build(deps): bump node-libcurl from 4.1.0 to 5.1.2 by dependabot[bot] · Pull Request #3445 · ardatan/whatwg-node

dependabot · 2026-06-26T23:37:20Z

Bumps node-libcurl from 4.1.0 to 5.1.2.

Release notes

v5.1.2

Fixed

Fixed Windows source builds against Node.js 26 failing with LINK : fatal error LNK1117: syntax error in option 'opt:lldltojobs=2'. Node 26 was built with clang-cl + lld + ThinLTO (PR nodejs/node#63114, released in v26.3.0), and node-gyp's create-config-gypi.js seeds the addon's config.gypi from process.config of the running Node binary — picking up enable_thin_lto: true and lto_jobs: <n> from how Node itself was built. Node's installed common.gypi then unconditionally appends -flto=thin to MSVC cl.exe's AdditionalOptions and /opt:lldltojobs=<n> to link.exe's. MSVC ignores -flto=thin (warning) but rejects /opt:lldltojobs=<n> because /OPT: only accepts REF/ICF/NOREF/NOICF/LBR/NOLBR. Force them off via npm_config_enable_thin_lto=false + npm_config_enable_lto=false in the Windows build script, which node-gyp forwards as -Denable_thin_lto=false gyp defines (top precedence — binding.gyp variables don't override config.gypi's, they're a separate gyp scope).

v5.1.1

Fixed

Fixed Windows source builds linking against libidn2 (and its libunistring transitive dep) instead of using the Windows-native WinIDN backed by Normaliz.lib. The vcpkg manifest was requesting both the idn and idn2 curl features, which forced vcpkg's curl port to pull libidn2 in; only idn is needed and lets the port pick WinIDN on Windows. Smaller binary, fewer transitive deps.

Fixed Windows source builds failing in deeply-nested consumer paths (typical of pnpm v10 monorepos) with CreateProcessW failed with 206 (The filename or extension is too long). vcpkg's bundled pwsh.exe sits at vcpkg/downloads/tools/powershell-core-<ver>-windows/pwsh.exe — easy to push past Windows' MAX_PATH from inside a deep node_modules/.pnpm/ tree. vcpkg's clone now goes to %LOCALAPPDATA%\node-libcurl-vcpkg\<moduleRootHash>\ regardless of where the package lives, so the toolchain's internal paths stay short.

Fixed Windows source builds failing with pkg-config: 'libcrypto'/'zlib' not found while building libssh2 in nested consumer paths. vcpkg_installed was also being written inside the deep module root, and msys2 pkg-config's PKG_CONFIG_PATH parsing tripped over both the path length and the drive-letter colon. vcpkg_installed now goes to %LOCALAPPDATA%\node-libcurl-vcpkg\<hash>-installed via --x-install-root, and vcpkg-get-info.js resolves against that path so binding.gyp still finds the libs.

Fixed vcpkg.exe's git clone failing with Filename too long while writing pack .keep files on deep paths. The clone now passes git -c core.longpaths=true.

Propagate VCPKG_DISABLE_METRICS=1 to all vcpkg subprocess invocations from scripts/vcpkg-setup.js (it was being set in the env action but lost when the install script spawned vcpkg.exe).

Changed

A consumer install of node-libcurl under pnpm v10 now requires opting node-libcurl's lifecycle scripts in via pnpm.onlyBuiltDependencies: ["node-libcurl"] in the consumer's package.json (or pnpm add --allow-build=node-libcurl). pnpm v10's default scripts-off policy otherwise leaves the package installed but non-functional — no vcpkg setup, no native addon build. This isn't a node-libcurl change per se, but is now exercised by the new windows-consumer-install CI workflow so the regression-protected path is documented.

