@pnpm/network.fetch 1100.0.2 → 1100.0.4

package/lib/dispatcher.js

@@ -23,7 +23,44 @@ setGlobalDispatcher(new Agent({
     connect: {
         autoSelectFamily: true,
     },
-}));
+}).compose(stripSecFetchHeaders));
+// undici's fetch() automatically adds sec-fetch-* headers (e.g. sec-fetch-mode: cors)
+// per the Fetch spec. Some registries like Azure DevOps Artifacts interpret these as
+// browser requests and reject them with HTTP 400. Since pnpm is a CLI tool, these
+// headers serve no purpose and must be stripped.
+// See https://github.com/pnpm/pnpm/issues/11572
+function stripSecFetchHeaders(dispatch) {
+    return (opts, handler) => {
+        if (opts.headers) {
+            if (Array.isArray(opts.headers)) {
+                // Flat array format: [key1, val1, key2, val2, ...]
+                const filtered = [];
+                for (let i = 0; i < opts.headers.length; i += 2) {
+                    if (!opts.headers[i].toLowerCase().startsWith('sec-fetch-')) {
+                        filtered.push(opts.headers[i], opts.headers[i + 1]);
+                    }
+                }
+                opts = { ...opts, headers: filtered };
+            }
+            else if (typeof opts.headers === 'object') {
+                // undici also accepts an iterable of [key, value] pairs (e.g. a Map or
+                // web Headers). Use that iterator when present; otherwise fall back to
+                // Object.entries for plain IncomingHttpHeaders objects.
+                const entries = Symbol.iterator in opts.headers
+                    ? opts.headers
+                    : Object.entries(opts.headers);
+                const headers = {};
+                for (const [key, value] of entries) {
+                    if (!key.toLowerCase().startsWith('sec-fetch-')) {
+                        headers[key] = value;
+                    }
+                }
+                opts = { ...opts, headers };
+            }
+        }
+        return dispatch(opts, handler);
+    };
+}
 const DISPATCHER_CACHE = new LRUCache({
     max: 50,
     dispose: (dispatcher) => {
@@ -130,6 +167,7 @@ function getProxyDispatcher(parsedUri, opts) {
     else {
         dispatcher = createHttpProxyDispatcher(proxyUrl, isHttps, opts, { ca, cert, key: certKey });
     }
+    dispatcher = dispatcher.compose(stripSecFetchHeaders);
     DISPATCHER_CACHE.set(key, dispatcher);
     return dispatcher;
 }
@@ -247,8 +285,9 @@ function getNonProxyDispatcher(parsedUri, opts) {
                 localAddress: opts.localAddress,
             },
     });
-    DISPATCHER_CACHE.set(key, agent);
-    return agent;
+    const dispatcher = agent.compose(stripSecFetchHeaders);
+    DISPATCHER_CACHE.set(key, dispatcher);
+    return dispatcher;
 }
 function checkNoProxy(parsedUri, opts) {
     const host = parsedUri.hostname

package/lib/fetchFromRegistry.d.ts

@@ -7,6 +7,20 @@ export interface FetchWithDispatcherOptions extends RequestInit {
     dispatcherOptions: DispatcherOptions;
 }
 export declare function fetchWithDispatcher(url: string | URL, opts: FetchWithDispatcherOptions): Promise<Response>;
+export interface CreateDispatchedFetchOptions extends DispatcherOptions {
+    /**
+     * Per-registry config (TLS, auth, etc.). When set, the matching TLS entries
+     * are automatically extracted into `clientCertificates` so callers don't
+     * have to do it themselves.
+     */
+    configByUri?: Record<string, RegistryConfig>;
+}
+/**
+ * Returns a {@link fetch} pre-bound to the given dispatcher options, so callers
+ * that need a fetch function (rather than a one-shot call) can route their
+ * requests through the configured proxy / TLS / local-address settings.
+ */
+export declare function createDispatchedFetch(opts: CreateDispatchedFetchOptions): (url: string | URL, opts?: RequestInit) => Promise<Response>;
 export type { DispatcherOptions };
 export interface CreateFetchFromRegistryOptions extends DispatcherOptions {
     userAgent?: string;

package/lib/fetchFromRegistry.js

@@ -17,7 +17,20 @@ export function fetchWithDispatcher(url, opts) {
         dispatcher,
     });
 }
+/**
+ * Returns a {@link fetch} pre-bound to the given dispatcher options, so callers
+ * that need a fetch function (rather than a one-shot call) can route their
+ * requests through the configured proxy / TLS / local-address settings.
+ */
+export function createDispatchedFetch(opts) {
+    const dispatcherOptions = {
+        ...opts,
+        clientCertificates: opts.clientCertificates ?? extractTlsConfigs(opts.configByUri),
+    };
+    return (url, fetchOpts) => fetchWithDispatcher(url, { ...fetchOpts, dispatcherOptions });
+}
 export function createFetchFromRegistry(defaultOpts) {
+    const clientCertificates = extractTlsConfigs(defaultOpts.configByUri);
     return async (url, opts) => {
         const headers = {
             'user-agent': USER_AGENT,
@@ -51,7 +64,7 @@ export function createFetchFromRegistry(defaultOpts) {
                 ...defaultOpts,
                 ...opts,
                 strictSsl: defaultOpts.strictSsl ?? true,
-                clientCertificates: extractTlsConfigs(defaultOpts.configByUri),
+                clientCertificates,
             };
             const response = await fetchWithDispatcher(urlObject, {
                 dispatcherOptions,

package/lib/index.d.ts

@@ -1,4 +1,4 @@
 export { clearDispatcherCache, getDispatcher } from './dispatcher.js';
 export { fetch, isRedirect, type RetryTimeoutOptions } from './fetch.js';
-export { createFetchFromRegistry, type CreateFetchFromRegistryOptions, type DispatcherOptions, fetchWithDispatcher } from './fetchFromRegistry.js';
+export { createDispatchedFetch, type CreateDispatchedFetchOptions, createFetchFromRegistry, type CreateFetchFromRegistryOptions, type DispatcherOptions, fetchWithDispatcher } from './fetchFromRegistry.js';
 export type { FetchFromRegistry } from '@pnpm/fetching.types';

package/lib/index.js

@@ -1,4 +1,4 @@
 export { clearDispatcherCache, getDispatcher } from './dispatcher.js';
 export { fetch, isRedirect } from './fetch.js';
-export { createFetchFromRegistry, fetchWithDispatcher } from './fetchFromRegistry.js';
+export { createDispatchedFetch, createFetchFromRegistry, fetchWithDispatcher } from './fetchFromRegistry.js';
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.fetch",
-  "version": "1100.0.2",
+  "version": "1100.0.4",
   "description": "Native fetch with retries",
   "keywords": [
     "pnpm",
@@ -31,10 +31,10 @@
     "lru-cache": "^11.2.7",
     "socks": "^2.8.1",
     "undici": "^7.2.0",
-    "@pnpm/core-loggers": "1100.0.1",
+    "@pnpm/core-loggers": "1100.0.2",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/fetching.types": "1100.0.1",
-    "@pnpm/types": "1101.0.0",
-    "@pnpm/error": "1100.0.0"
+    "@pnpm/types": "1101.1.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -43,7 +43,7 @@
     "@jest/globals": "30.3.0",
     "https-proxy-server-express": "0.1.2",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/network.fetch": "1100.0.2"
+    "@pnpm/network.fetch": "1100.0.4"
   },
   "engines": {
     "node": ">=22.13"