022 baseline)
+- Minimum Node.js version is now `>=16.20.0` (`engines` updated accordingly)
+- Tests: removed the CJS `require()` spec (`test/Index.spec.cjs`); `test/config.json` now runs `*[sS]pec.js` only
+
+## v0.3.2 (2023-05-01)
+- Update TypeScript to 5.0.4 [b1015b8](https://github.com/mccormicka/string-argv/commit/b1015b8911b1505ed2ccd546fa0c35dc1dfcda07)
+- CI workflow (`node.js.yml`) added via [#22](https://github.com/mccormicka/string-argv/pull/22)
+- Retroactive note: this release (via the dual ESM/CommonJS layout from v0.3.1 combined with the TypeScript 5.0.4 toolchain) requires Node.js `>=12.20.0`. The ESM build (`index.js`) uses `export` syntax with `"type": "module"` and conditional `exports` (`import`/`require`), which need unflagged ESM support (Node.js 12.17+), and TypeScript 5.0 itself requires Node.js >=12.20 — so support for older Node versions (previously advertised as `>=0.6.19`) was effectively dropped here. Sorry we didn't call this out as a breaking change at the time — the `engines` field has now been corrected to `>=12.20.0`.
+
+## v0.3.1 (2022-09-16)
+- Now provides both esm and cjs builds
+- Update TypeScript to 4.8.3
+
+## v0.3.0 (2019-04-16)
+**Dev Experience Changes**
+- Project now compiled with TypeScript and provides typings
+
+## v0.2.0 (2019-04-14)
+**Parsing Behavior Changes**
+- Now parses multiple nested quotes and content when there are no spaces [7d9b897](https://github.com/mccormicka/string-argv/commit/7d9b89730ea112b829f2591e3e9cae4c0d0cc285)

package/node_modules/string-argv/README.md

@@ -1,50 +1,96 @@
-
-# What is it?
-`string-argv` parses a string into an argument array to mimic `process.argv`.
-This is useful when testing Command Line Utilities that you want to pass arguments to and is the opposite of what the other argv utilities do.
-
-# Installation
-
-```
-npm install string-argv --save
-```
-
-# Usage
-
-```js
-var stringArgv = require('string-argv');
-var args = stringArgv(
-    '-testing test -valid=true --quotes "test quotes" "nested \'quotes\'" --key="some value" --title="Peter\'s Friends"',
-    'node',
-    'testing.js'
-);
-
-//legacy
-var args2 = stringArgv.parseArgsStringToArgv(
-    '-testing test -valid=true --quotes "test quotes" "nested \'quotes\'" --key="some value" --title="Peter\'s Friends"',
-    'node',
-    'testing.js'
-);
-
-console.log(args);
-/** output
-[ 'node',
-  'testing.js',
-  '-testing',
-  'test',
-  '-valid=true',
-  '--quotes',
-  'test quotes',
-  'nested \'quotes\'',
-  '--key="some value"',
-  '--title="Peter\'s Friends"' ]
-  **/
-```
-
-## params
-
-__required__: __arguments__ String: arguments that you would normally pass to the command line.
-
-__optional__: __environment__ String: Adds to the environment position in the argv array. If ommitted then there is no need to call argv.split(2) to remove the environment/file values. However if your cli.parse method expects a valid argv value then you should include this value.
-
-__optional__: __file__ String: file that called the arguments. If omitted then there is no need to call argv.split(2) to remove the environment/file values. However if your cli.parse method expects a valid argv value then you should include this value.
+
+# What is it?
+`string-argv` parses a string into an argument array to mimic `process.argv`.
+This is useful when testing Command Line Utilities that you want to pass arguments to and is the opposite of what the other argv utilities do.
+
+# Installation
+
+```
+npm install string-argv --save
+```
+
+# Requirements
+
+Requires Node.js `>=16.20.0`.
+
+This package is ESM-only (`"type": "module"`). Use `import`, not `require()`:
+
+```js
+import stringArgv from 'string-argv';
+```
+
+TypeScript 7 requires Node.js >=16.20, and the single ESM build targets
+ES2022, so 16.20.0 is the minimum supported version.
+
+# Usage
+
+```ts
+// Typescript
+import stringArgv from 'string-argv';
+
+const args = stringArgv(
+  '-testing test -valid=true --quotes "test quotes" "nested \'quotes\'" --key="some value" --title="Peter\'s Friends"',
+  'node',
+  'testing.js'
+);
+
+console.log(args);
+```
+
+```js
+// Javascript (ESM)
+import { parseArgsStringToArgv } from 'string-argv';
+
+var args = parseArgsStringToArgv(
+    '-testing test -valid=true --quotes "test quotes" "nested \'quotes\'" --key="some value" --title="Peter\'s Friends"',
+    'node',
+    'testing.js'
+);
+
+console.log(args);
+/** output
+[ 'node',
+  'testing.js',
+  '-testing',
+  'test',
+  '-valid=true',
+  '--quotes',
+  'test quotes',
+  'nested \'quotes\'',
+  '--key=some value',
+  '--title=Peter\'s Friends' ]
+  **/
+```
+
+## params
+
+__required__: __arguments__ String: arguments that you would normally pass to the command line.
+
+__optional__: __environment__ String: Adds to the environment position in the argv array. If ommitted then there is no need to call argv.split(2) to remove the environment/file values. However if your cli.parse method expects a valid argv value then you should include this value.
+
+__optional__: __file__ String: file that called the arguments. If omitted then there is no need to call argv.split(2) to remove the environment/file values. However if your cli.parse method expects a valid argv value then you should include this value.
+
+## Parsing behavior (bash-compatible quoting)
+
+Quoting follows bash word-splitting rules: `'` and `"` group text into a single
+argument, adjacent quoted and unquoted segments are concatenated, and the quote
+characters themselves are removed. Whitespace separates arguments only when it
+appears outside of quotes.
+
+```
+--foo="bar"'baz'                    -> [--foo=barbaz]
+a" b"                                -> [a b]
+"a"b                                 -> [ab]
+jake run:silent["echo 1"]["echo 2"]  -> [jake, run:silent[echo 1][echo 2], --trace]
+--name='Phil Taylor'                 -> [--name=Phil Taylor]
+--title="Peter's Friends"            -> [--title=Peter's Friends]
+```
+
+A quote of the opposite kind inside quotes is kept literally
+(`--name='Phil "The Power" Taylor'` -> `--name=Phil "The Power" Taylor`),
+and empty quotes produce an empty argument (`""` -> `[""]`).
+
+Known differences from bash:
+- backslash escapes are not processed
+- `$variables`, globs and other expansions are left literal
+- an unclosed quote consumes the rest of the input instead of raising a syntax error

