@depup/jsdom 28.1.0-depup.1

package/lib/jsdom/living/xhr/XMLHttpRequestEventTarget-impl.js

@@ -0,0 +1,17 @@
+"use strict";
+const EventTargetImpl = require("../events/EventTarget-impl").implementation;
+const idlUtils = require("../../../generated/idl/utils");
+const { setupForSimpleEventAccessors } = require("../helpers/create-event-accessor");
+
+const events = ["loadstart", "progress", "abort", "error", "load", "timeout", "loadend"];
+
+class XMLHttpRequestEventTargetImpl extends EventTargetImpl {
+  // TODO: remove this when we fix EventTargetImpl to use this._globalObject directly instead of using _ownerDocument.
+  // https://github.com/jsdom/jsdom/issues/2780
+  get _ownerDocument() {
+    return idlUtils.implForWrapper(this._globalObject._document);
+  }
+}
+setupForSimpleEventAccessors(XMLHttpRequestEventTargetImpl.prototype, events);
+
+exports.implementation = XMLHttpRequestEventTargetImpl;

package/lib/jsdom/living/xhr/XMLHttpRequestUpload-impl.js

@@ -0,0 +1,4 @@
+"use strict";
+const XMLHttpRequestEventTargetImpl = require("./XMLHttpRequestEventTarget-impl").implementation;
+
+exports.implementation = class XMLHttpRequestUploadImpl extends XMLHttpRequestEventTargetImpl {};

package/lib/jsdom/living/xhr/multipart-form-data.js

@@ -0,0 +1,99 @@
+"use strict";
+const conversions = require("webidl-conversions");
+const { utf8Encode } = require("../helpers/encoding");
+
+// https://fetch.spec.whatwg.org/#concept-bodyinit-extract (note: always UTF-8)
+// https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart%2Fform-data-encoding-algorithm
+// https://andreubotella.github.io/multipart-form-data/
+
+const contentDispositionPrefix = utf8Encode(`Content-Disposition: form-data; name="`);
+const filenamePrefix = utf8Encode(`; filename="`);
+const contentType = utf8Encode(`Content-Type: `);
+
+// https://andreubotella.github.io/multipart-form-data/#multipart-form-data-boundary
+function generateBoundary() {
+  let boundary = "--------------------------";
+  for (let i = 0; i < 24; ++i) {
+    boundary += Math.floor(Math.random() * 10).toString(16);
+  }
+  return utf8Encode(boundary);
+}
+
+// https://andreubotella.github.io/multipart-form-data/#escape-a-multipart-form-data-name
+function escapeName(name, isFilename = false) {
+  if (isFilename) {
+    name = conversions.USVString(name);
+  } else {
+    name = name.replace(/\r(?!\n)|(?<!\r)\n/g, "\r\n");
+  }
+
+  const encoded = utf8Encode(name);
+  const encodedWithSubs = [];
+  for (const originalByte of encoded) {
+    if (originalByte === 0x0A) {
+      encodedWithSubs.push(37, 48, 65); // `%0A`
+    } else if (originalByte === 0x0D) {
+      encodedWithSubs.push(37, 48, 68); // `%0D`
+    } else if (originalByte === 0x22) {
+      encodedWithSubs.push(37, 50, 50); // `%22`
+    } else {
+      encodedWithSubs.push(originalByte);
+    }
+  }
+
+  return new Uint8Array(encodedWithSubs);
+}
+
+// https://andreubotella.github.io/multipart-form-data/#multipart-form-data-chunk-serializer
+exports.serializeEntryList = entries => {
+  const boundary = generateBoundary();
+  const outputChunks = [];
+
+  for (const entry of entries) {
+    const chunkBytes = [
+      45, 45, // `--`
+      ...boundary,
+      0x0D, 0x0A
+    ];
+
+    chunkBytes.push(...contentDispositionPrefix, ...escapeName(entry.name), 0x22 /* `"` */);
+
+    let { value } = entry;
+    if (typeof value === "string") {
+      chunkBytes.push(0x0D, 0x0A, 0x0D, 0x0A);
+
+      value = value.replace(/\r(?!\n)|(?<!\r)\n/g, "\r\n");
+
+      chunkBytes.push(...utf8Encode(value));
+
+      chunkBytes.push(0x0D, 0x0A);
+
+      outputChunks.push(new Uint8Array(chunkBytes));
+    } else {
+      // value is a FileImpl object
+
+      chunkBytes.push(...filenamePrefix, ...escapeName(value.name, true), 0x22, 0x0D, 0x0A);
+
+      const type = value.type !== "" ? value.type : "application/octet-stream";
+      chunkBytes.push(...contentType, ...utf8Encode(type));
+
+      chunkBytes.push(0x0D, 0x0A, 0x0D, 0x0A);
+
+      outputChunks.push(
+        new Uint8Array(chunkBytes),
+        // The spec returns the File object here but for our purposes the bytes (as a `Uint8Array`) are more convenient.
+        value._bytes,
+        new Uint8Array([0x0D, 0x0A])
+      );
+    }
+  }
+
+  outputChunks.push(
+    new Uint8Array([45, 45]), // `--`
+    boundary,
+    new Uint8Array([45, 45]), // `--`
+    new Uint8Array([0x0D, 0x0A])
+  );
+
+  return { boundary, outputChunks };
+};