v5.1.0

Fixed

Fixed Curl.perform() intermittently throwing CurlMultiError: Could not remove easy handle from multi handle.: API function called from within callback (CURLM_RECURSIVE_API_CALL) under concurrent load, particularly visible on Alpine. The regression came from v5.0.0 enabling libcurl 8.17's new CURLMOPT_NOTIFYFUNCTION API, which fires from inside curl_multi_socket_action. The notification resolved the perform-promise synchronously, and the resulting .then() microtask called curl_multi_remove_handle while libcurl was still on its own call stack. The removal is now deferred via setImmediate so libcurl can unwind first. (fixes #439)

Fixed macOS x64 prebuilt binary tarballs containing an arm64 binary instead of x86_64. The universal build packaging in scripts/ci/build.sh was extracting both architectures to the same output file before either was packaged, so the second lipo extraction overwrote the first. This affected all macOS releases since v5.0.0. (#446, fixes #445)

Fixed CurlMimePart#setDataStream hanging on Linux when libcurl needed a second read callback after the stream emitted its initial data. The mime read callback wasn't tracking CURLPAUSE_SEND state after returning CURL_READFUNC_PAUSE, so isPausedSend stayed false and the test/example unpause callbacks were silent no-ops. The unpause is now also deferred via setImmediate to avoid re-entering libcurl while it's still processing the pause. (#448)

Fixed vcpkg build failures when the exact OpenSSL version bundled with Node.js isn't present in the vcpkg registry. The build now resolves to the closest compatible version (preferring a newer patch on the same minor line, falling back to the closest lower patch, then the next minor) with a clear warning about the substitution. (#447)

Fixed Alpine CI builds failing with fatal error: ngtcp2/ngtcp2_crypto_quictls.h: No such file or directory after the ngtcp2 1.17.0 + OpenSSL 3.5+ combination switched to the new libngtcp2_crypto_ossl backend. Added the statically-built OpenSSL's pkgconfig dir to PKG_CONFIG_PATH so libcurl's probe for libngtcp2_crypto_ossl can resolve its Requires: libcrypto on systems without system OpenSSL.

Fixed Windows CI builds failing with Could not find any Visual Studio installation to use after GitHub started serving Visual Studio 2026 (v145) on the windows-2025 runner ahead of the official 2026-06-15 migration. The build script no longer pins msvs_version=2022, letting node-gyp 12.1.0+ auto-detect whichever supported MSVC toolset is installed.

Added

Node.js 26 to the CI matrix. Prebuilt binaries are now published for Node 26 alongside the existing 22, 24, and 25 versions.

Changed

Bumped node-gyp from 11.4.2 to 12.3.0 and @mapbox/node-pre-gyp from 2.0.0 to 2.0.3. node-gyp v12.1.0+ adds Visual Studio 2026 detection support. The only node-gyp v12 breaking change (engine range bumped to ^20.17.0 || >=22.9.0) does not affect this project, which already requires Node.js ≥ 22.20.0.

Bumped Alpine container image from alpine3.21 to alpine3.22 so the Node.js 26 image variant is available (node:26-alpine3.21 is not published). Musl is 1.2.5 across Alpine 3.20–3.23, so the prebuilt binary remains runtime-compatible on Alpine 3.21.

The unpause callback documentation and examples for CurlMimePart#setDataStream and Easy#setMimePost now correctly reference CurlPause.Send instead of CurlPause.Recv. Mime upload data is supplied via the read callback, so pausing affects CURLPAUSE_SEND. (#448)

v5.0.2

Fixed

Fixed the types on the FileInfo object. With 5.0.0, the properties were changed to be all in lowercase, to follow the libcurl struct more closely.

v5.0.1

Fixed

Building from source on macOS would not work properly.

v5.0.0

Breaking Change
The prebuilt binary is now built with libcurl 8.17.0. Every breaking change introduced by libcurl 8 is also a breaking change for this version.
Version: libcurl/8.17.0 OpenSSL/3.5.2 zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 libidn2/2.1.1 libssh2/1.10.0 nghttp2/1.66.0 ngtcp2/1.17.0 nghttp3/1.12.0 OpenLDAP/2.6.9
Protocols: dict, file, ftp, ftps, gopher, gophers, http, https, imap, imaps, ldap, ldaps, mqtt, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp, ws, wss
Features: AsynchDNS, IDN, IPv6, Largefile, NTLM, SSL, libz, brotli, TLS-SRP, HTTP2, UnixSockets, HTTPS-proxy, alt-svc
Minimum supported Electron version is now Electron v38.0.0 (moving forward prebuilt binaries will only be available for the latest 2 versions of Electron).