package/node_modules/string-argv/index.d.ts

@@ -0,0 +1,2 @@
+export { parseArgsStringToArgv };
+export default function parseArgsStringToArgv(value: string, env?: string, file?: string): string[];

package/node_modules/string-argv/index.js

@@ -1,35 +1,55 @@
-"use strict";
-
-module.exports = parseArgsStringToArgv;
-module.exports.parseArgsStringToArgv = parseArgsStringToArgv;
-
-function parseArgsStringToArgv(value, env, file) {
-  // ([^\s'"]+(['"])([^\2]*?)\2) Match `text"quotes text"`
-
-  // [^\s'"] or Match if not a space ' or "
-
-  // (['"])([^\4]*?)\4 or Match "quoted text" without quotes
-  // `\2` and `\4` are a backreference to the quote style (' or ") captured
-  var myRegexp = /([^\s'"]+(['"])([^\2]*?)\2)|[^\s'"]+|(['"])([^\4]*?)\4/gi;
-  var myString = value;
-  var myArray = [
-  ];
-  if (env) {
-    myArray.push(env);
-  }
-  if (file) {
-    myArray.push(file);
-  }
-  var match;
-  do {
-        // Each call to exec returns the next regex match as an array
-    match = myRegexp.exec(myString);
-    if (match !== null) {
-      // Index 1 in the array is the captured group if it exists
-      // Index 0 is the matched text, which we use if no captured group exists
-      myArray.push(match[1] || match[5] || match[0]);
-    }
-  } while (match !== null);
-
-  return myArray;
-}
+export { parseArgsStringToArgv };
+export default function parseArgsStringToArgv(value, env, file) {
+    const myArray = [];
+    if (env) {
+        myArray.push(env);
+    }
+    if (file) {
+        myArray.push(file);
+    }
+    let current = "";
+    let inQuote = null;
+    let hasToken = false; // Track if we've started a token (for empty quotes)
+    let i = 0;
+    while (i < value.length) {
+        const char = value[i];
+        if (inQuote) {
+            // Inside quotes - look for the closing quote
+            if (char === inQuote) {
+                // End of quoted section
+                inQuote = null;
+            }
+            else {
+                // Add character to current token (without the quotes)
+                current += char;
+            }
+        }
+        else {
+            // Outside quotes
+            if (char === '"' || char === "'") {
+                // Start of quoted section - this means we have a token even if empty
+                inQuote = char;
+                hasToken = true;
+            }
+            else if (/\s/.test(char)) {
+                // Whitespace - end current token if we have one
+                if (hasToken) {
+                    myArray.push(current);
+                    current = "";
+                    hasToken = false;
+                }
+            }
+            else {
+                // Regular character - add to current token
+                current += char;
+                hasToken = true;
+            }
+        }
+        i++;
+    }
+    // Don't forget the last token
+    if (hasToken) {
+        myArray.push(current);
+    }
+    return myArray;
+}