package/lib/jsdom/living/xhr/xhr-sync-worker.js

@@ -0,0 +1,51 @@
+"use strict";
+// Persistent worker thread for handling synchronous XHR requests.
+//
+// This worker runs in a separate thread and performs async HTTP requests on behalf of the main
+// thread, which blocks on Atomics.wait() until we signal completion. A single JSDOM instance is
+// created at startup and reused across requests to avoid the ~400ms initialization cost each time.
+//
+// The signaling protocol (shared with sendSyncWorkerRequest in XMLHttpRequest-impl.js):
+// 1. Main thread sends us a SharedArrayBuffer, a MessagePort, and the serialized request config.
+// 2. We perform the XHR asynchronously.
+// 3. When done, we post the serialized response to the MessagePort, then signal the main thread
+//    by writing 1 to the SharedArrayBuffer with Atomics.store() and waking it with Atomics.notify().
+
+const { parentPort } = require("node:worker_threads");
+const { JSDOM } = require("../../../..");
+const idlUtils = require("../../../generated/idl/utils");
+
+const dom = new JSDOM();
+const IDLE_TIMEOUT_MS = 5000;
+
+let idleTimer = setTimeout(() => process.exit(0), IDLE_TIMEOUT_MS);
+idleTimer.unref();
+
+parentPort.on("message", ({ sharedBuffer, responsePort, config }) => {
+  clearTimeout(idleTimer);
+
+  const int32 = new Int32Array(sharedBuffer);
+
+  const xhr = new dom.window.XMLHttpRequest();
+  const xhrImpl = idlUtils.implForWrapper(xhr);
+  xhrImpl._adoptSerializedRequest(config);
+
+  function done() {
+    const response = xhrImpl._serializeResponse();
+    const transfer = response.responseBytes ? [response.responseBytes.buffer] : [];
+    responsePort.postMessage(response, transfer);
+    Atomics.store(int32, 0, 1);
+    Atomics.notify(int32, 0);
+
+    idleTimer = setTimeout(() => process.exit(0), IDLE_TIMEOUT_MS);
+    idleTimer.unref();
+  }
+
+  try {
+    xhr.addEventListener("loadend", done, false);
+    xhr.send(xhrImpl._body);
+  } catch (error) {
+    xhrImpl._error = error;
+    done();
+  }
+});