... (truncated)

Changelog

Sourced from node-libcurl's changelog.

[5.1.2] - 2026-06-08

Fixed

Fixed Windows source builds against Node.js 26 failing with LINK : fatal error LNK1117: syntax error in option 'opt:lldltojobs=2'. Node 26 was built with clang-cl + lld + ThinLTO (PR nodejs/node#63114, released in v26.3.0), and node-gyp's create-config-gypi.js seeds the addon's config.gypi from process.config of the running Node binary — picking up enable_thin_lto: true and lto_jobs: <n> from how Node itself was built. Node's installed common.gypi then unconditionally appends -flto=thin to MSVC cl.exe's AdditionalOptions and /opt:lldltojobs=<n> to link.exe's. MSVC ignores -flto=thin (warning) but rejects /opt:lldltojobs=<n> because /OPT: only accepts REF/ICF/NOREF/NOICF/LBR/NOLBR. Force them off via npm_config_enable_thin_lto=false + npm_config_enable_lto=false in the Windows build script, which node-gyp forwards as -Denable_thin_lto=false gyp defines (top precedence — binding.gyp variables don't override config.gypi's, they're a separate gyp scope).

[5.1.1] - 2026-06-05

Fixed

Fixed Windows source builds linking against libidn2 (and its libunistring transitive dep) instead of using the Windows-native WinIDN backed by Normaliz.lib. The vcpkg manifest was requesting both the idn and idn2 curl features, which forced vcpkg's curl port to pull libidn2 in; only idn is needed and lets the port pick WinIDN on Windows. Smaller binary, fewer transitive deps.

Fixed Windows source builds failing in deeply-nested consumer paths (typical of pnpm v10 monorepos) with CreateProcessW failed with 206 (The filename or extension is too long). vcpkg's bundled pwsh.exe sits at vcpkg/downloads/tools/powershell-core-<ver>-windows/pwsh.exe — easy to push past Windows' MAX_PATH from inside a deep node_modules/.pnpm/ tree. vcpkg's clone now goes to %LOCALAPPDATA%\node-libcurl-vcpkg\<moduleRootHash>\ regardless of where the package lives, so the toolchain's internal paths stay short.

Fixed Windows source builds failing with pkg-config: 'libcrypto'/'zlib' not found while building libssh2 in nested consumer paths. vcpkg_installed was also being written inside the deep module root, and msys2 pkg-config's PKG_CONFIG_PATH parsing tripped over both the path length and the drive-letter colon. vcpkg_installed now goes to %LOCALAPPDATA%\node-libcurl-vcpkg\<hash>-installed via --x-install-root, and vcpkg-get-info.js resolves against that path so binding.gyp still finds the libs.

Fixed vcpkg.exe's git clone failing with Filename too long while writing pack .keep files on deep paths. The clone now passes git -c core.longpaths=true.

Propagate VCPKG_DISABLE_METRICS=1 to all vcpkg subprocess invocations from scripts/vcpkg-setup.js (it was being set in the env action but lost when the install script spawned vcpkg.exe).

Changed

A consumer install of node-libcurl under pnpm v10 now requires opting node-libcurl's lifecycle scripts in via pnpm.onlyBuiltDependencies: ["node-libcurl"] in the consumer's package.json (or pnpm add --allow-build=node-libcurl). pnpm v10's default scripts-off policy otherwise leaves the package installed but non-functional — no vcpkg setup, no native addon build. This isn't a node-libcurl change per se, but is now exercised by the new windows-consumer-install CI workflow so the regression-protected path is documented.