package/node_modules/string-argv/package.json

@@ -1,40 +1,50 @@
-{
-  "name": "string-argv",
-  "description": "string-argv parses a string into an argument array to mimic process.argv. This is useful when testing Command Line Utilities that you want to pass arguments to.",
-  "version": "0.1.1",
-  "contributors": [{
-    "name": "Michael Ferris",
-    "email": "mike.ferri@hotmail.com"
-  }],
-  "author": {
-    "name": "Anthony McCormick",
-    "email": "anthony.mccormick@gmail.com"
-  },
-  "license": "MIT",
-  "keywords": [
-    "argv"
-  ],
-  "scripts": {
-    "lint": "eslint .",
-    "test": "jasmine --config=test/config.json && npm run lint"
-  },
-  "main": "index",
-  "engines": {
-    "node": ">=0.6.19"
-  },
-  "bugs": {
-    "url": "https://github.com/mccormicka/string-argv/issues"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/mccormicka/string-argv"
-  },
-  "homepage": "https://github.com/mccormicka/string-argv",
-  "readmeFilename": "README.md",
-  "dependencies": {},
-  "devDependencies": {
-    "eslint": "^2.0.0",
-    "eslint-config-cellule": "^3.0.0",
-    "jasmine": "^2.4.1"
-  }
-}
+{
+  "name": "string-argv",
+  "description": "string-argv parses a string into an argument array to mimic process.argv. This is useful when testing Command Line Utilities that you want to pass arguments to.",
+  "version": "0.4.0",
+  "contributors": [
+    {
+      "name": "Michael Ferris",
+      "email": "mike.ferri@hotmail.com"
+    }
+  ],
+  "author": {
+    "name": "Anthony McCormick",
+    "email": "anthony.mccormick@gmail.com"
+  },
+  "license": "MIT",
+  "keywords": [
+    "argv"
+  ],
+  "scripts": {
+    "build": "tsc -p .",
+    "prepublishOnly": "npm test",
+    "test": "npm run build & jasmine --config=test/config.json",
+    "test:no-build": "jasmine --config=test/config.json"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    }
+  },
+  "main": "./index.js",
+  "types": "index.d.ts",
+  "engines": {
+    "node": ">=16.20.0"
+  },
+  "bugs": {
+    "url": "https://github.com/mccormicka/string-argv/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mccormicka/string-argv"
+  },
+  "homepage": "https://github.com/mccormicka/string-argv",
+  "readmeFilename": "README.md",
+  "devDependencies": {
+    "jasmine": "^4.4.0",
+    "typescript": "^7.0.2"
+  }
+}

package/node_modules/undici/README.md

@@ -86,6 +86,24 @@ Using [benchmark-http2.js](https://github.com/nodejs/undici/blob/main/benchmarks
 
 Node.js includes a built-in `fetch()` implementation powered by undici starting from Node.js v18. However, there are important differences between using the built-in fetch and installing undici as a separate module.
 
+### WebAssembly requirement
+
+Undici's HTTP/1 parser requires WebAssembly. There is no alternative parser when
+WebAssembly is unavailable, for example in Node.js configurations where
+`--jitless` disables it. The existence of `fetch` does not imply that it can make
+HTTP/1 requests in that environment.
+
+When the HTTP/1 parser is needed without WebAssembly, Client and dispatcher
+requests fail with an `Error` whose code is `ERR_WEBASSEMBLY_NOT_SUPPORTED`.
+`fetch` rejects with a `TypeError` carrying that error in `error.cause`. Importing
+Undici, accessing `fetch`, and using `Headers`, `FormData`, `Request`, or `Response`
+do not themselves require the HTTP/1 parser.
+
+The error is defined locally in Undici and does not depend on Node.js providing
+that error code. For built-in fetch, this behavior depends on the bundled Undici
+version. Node.js receives upstream fixes through its normal vendored Undici
+update, rather than changes to the generated bundle alone.
+
 ### Built-in Fetch (Node.js v18+)
 
 Node.js's built-in fetch is powered by a bundled version of undici:
@@ -378,7 +396,16 @@ The `body` mixins are the most common way to format the request/response body. M
 > The body returned from `undici.request` does not implement `.formData()`.
 