package/lib/jsdom/living/xhr/xhr-utils.js

@@ -0,0 +1,206 @@
+"use strict";
+const { Readable } = require("stream");
+const { parseURL, serializeURL, serializeURLOrigin } = require("whatwg-url");
+const HeaderList = require("../fetch/header-list");
+const { isForbiddenResponseHeaderName, isNoCORSSafelistedRequestHeaderName } = require("../fetch/header-types");
+
+const headerListSeparatorRegexp = /,[ \t]*/;
+const simpleMethods = new Set(["GET", "HEAD", "POST"]);
+
+const corsSafeResponseHeaders = new Set([
+  "cache-control",
+  "content-language",
+  "content-length",
+  "content-type",
+  "expires",
+  "last-modified",
+  "pragma"
+]);
+
+/**
+ * A network error response.
+ */
+function makeNetworkError(error = null) {
+  return { type: "error", error };
+}
+
+/**
+ * Check if a response is a network error.
+ */
+function isNetworkError(response) {
+  return response && response.type === "error";
+}
+
+/**
+ * Performs a fetch operation for XHR with full CORS handling.
+ * Delegates redirect handling and CORS validation to the dispatcher.
+ *
+ * @param {JSDOMDispatcher} dispatcher - The dispatcher to use for sending the request
+ * @param {Object} config - Request configuration
+ * @param {AbortSignal} signal - Signal to abort the fetch
+ * @returns {Promise<Object>} The response object with filteredResponseHeaders, or a network error response
+ */
+async function performFetch(dispatcher, config, signal) {
+  const {
+    url,
+    method,
+    requestHeaders: userRequestHeaders,
+    body,
+    origin,
+    referrer,
+    withCredentials,
+    auth,
+    uploadListener
+  } = config;
+
+  const urlRecord = parseURL(url);
+  const ucMethod = method.toUpperCase();
+
+  // Build request headers - start with user-set headers
+  // Default headers (User-Agent, Accept, etc.) are added by the dispatcher
+  const requestHeaders = userRequestHeaders.clone();
+
+  if (referrer) {
+    requestHeaders.set("Referer", referrer);
+  }
+
+  const crossOrigin = origin !== serializeURLOrigin(urlRecord);
+  if (crossOrigin) {
+    requestHeaders.set("Origin", origin);
+  }
+
+  // Compute if preflight is needed (but don't execute - dispatcher will)
+  const nonSimpleHeaders = [];
+  for (const name of userRequestHeaders.names()) {
+    if (!isNoCORSSafelistedRequestHeaderName(name)) {
+      nonSimpleHeaders.push(name);
+    }
+  }
+  const needsPreflight = crossOrigin &&
+    (!simpleMethods.has(ucMethod) || nonSimpleHeaders.length > 0 || uploadListener);
+
+  // Build opaque options for dispatcher
+  const opaque = {
+    element: null,
+    url,
+    origin,
+    corsMode: crossOrigin, // Enable CORS handling if cross-origin
+    withCredentials,
+    auth
+  };
+  if (needsPreflight) {
+    opaque.preflight = { unsafeHeaders: nonSimpleHeaders };
+  }
+
+  // Single dispatch call - dispatcher handles preflight, redirects, CORS
+  const response = await dispatchMainRequest(dispatcher, {
+    method,
+    headers: requestHeaders,
+    body,
+    opaque
+  }, signal);
+
+  if (isNetworkError(response)) {
+    return response;
+  }
+
+  // Build filtered response headers (post-processing)
+  const filteredResponseHeaders = new Set();
+  const { headers } = response;
+
+  // Determine effective origin for filtering (from response URL after redirects)
+  const destUrlRecord = parseURL(response.url);
+  const isCrossOriginResponse = origin !== serializeURLOrigin(destUrlRecord) && destUrlRecord.scheme !== "data";
+
+  if (isCrossOriginResponse) {
+    // Filter headers not exposed by CORS
+    const acehStr = headers.get("access-control-expose-headers");
+    const aceh = new Set(acehStr ? acehStr.trim().toLowerCase().split(headerListSeparatorRegexp) : []);
+    for (const [header] of headers) {
+      if (!corsSafeResponseHeaders.has(header) && !aceh.has(header) && !aceh.has("*")) {
+        filteredResponseHeaders.add(header);
+      }
+    }
+  }
+
+  // Always filter forbidden response headers
+  for (const [header] of headers) {
+    if (isForbiddenResponseHeaderName(header)) {
+      filteredResponseHeaders.add(header);
+    }
+  }
+
+  response.filteredResponseHeaders = filteredResponseHeaders;
+  return response;
+}
+
+/**
+ * Helper to dispatch a request and return a Promise with the response.
+ *
+ * We use the callback-based dispatch() API instead of the simpler request() API because of
+ * WrapHandler's incorrect encoding of header values: https://github.com/nodejs/undici/issues/4797
+ */
+function dispatchMainRequest(dispatcher, opts, signal) {
+  if (signal.aborted) {
+    return Promise.resolve(makeNetworkError());
+  }
+
+  return new Promise(resolve => {
+    let context, bodyStream, sendAbortToUndiciController;
+
+    function onAbort() {
+      sendAbortToUndiciController?.(signal.reason);
+      bodyStream?.destroy();
+      resolve(makeNetworkError());
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+
+    dispatcher.dispatch(opts, {
+      onRequestStart(controller, ctx) {
+        context = ctx;
+        sendAbortToUndiciController = reason => controller.abort(reason);
+        if (signal.aborted) {
+          controller.abort(signal.reason);
+        }
+      },
+      onResponseStart(controller, statusCode, headers, statusText) {
+        if (signal.aborted) {
+          return;
+        }
+
+        // Prevent unhandled "error" events from `destroy()` calls.
+        bodyStream = new Readable({ read() {} });
+        bodyStream.on("error", () => {});
+
+        // Get final URL from context (set by dispatcher after handling redirects)
+        const finalURL = serializeURL(context.finalURL);
+
+        resolve({
+          status: statusCode,
+          statusText: statusText || "",
+          headers: HeaderList.fromJSON(headers),
+          body: bodyStream,
+          url: finalURL
+        });
+      },
+      onResponseData(controller, chunk) {
+        if (signal.aborted) {
+          return;
+        }
+        bodyStream.push(chunk);
+      },
+      onResponseEnd() {
+        signal.removeEventListener("abort", onAbort);
+        bodyStream?.push(null);
+      },
+      onResponseError(controller, err) {
+        signal.removeEventListener("abort", onAbort);
+        bodyStream?.destroy(err);
+        resolve(makeNetworkError(err));
+      }
+    });
+  });
+}
+
+exports.performFetch = performFetch;
+exports.isNetworkError = isNetworkError;