[5.1.0] - 2026-05-31

Fixed

Fixed Curl.perform() intermittently throwing CurlMultiError: Could not remove easy handle from multi handle.: API function called from within callback (CURLM_RECURSIVE_API_CALL) under concurrent load, particularly visible on Alpine. The regression came from v5.0.0 enabling libcurl 8.17's new CURLMOPT_NOTIFYFUNCTION API, which fires from inside curl_multi_socket_action. The notification resolved the perform-promise synchronously, and the resulting .then() microtask called curl_multi_remove_handle while libcurl was still on its own call stack. The removal is now deferred via setImmediate so libcurl can unwind first. (fixes #439)

Fixed macOS x64 prebuilt binary tarballs containing an arm64 binary instead of x86_64. The universal build packaging in scripts/ci/build.sh was extracting both architectures to the same output file before either was packaged, so the second lipo extraction overwrote the first. This affected all macOS releases since v5.0.0. (#446, fixes #445)

Fixed CurlMimePart#setDataStream hanging on Linux when libcurl needed a second read callback after the stream emitted its initial data. The mime read callback wasn't tracking CURLPAUSE_SEND state after returning CURL_READFUNC_PAUSE, so isPausedSend stayed false and the test/example unpause callbacks were silent no-ops. The unpause is now also deferred via setImmediate to avoid re-entering libcurl while it's still processing the pause. (#448)

Fixed vcpkg build failures when the exact OpenSSL version bundled with Node.js isn't present in the vcpkg registry. The build now resolves to the closest compatible version (preferring a newer patch on the same minor line, falling back to the closest lower patch, then the next minor) with a clear warning about the substitution. (#447)

Fixed Alpine CI builds failing with fatal error: ngtcp2/ngtcp2_crypto_quictls.h: No such file or directory after the ngtcp2 1.17.0 + OpenSSL 3.5+ combination switched to the new libngtcp2_crypto_ossl backend. Added the statically-built OpenSSL's pkgconfig dir to PKG_CONFIG_PATH so libcurl's probe for libngtcp2_crypto_ossl can resolve its Requires: libcrypto on systems without system OpenSSL.

Fixed Windows CI builds failing with Could not find any Visual Studio installation to use after GitHub started serving Visual Studio 2026 (v145) on the windows-2025 runner ahead of the official 2026-06-15 migration. The build script no longer pins msvs_version=2022, letting node-gyp 12.1.0+ auto-detect whichever supported MSVC toolset is installed.

Added

Node.js 26 to the CI matrix. Prebuilt binaries are now published for Node 26 alongside the existing 22, 24, and 25 versions.

Changed

Bumped node-gyp from 11.4.2 to 12.3.0 and @mapbox/node-pre-gyp from 2.0.0 to 2.0.3. node-gyp v12.1.0+ adds Visual Studio 2026 detection support. The only node-gyp v12 breaking change (engine range bumped to ^20.17.0 || >=22.9.0) does not affect this project, which already requires Node.js ≥ 22.20.0.

Bumped Alpine container image from alpine3.21 to alpine3.22 so the Node.js 26 image variant is available (node:26-alpine3.21 is not published). Musl is 1.2.5 across Alpine 3.20–3.23, so the prebuilt binary remains runtime-compatible on Alpine 3.21.

The unpause callback documentation and examples for CurlMimePart#setDataStream and Easy#setMimePost now correctly reference CurlPause.Send instead of CurlPause.Recv. Mime upload data is supplied via the read callback, so pausing affects CURLPAUSE_SEND. (#448)

[5.0.2] - 2026-01-15

Fixed

Fixed the types on the FileInfo object. With 5.0.0, the properties were changed to be all in lowercase, to follow the libcurl struct more closely.

[5.0.1] - 2025-11-13

Fixed

Building from source on macOS would not work properly.