 > [!WARNING]
-> Calling `body.formData()` on a fetch response causes undici to buffer and parse the entire body. Since this is dictated by the spec, `body.formData()` must only be called on responses from trusted servers.
+> The body mixins `.arrayBuffer()`, `.blob()`, `.bytes()`, `.json()`, `.text()`,
+> and `.formData()` buffer the entire body in memory before returning. Where
+> applicable, they also decode or parse the payload and retain that
+> representation in memory. Calling these methods therefore means trusting that
+> the response body is small enough to fit in the available memory. Do not use
+> them for responses from untrusted or user-controlled sources. Instead, consume
+> the response body as a stream and enforce an application-specific size limit:
+> use `response.body` for fetch responses or the `body` returned by
+> `undici.request()`. For streaming decoded text, use `body.textStream()` on a
+> fetch `Request` or `Response`.
 
 Example usage:
 
@@ -764,14 +791,18 @@ and `undici.Agent`) which will enable the family autoselection algorithm when es
 
 ## Collaborators
 
-* [__Daniele Belardi__](https://github.com/dnlup), <https://www.npmjs.com/~dnlup>
-* [__Ethan Arrowood__](https://github.com/ethan-arrowood), <https://www.npmjs.com/~ethan_arrowood>
+* [__Aras Abbasi__](https://github.com/Uzlopak)
+* [__Carlos Fuentes__](https://github.com/metcoder95), <https://www.npmjs.com/~metcoder95>
+* [__Ethan Arrowood__](https://github.com/Ethan-Arrowood), <https://www.npmjs.com/~ethan_arrowood>
 * [__Matteo Collina__](https://github.com/mcollina), <https://www.npmjs.com/~matteo.collina>
 * [__Matthew Aitken__](https://github.com/KhafraDev), <https://www.npmjs.com/~khaf>
+* [__Mert Can Altin__](https://github.com/mertcanaltin), <https://www.npmjs.com/~mertcanaltin>
 * [__Robert Nagy__](https://github.com/ronag), <https://www.npmjs.com/~ronag>
-* [__Szymon Marczak__](https://github.com/szmarczak), <https://www.npmjs.com/~szmarczak>
+* [__Trivikram Kamat__](https://github.com/trivikr), <https://www.npmjs.com/~trivikr>
+* [__tsctx__](https://github.com/tsctx)
 
 ## Past Collaborators
+* [__Szymon Marczak__](https://github.com/szmarczak), <https://www.npmjs.com/~szmarczak>
 * [__Tomas Della Vedova__](https://github.com/delvedor), <https://www.npmjs.com/~delvedor>
 
 ### Releasers

package/node_modules/undici/docs/docs/api/Agent.md

@@ -56,16 +56,16 @@ changes:
     `Infinity`, no limit is enforced. Must be a number greater than `0`.
     **Default:** `Infinity`.
 
-`Agent` inherits all {PoolOptions} (and therefore all {ClientOptions}). The
-per-origin {Pool} it creates uses the default unlimited `connections`, so
-concurrent requests to the same origin are spread across separate {Client}
-instances on separate sockets.
+`Agent` inherits all {PoolOptions} (and therefore all {ClientOptions}). Each
+origin gets a separate {Pool}, with `connections` acting as the maximum number
+of clients that pool may create.
 
 > [!NOTE]
-> Because each concurrent request to an origin may use a different {Client},
-> HTTP/2 multiplexing on a shared session does not apply unless `connections` is
-> set to a small value (for example `connections: 1`). See {PoolOptions} and
-> {ClientOptions} for the full set of inherited options such as `allowH2`
+> For an h2-capable HTTPS origin, the per-origin pool waits for the first TLS
+> connection to finish ALPN negotiation. If the server selects h2, concurrent
+> requests share that session up to `maxConcurrentStreams`. If it selects
+> HTTP/1.1, normal connection fan-out resumes up to `connections`. See
+> {PoolOptions} and {ClientOptions} for inherited options such as `allowH2`
 > (default `true`) and `maxConcurrentStreams` (default `100`).
 