package/lib/jsdom/utils.js

@@ -0,0 +1,105 @@
+"use strict";
+const { domSymbolTree } = require("./living/helpers/internal-constants");
+const SYMBOL_TREE_POSITION = require("symbol-tree").TreePosition;
+
+/**
+ * Define a set of properties on an object, by copying the property descriptors
+ * from the original object.
+ *
+ * - `object` {Object} the target object
+ * - `properties` {Object} the source from which to copy property descriptors
+ */
+exports.define = function define(object, properties) {
+  for (const name of Object.getOwnPropertyNames(properties)) {
+    const propDesc = Object.getOwnPropertyDescriptor(properties, name);
+    Object.defineProperty(object, name, propDesc);
+  }
+};
+
+exports.mixin = (target, source) => {
+  const keys = Reflect.ownKeys(source);
+  for (let i = 0; i < keys.length; ++i) {
+    if (keys[i] in target) {
+      continue;
+    }
+
+    Object.defineProperty(target, keys[i], Object.getOwnPropertyDescriptor(source, keys[i]));
+  }
+};
+
+let memoizeQueryTypeCounter = 0;
+
+/**
+ * Returns a version of a method that memoizes specific types of calls on the object
+ *
+ * - `fn` {Function} the method to be memozied
+ */
+exports.memoizeQuery = function memoizeQuery(fn) {
+  // Only memoize query functions with arity <= 2
+  if (fn.length > 2) {
+    return fn;
+  }
+
+  const type = memoizeQueryTypeCounter++;
+
+  return function (...args) {
+    if (!this._memoizedQueries) {
+      return fn.apply(this, args);
+    }
+
+    if (!this._memoizedQueries[type]) {
+      this._memoizedQueries[type] = Object.create(null);
+    }
+
+    let key;
+    if (args.length === 1 && typeof args[0] === "string") {
+      key = args[0];
+    } else if (args.length === 2 && typeof args[0] === "string" && typeof args[1] === "string") {
+      key = args[0] + "::" + args[1];
+    } else {
+      return fn.apply(this, args);
+    }
+
+    if (!(key in this._memoizedQueries[type])) {
+      this._memoizedQueries[type][key] = fn.apply(this, args);
+    }
+    return this._memoizedQueries[type][key];
+  };
+};
+
+exports.simultaneousIterators = function* (first, second) {
+  for (;;) {
+    const firstResult = first.next();
+    const secondResult = second.next();
+
+    if (firstResult.done && secondResult.done) {
+      return;
+    }
+
+    yield [
+      firstResult.done ? null : firstResult.value,
+      secondResult.done ? null : secondResult.value
+    ];
+  }
+};
+
+exports.treeOrderSorter = function (a, b) {
+  const compare = domSymbolTree.compareTreePosition(a, b);
+
+  if (compare & SYMBOL_TREE_POSITION.PRECEDING) { // b is preceding a
+    return 1;
+  }
+
+  if (compare & SYMBOL_TREE_POSITION.FOLLOWING) {
+    return -1;
+  }
+
+  // disconnected or equal:
+  return 0;
+};
+
+try {
+  exports.Canvas = require("canvas");
+} catch {
+  exports.Canvas = null;
+}