[5.0.0] - 2025-01-13

Breaking Change
The prebuilt binary is now built with libcurl 8.17.0. Every breaking change introduced by libcurl 8 is also a breaking change for this version.

... (truncated)

Commits

1e0bbef 5.1.2
4d0f347 chore: prepare CHANGELOG for v5.1.2 release
82ba321 Merge branch 'develop' into master for v5.1.2
2c28d96 fix: disable LTO/ThinLTO via gyp -D flags for Node 26 Windows builds
a222989 fix: disable LTO/ThinLTO in binding.gyp for Windows + Node 26 builds
2d8588b 5.1.1
5d5e0cb chore: prepare CHANGELOG for v5.1.1 release
2831f10 Merge branch 'develop' into master for v5.1.1
7670677 ci: reduce consumer test nesting from 12 to 4 to fit MSVC c1xx MAX_PATH [skip...
11a13a8 ci: actually fail the consumer test when the install fails [skip ci]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for node-libcurl since your current version.

Install script changes

This version adds preinstall script that runs during installation. Review the package contents before updating.

github-actions · 2026-07-02T17:37:48Z

✅ `@benchmarks/node-fetch` results (noConsumeBody)

   ✓ active_handles.................: avg=136.965592 min=42       med=136     max=199      p(90)=160     p(95)=166    
     data_received..................: 28 MB  946 kB/s
     data_sent......................: 18 MB  612 kB/s
     http_req_blocked...............: avg=2.47µs     min=390ns    med=1.16µs  max=3.78ms   p(90)=1.84µs  p(95)=2.18µs 
     http_req_connecting............: avg=770ns      min=0s       med=0s      max=3.74ms   p(90)=0s      p(95)=0s     
     http_req_duration..............: avg=16.11ms    min=591.85µs med=15.4ms  max=826.72ms p(90)=21.87ms p(95)=25.45ms
       { expected_response:true }...: avg=16.11ms    min=591.85µs med=15.4ms  max=826.72ms p(90)=21.87ms p(95)=25.45ms
     http_req_failed................: 0.00%  ✓ 0           ✗ 185455
     http_req_receiving.............: avg=40.1µs     min=7.52µs   med=21.02µs max=22.06ms  p(90)=39.86µs p(95)=53.73µs
     http_req_sending...............: avg=12.89µs    min=2.2µs    med=6.27µs  max=19.92ms  p(90)=10.22µs p(95)=17.57µs
     http_req_tls_handshaking.......: avg=0s         min=0s       med=0s      max=0s       p(90)=0s      p(95)=0s     
     http_req_waiting...............: avg=16.06ms    min=563.42µs med=15.35ms max=826.62ms p(90)=21.81ms p(95)=25.31ms
     http_reqs......................: 185455 6180.580175/s
     iteration_duration.............: avg=32.32ms    min=9.23ms   med=30.82ms max=843.91ms p(90)=38.68ms p(95)=41.77ms
     iterations.....................: 92712  3089.773525/s
     vus............................: 100    min=100       max=100 
     vus_max........................: 100    min=100       max=100

github-actions · 2026-07-02T17:37:55Z

✅ `@benchmarks/node-fetch` results (consumeBody)