 ### `agent.closed`

package/node_modules/undici/docs/docs/api/CacheStore.md

@@ -42,7 +42,8 @@ added: v7.0.0
 Stores cached responses in memory. The store enforces upper bounds on the total
 number of responses, the total size of all responses, and the size of any single
 response. When a limit is exceeded, the store evicts approximately half of its
-entries and emits a [`'maxSizeExceeded'`](#event-maxsizeexceeded) event.
+entries, least recently used first, and emits a
+[`'maxSizeExceeded'`](#event-maxsizeexceeded) event.
 
 ```mjs
 import { interceptors, cacheStores, Agent, setGlobalDispatcher } from 'undici'
@@ -163,7 +164,9 @@ added: v7.0.0
 -->
 
 Stores cached responses in a SQLite database using the [`node:sqlite`][] API.
-The constructor throws when [`node:sqlite`][] is not available.
+The constructor throws when [`node:sqlite`][] is not available. Response bodies
+larger than `compressThreshold` are stored compressed with zstd and
+decompressed when read back, saving database space.
 
 ```mjs
 import { interceptors, cacheStores, Agent, setGlobalDispatcher } from 'undici'
@@ -189,9 +192,16 @@ added: v7.0.0
   * `maxEntrySize` {number} The maximum size, in bytes, of a single response
     body. Responses whose body exceeds this value are not cached. Must not
     exceed `2000000000` (2 GB). **Default:** `2000000000` (2 GB).
+  * `compressThreshold` {number} The size, in bytes, above which a response
+    body is stored compressed with zstd. Responses with an easily compressible
+    Content-Type (e.g. json, xml, plain text) are compressed regardless of
+    size. Requires a Node version with zstd
+    support (22.19+); when unavailable, bodies are stored uncompressed.
+    **Default:** `1048576` (1 MiB).
 
-`maxCount` and `maxEntrySize` must be non-negative integers; a `TypeError` is
-thrown otherwise, or if `maxEntrySize` is greater than 2 GB.
+`maxCount`, `maxEntrySize`, and `compressThreshold` must be non-negative
+integers; a `TypeError` is thrown otherwise, or if `maxEntrySize` is greater
+than 2 GB.
 
 ### `sqliteCacheStore.close()`
 
@@ -225,7 +235,8 @@ added: v7.0.0
   See [`GetResult`](#getresult).
 
 Looks up a cached response for `key`, comparing the request method and every
-header named in the stored `vary` map.
+header named in the stored `vary` map. A body that was stored compressed is
+decompressed before being returned.
 
 ### `sqliteCacheStore.set(key, value)`
 
@@ -240,9 +251,11 @@ added: v7.0.0
 * Returns: {undefined}
 
 Writes a response into the database directly, without going through a stream. If
-the body exceeds `maxEntrySize`, nothing is stored. When an entry already exists
-for `key` it is overwritten; otherwise a new row is inserted and old entries are
-pruned to honour `maxCount`. This method is used internally by
+the body exceeds `maxEntrySize`, nothing is stored. A body larger than
+`compressThreshold`, or with an easily compressible Content-Type (e.g. json,
+xml, plain text), is compressed with zstd before being written. When an entry
+already exists for `key` it is overwritten; otherwise a new row is inserted and
+old entries are pruned to honour `maxCount`. This method is used internally by
 [`sqliteCacheStore.createWriteStream()`](#sqlitecachestorecreatewritestreamkey-value).
 
 ### `sqliteCacheStore.createWriteStream(key, value)`
@@ -260,7 +273,9 @@ added: v7.0.0
 
 Returns a {Writable} stream used to write the response body into the store. When
 the stream finishes, the buffered body is committed via
-[`sqliteCacheStore.set()`](#sqlitecachestoresetkey-value). If the body exceeds
+[`sqliteCacheStore.set()`](#sqlitecachestoresetkey-value), where bodies larger
+than `compressThreshold` or with an easily compressible Content-Type are
+compressed with zstd. If the body exceeds
 `maxEntrySize`, the stream is destroyed and nothing is stored.
 