package/lib/jsdom/virtual-console.js

@@ -0,0 +1,46 @@
+"use strict";
+const { EventEmitter } = require("events");
+
+module.exports = class VirtualConsole extends EventEmitter {
+  constructor() {
+    super();
+
+    this.on("error", () => {
+      // If "error" event has no listeners,
+      // EventEmitter throws an exception
+    });
+  }
+
+  forwardTo(anyConsole, { jsdomErrors } = {}) {
+    for (const method of Object.keys(anyConsole)) {
+      if (typeof anyConsole[method] === "function") {
+        function onMethodCall(...args) {
+          anyConsole[method](...args);
+        }
+        this.on(method, onMethodCall);
+      }
+    }
+
+    function forward(e) {
+      if (e.type === "unhandled-exception") {
+        anyConsole.error(e.cause.stack);
+      } else {
+        anyConsole.error(e.message);
+      }
+    }
+
+    if (jsdomErrors === undefined) {
+      this.on("jsdomError", forward);
+    } else if (Array.isArray(jsdomErrors)) {
+      this.on("jsdomError", e => {
+        if (jsdomErrors.includes(e.type)) {
+          forward(e);
+        }
+      });
+    } else if (jsdomErrors !== "none") {
+      throw new TypeError("Invalid jsdomErrors option");
+    }
+
+    return this;
+  }
+};

