@pnpm/network.fetch 1100.0.3 → 1100.0.4

package/lib/dispatcher.js

@@ -23,7 +23,44 @@ setGlobalDispatcher(new Agent({
     connect: {
         autoSelectFamily: true,
     },
-}));
+}).compose(stripSecFetchHeaders));
+// undici's fetch() automatically adds sec-fetch-* headers (e.g. sec-fetch-mode: cors)
+// per the Fetch spec. Some registries like Azure DevOps Artifacts interpret these as
+// browser requests and reject them with HTTP 400. Since pnpm is a CLI tool, these
+// headers serve no purpose and must be stripped.
+// See https://github.com/pnpm/pnpm/issues/11572
+function stripSecFetchHeaders(dispatch) {
+    return (opts, handler) => {
+        if (opts.headers) {
+            if (Array.isArray(opts.headers)) {
+                // Flat array format: [key1, val1, key2, val2, ...]
+                const filtered = [];
+                for (let i = 0; i < opts.headers.length; i += 2) {
+                    if (!opts.headers[i].toLowerCase().startsWith('sec-fetch-')) {
+                        filtered.push(opts.headers[i], opts.headers[i + 1]);
+                    }
+                }
+                opts = { ...opts, headers: filtered };
+            }
+            else if (typeof opts.headers === 'object') {
+                // undici also accepts an iterable of [key, value] pairs (e.g. a Map or
+                // web Headers). Use that iterator when present; otherwise fall back to
+                // Object.entries for plain IncomingHttpHeaders objects.
+                const entries = Symbol.iterator in opts.headers
+                    ? opts.headers
+                    : Object.entries(opts.headers);
+                const headers = {};
+                for (const [key, value] of entries) {
+                    if (!key.toLowerCase().startsWith('sec-fetch-')) {
+                        headers[key] = value;
+                    }
+                }
+                opts = { ...opts, headers };
+            }
+        }
+        return dispatch(opts, handler);
+    };
+}
 const DISPATCHER_CACHE = new LRUCache({
     max: 50,
     dispose: (dispatcher) => {
@@ -130,6 +167,7 @@ function getProxyDispatcher(parsedUri, opts) {
     else {
         dispatcher = createHttpProxyDispatcher(proxyUrl, isHttps, opts, { ca, cert, key: certKey });
     }
+    dispatcher = dispatcher.compose(stripSecFetchHeaders);
     DISPATCHER_CACHE.set(key, dispatcher);
     return dispatcher;
 }
@@ -247,8 +285,9 @@ function getNonProxyDispatcher(parsedUri, opts) {
                 localAddress: opts.localAddress,
             },
     });
-    DISPATCHER_CACHE.set(key, agent);
-    return agent;
+    const dispatcher = agent.compose(stripSecFetchHeaders);
+    DISPATCHER_CACHE.set(key, dispatcher);
+    return dispatcher;
 }
 function checkNoProxy(parsedUri, opts) {
     const host = parsedUri.hostname

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.fetch",
-  "version": "1100.0.3",
+  "version": "1100.0.4",
   "description": "Native fetch with retries",
   "keywords": [
     "pnpm",
@@ -31,10 +31,10 @@
     "lru-cache": "^11.2.7",
     "socks": "^2.8.1",
     "undici": "^7.2.0",
-    "@pnpm/error": "1100.0.0",
     "@pnpm/core-loggers": "1100.0.2",
-    "@pnpm/types": "1101.1.0",
-    "@pnpm/fetching.types": "1100.0.1"
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/fetching.types": "1100.0.1",
+    "@pnpm/types": "1101.1.0"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -42,8 +42,8 @@
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "https-proxy-server-express": "0.1.2",
-    "@pnpm/network.fetch": "1100.0.3",
-    "@pnpm/logger": "1100.0.0"
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/network.fetch": "1100.0.4"
   },
   "engines": {
     "node": ">=22.13"