fix: harden HTTPS CA trust, IPv6 verification, and content-encoding parsing - #3504

Merged

ardatan merged 22 commits into

masterfrom

fix/bun-https-cleanup-timeout

Aug 12, 2026

Commits on Aug 12, 2026

fix(test): use local HTTPS server for cleanup resource test
ardatan
committed
ec52ce8
fix(test): add node:https TestServer and harden curl CA loading
ardatan
committed
00aac2d
fix(test): gate node:https on CA APIs and preserve URL protocol for ipv6
ardatan
committed
0787f74
revert: keep fetchCurl CA loading unchanged
ardatan
committed
c21643f
refactor: trust CAs via tls.getCACertificates in fetchCurl
ardatan
committed
9217ac6
fix: preserve NODE_EXTRA_CA_CERTS when getCACertificates is unavailable
ardatan
committed
f962c78
docs: note when getCACertificates fallback can be removed
ardatan
committed
58c1317
changeset: document libcurl default CA store alignment
ardatan
committed
64898ed
docs(test): note Bun may expose setDefaultCACertificates
ardatan
committed
7db01c2
fix(test): support node:https on Deno via openssl CA and createHttpClient
ardatan
committed
7577dfc
fix(test): skip node:https on Deno and fix raw http clients for TLS
ardatan
committed
31aa3a0
fix(test): type requestForUrl with http.RequestOptions
ardatan
committed
d9b2cc4
fix(test): include ::1 in ephemeral TLS cert SAN for ipv6 tests
ardatan
committed
986456b
fix(test): soft-skip external HTTPS connectivity errors and clarify CA docs
ardatan
committed
40265e2
fix(test): skip ipv6 checks on node:https due to Node TLS SAN regression
ardatan
committed
9ba05b7
fix(node-fetch): verify IPv6 IP SANs in node-http HTTPS ponyfill
ardatan
committed
350d848
perf(node-fetch): apply IPv6 SAN workaround only when Node probe fails
ardatan
committed
ed3d981
perf(node-fetch): probe IPv6 SAN workaround lazily on first HTTPS use
ardatan
committed
4ae4e57
fix(server): trim Accept-Encoding / Content-Encoding tokens
ardatan
committed
8116a51
fix(test): soft-skip flaky github.com http→https redirect
ardatan
committed
0e0f9a9
fix(test): replace github.com redirect with local http→https servers
ardatan
committed
acd7830
revert(test): restore intentional github.com http→https redirect check
ardatan
committed
1c03a6e

Navigation Menu

Uh oh!

fix: harden HTTPS CA trust, IPv6 verification, and content-encoding parsing - #3504

fix: harden HTTPS CA trust, IPv6 verification, and content-encoding parsing#3504
ardatan merged 22 commits into
masterfrom
fix/bun-https-cleanup-timeout

Commits on Aug 12, 2026

fix(test): use local HTTPS server for cleanup resource test

fix(test): add node:https TestServer and harden curl CA loading

fix(test): gate node:https on CA APIs and preserve URL protocol for ipv6

revert: keep fetchCurl CA loading unchanged

refactor: trust CAs via tls.getCACertificates in fetchCurl

fix: preserve NODE_EXTRA_CA_CERTS when getCACertificates is unavailable

docs: note when getCACertificates fallback can be removed

changeset: document libcurl default CA store alignment

docs(test): note Bun may expose setDefaultCACertificates

fix(test): support node:https on Deno via openssl CA and createHttpClient

fix(test): skip node:https on Deno and fix raw http clients for TLS

fix(test): type requestForUrl with http.RequestOptions

fix(test): include ::1 in ephemeral TLS cert SAN for ipv6 tests

fix(test): soft-skip external HTTPS connectivity errors and clarify CA docs

fix(test): skip ipv6 checks on node:https due to Node TLS SAN regression

fix(node-fetch): verify IPv6 IP SANs in node-http HTTPS ponyfill

perf(node-fetch): apply IPv6 SAN workaround only when Node probe fails

perf(node-fetch): probe IPv6 SAN workaround lazily on first HTTPS use

fix(server): trim Accept-Encoding / Content-Encoding tokens

fix(test): soft-skip flaky github.com http→https redirect

fix(test): replace github.com redirect with local http→https servers

revert(test): restore intentional github.com http→https redirect check