package/package.json

@@ -0,0 +1,143 @@
+{
+  "name": "@depup/jsdom",
+  "version": "28.1.0-depup.1",
+  "description": "[DepUp] A JavaScript implementation of many web standards",
+  "keywords": [
+    "depup",
+    "dependency-bumped",
+    "updated-deps",
+    "jsdom",
+    "dom",
+    "html",
+    "whatwg",
+    "w3c"
+  ],
+  "maintainers": [
+    "Elijah Insua <tmpvar@gmail.com> (http://tmpvar.com)",
+    "Domenic Denicola <d@domenic.me> (https://domenic.me/)",
+    "Sebastian Mayr <sebmaster16@gmail.com> (https://blog.smayr.name/)",
+    "Joris van der Wel <joris@jorisvanderwel.com>",
+    "Timothy Gu <timothygu99@gmail.com> (https://timothygu.me/)",
+    "Magne Andersson <code@zirro.se> (https://zirro.se/)",
+    "Pierre-Marie Dartus <dartus.pierremarie@gmail.com>"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jsdom/jsdom.git"
+  },
+  "dependencies": {
+    "@acemir/cssom": "^0.9.31",
+    "@asamuzakjp/dom-selector": "^7.0.2",
+    "@bramus/specificity": "^2.4.2",
+    "@exodus/bytes": "^1.15.0",
+    "cssstyle": "^6.2.0",
+    "data-urls": "^7.0.0",
+    "decimal.js": "^10.6.0",
+    "html-encoding-sniffer": "^6.0.0",
+    "http-proxy-agent": "^8.0.0",
+    "https-proxy-agent": "^8.0.0",
+    "is-potential-custom-element-name": "^1.0.1",
+    "parse5": "^8.0.0",
+    "saxes": "^6.0.0",
+    "symbol-tree": "^3.2.4",
+    "tough-cookie": "^6.0.1",
+    "undici": "^7.24.3",
+    "w3c-xmlserializer": "^5.0.0",
+    "webidl-conversions": "^8.0.1",
+    "whatwg-mimetype": "^5.0.0",
+    "whatwg-url": "^16.0.1",
+    "xml-name-validator": "^5.0.0"
+  },
+  "peerDependencies": {
+    "canvas": "^3.0.0"
+  },
+  "peerDependenciesMeta": {
+    "canvas": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@domenic/eslint-config": "^4.1.0",
+    "eslint": "^9.39.2",
+    "eslint-plugin-html": "^8.1.4",
+    "eslint-plugin-n": "^17.23.2",
+    "globals": "^17.3.0",
+    "js-yaml": "^4.1.1",
+    "minimatch": "^10.1.2",
+    "mocha": "^11.7.5",
+    "mocha-sugar-free": "^1.4.0",
+    "npm-run-all2": "^8.0.4",
+    "opener": "^1.5.2",
+    "pngjs": "^7.0.0",
+    "semver": "^7.7.4",
+    "server-destroy": "^1.0.1",
+    "tinybench": "^6.0.0",
+    "webidl2": "^24.5.0",
+    "webidl2js": "^19.1.0"
+  },
+  "scripts": {
+    "prepare:convert-idl": "node ./scripts/webidl/convert.js",
+    "prepare:generate-event-sets": "node ./scripts/generate-event-sets.js",
+    "prepare:generate-js-globals": "node ./scripts/generate-js-globals.js",
+    "pretest": "npm run prepare && npm run wpt:init",
+    "test": "npm-run-all --continue-on-error test:*",
+    "test:api": "mocha test/api/",
+    "test:to-port-to-wpts": "mocha test/to-port-to-wpts/ && mocha test/to-port-to-wpts/level1/ && mocha test/to-port-to-wpts/level2/ && mocha test/to-port-to-wpts/level3/",
+    "test:tuwpt": "mocha test/web-platform-tests/run-tuwpts.js",
+    "test:tuwpt:browser": "node scripts/verify-tuwpts-in-browser.js",
+    "test:wpt": "mocha test/web-platform-tests/run-wpts.js",
+    "lint": "eslint --cache",
+    "wpt:init": "git submodule update --init --recursive",
+    "wpt:reset": "rm -rf ./test/web-platform-tests/tests && npm run wpt:init",
+    "wpt:update": "git submodule update --init --recursive --remote && cd test/web-platform-tests/tests && python wpt.py manifest --path ../wpt-manifest.json",
+    "update-authors": "git log --format=\"%aN <%aE>\" | sort -f | uniq > AUTHORS.txt",
+    "benchmark": "node ./benchmark/runner"
+  },
+  "main": "./lib/api.js",
+  "type": "commonjs",
+  "engines": {
+    "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+  },
+  "depup": {
+    "changes": {
+      "@asamuzakjp/dom-selector": {
+        "from": "^6.8.1",
+        "to": "^7.0.2"
+      },
+      "@exodus/bytes": {
+        "from": "^1.11.0",
+        "to": "^1.15.0"
+      },
+      "cssstyle": {
+        "from": "^6.0.1",
+        "to": "^6.2.0"
+      },
+      "http-proxy-agent": {
+        "from": "^7.0.2",
+        "to": "^8.0.0"
+      },
+      "https-proxy-agent": {
+        "from": "^7.0.6",
+        "to": "^8.0.0"
+      },
+      "tough-cookie": {
+        "from": "^6.0.0",
+        "to": "^6.0.1"
+      },
+      "undici": {
+        "from": "^7.21.0",
+        "to": "^7.24.3"
+      },
+      "whatwg-url": {
+        "from": "^16.0.0",
+        "to": "^16.0.1"
+      }
+    },
+    "depsUpdated": 8,
+    "originalPackage": "jsdom",
+    "originalVersion": "28.1.0",
+    "processedAt": "2026-03-14T20:53:57.069Z",
+    "smokeTest": "passed"
+  }
+}