 ### `sqliteCacheStore.delete(key)`

package/node_modules/undici/docs/docs/api/Client.md

@@ -116,8 +116,8 @@ added: v1.0.0
   * `maxConcurrentStreams` {number} _Deprecated: use h2Options.useH2c instead_ The maximum number of concurrent HTTP/2
     streams for a single session. Once h2 is negotiated this — not `pipelining`,
     which is HTTP/1.1 only — is the ceiling used to dispatch in-flight requests.
-    It may be overridden by the server's `SETTINGS_MAX_CONCURRENT_STREAMS`
-    frame. **Default:** `100`.
+    The server's `SETTINGS_MAX_CONCURRENT_STREAMS` can lower this limit, but
+    not raise it. **Default:** `100`.
   * `connectionWindowSize` {number} _Deprecated: use h2Options.connectionWindowSize instead_ The HTTP/2 connection-level flow-control
     window size set via `ClientHttp2Session.setLocalWindowSize()`. Must be a
     positive integer. **Default:** `524288`.
@@ -130,8 +130,8 @@ added: v1.0.0
     * `maxConcurrentStreams` {number} The maximum number of concurrent HTTP/2
       streams for a single session. Once h2 is negotiated this — not `pipelining`,
       which is HTTP/1.1 only — is the ceiling used to dispatch in-flight requests.
-      It may be overridden by the server's `SETTINGS_MAX_CONCURRENT_STREAMS`
-      frame. **Default:** `100`.
+      The server's `SETTINGS_MAX_CONCURRENT_STREAMS` can lower this limit, but
+      not raise it. **Default:** `100`.
     * `connectionWindowSize` {number} The HTTP/2 connection-level flow-control
       window size set via `ClientHttp2Session.setLocalWindowSize()`. Must be a
       positive integer. **Default:** `524288`.
@@ -148,8 +148,13 @@ added: v1.0.0
       payloads, and decompressed (`permessage-deflate`) messages. Set to `0` to
       disable the limit. **Default:** `134217728`.
   * `eventSource` {Object} (optional) EventSource-specific configuration.
-    * `maxEventSize` {number} The maximum allowed event size, in bytes, for
-      EventSource messages. Set to `0` to disable the limit.
+    * `maxEventSize` {number} The maximum total bytes of data and metadata
+      field values retained for a pending EventSource event. Each unfinished
+      line is separately limited to this value plus seven syntax bytes, before
+      its line ending arrives. The number of `data:` lines per event and input
+      chunks buffered for an unfinished line are each limited to
+      `min(131072, max(1024, floor(maxEventSize / 128)))` to bound object overhead.
+      Set to `0` to disable these limits.
       **Default:** `buffer.kStringMaxLength`.
 * Returns: {Client}
 

package/node_modules/undici/docs/docs/api/DiagnosticsChannel.md

@@ -120,7 +120,8 @@ diagnosticsChannel.channel('undici:request:bodySent').subscribe(({ request }) =>
 added: v6.3.0
 -->
 
-Published after the response headers have been received.
+Published after the response headers have been received. This includes a
+successful CONNECT or protocol upgrade response.
 
 * `message` {Object}
   * `request` {Object} The same object published by
@@ -128,8 +129,9 @@ Published after the response headers have been received.
   * `response` {Object} The response being received.
     * `statusCode` {number} The HTTP status code.
     * `statusText` {string} The HTTP status message.
-    * `headers` {Buffer[]} The raw response headers as an array of buffers,
-      alternating between header name and value.
+    * `headers` {Buffer[]|Object} HTTP/1.1 response headers are an array of
+      buffers alternating between header name and value. HTTP/2 response
+      headers are an object.
 
 ```mjs
 import diagnosticsChannel from 'node:diagnostics_channel'
@@ -137,7 +139,7 @@ import diagnosticsChannel from 'node:diagnostics_channel'
 diagnosticsChannel.channel('undici:request:headers').subscribe(({ request, response }) => {
   console.log('statusCode', response.statusCode)
   console.log(response.statusText)
-  console.log(response.headers.map((x) => x.toString()))
+  console.log(response.headers)
 })
 ```
 
@@ -168,8 +170,9 @@ diagnosticsChannel.channel('undici:request:bodyChunkReceived').subscribe(({ requ
 added: v6.3.0
 -->
 
-Published after the response body and trailers have been received, that is, once
-the response has fully completed.
+Published once the response has fully completed. After an upgraded socket has
+been passed to the request handler, this event is published with an empty
+`trailers` array.
 
 * `message` {Object}
   * `request` {Object} The same object published by