   ✓ active_handles.................: avg=139.774723 min=28      med=139     max=193     p(90)=159     p(95)=164    
     data_received..................: 22 MB  748 kB/s
     data_sent......................: 14 MB  479 kB/s
     http_req_blocked...............: avg=3.45µs     min=561ns   med=1.6µs   max=7.88ms  p(90)=2.18µs  p(95)=2.61µs 
     http_req_connecting............: avg=1.29µs     min=0s      med=0s      max=4.38ms  p(90)=0s      p(95)=0s     
     http_req_duration..............: avg=20.39ms    min=5.02ms  med=19.43ms max=1.04s   p(90)=26.28ms p(95)=31.96ms
       { expected_response:true }...: avg=20.39ms    min=5.02ms  med=19.43ms max=1.04s   p(90)=26.28ms p(95)=31.96ms
     http_req_failed................: 0.00%  ✓ 0           ✗ 146621
     http_req_receiving.............: avg=37.25µs    min=8.48µs  med=23.98µs max=17.3ms  p(90)=42.76µs p(95)=55.44µs
     http_req_sending...............: avg=12.21µs    min=2.89µs  med=7.44µs  max=28.33ms p(90)=11.84µs p(95)=19.09µs
     http_req_tls_handshaking.......: avg=0s         min=0s      med=0s      max=0s      p(90)=0s      p(95)=0s     
     http_req_waiting...............: avg=20.34ms    min=4.89ms  med=19.38ms max=1.04s   p(90)=26.22ms p(95)=31.89ms
     http_reqs......................: 146621 4886.804427/s
     iteration_duration.............: avg=40.89ms    min=18.63ms med=38.84ms max=1.07s   p(90)=48.6ms  p(95)=52.22ms
     iterations.....................: 73283  2442.485652/s
     vus............................: 100    min=100       max=100 
     vus_max........................: 100    min=100       max=100

github-actions · 2026-07-02T17:38:49Z

✅ `@benchmarks/server` results (native)

     ✓ response code was 200
     ✓ valid response structure

   ✓ checks.........................: 100.00% ✓ 638316      ✗ 0     
     data_received..................: 64 MB   706 kB/s
     data_sent......................: 48 MB   528 kB/s
     http_req_blocked...............: avg=1.17µs   min=832ns    med=1.04µs   max=291.72µs p(90)=1.27µs   p(95)=1.51µs  
     http_req_connecting............: avg=0ns      min=0s       med=0s       max=149.52µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=227.2µs  min=180.88µs med=216.45µs max=11.3ms   p(90)=245.77µs p(95)=258.1µs 
       { expected_response:true }...: avg=227.2µs  min=180.88µs med=216.45µs max=11.3ms   p(90)=245.77µs p(95)=258.1µs 
     http_req_failed................: 0.00%   ✓ 0           ✗ 319158
     http_req_receiving.............: avg=26.08µs  min=14.41µs  med=25.72µs  max=5.43ms   p(90)=28.96µs  p(95)=31.18µs 
     http_req_sending...............: avg=6.62µs   min=5.09µs   med=5.76µs   max=5.42ms   p(90)=7.04µs   p(95)=8.04µs  
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=194.49µs min=148.41µs med=183.95µs max=11.22ms  p(90)=212.38µs p(95)=222.35µs
     http_reqs......................: 319158  3546.187414/s
     iteration_duration.............: avg=276.79µs min=223.66µs med=264.81µs max=11.42ms  p(90)=301.34µs p(95)=317.96µs
     iterations.....................: 319158  3546.187414/s
     vus............................: 1       min=1         max=1   
     vus_max........................: 1       min=1         max=1

github-actions · 2026-07-02T17:38:53Z

✅ `@benchmarks/server` results (ponyfill)

     ✓ response code was 200
     ✓ valid response structure

   ✓ checks.........................: 100.00% ✓ 1675450     ✗ 0     
     data_received..................: 165 MB  1.8 MB/s
     data_sent......................: 125 MB  1.4 MB/s
     http_req_blocked...............: avg=664ns    min=299ns   med=532ns   max=6.04ms   p(90)=932ns    p(95)=1.13µs  
     http_req_connecting............: avg=0ns      min=0s      med=0s      max=135.56µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=75.91µs  min=40.49µs med=70.11µs max=7ms      p(90)=90.54µs  p(95)=102.3µs 
       { expected_response:true }...: avg=75.91µs  min=40.49µs med=70.11µs max=7ms      p(90)=90.54µs  p(95)=102.3µs 
     http_req_failed................: 0.00%   ✓ 0           ✗ 837725
     http_req_receiving.............: avg=13.36µs  min=4.97µs  med=11.74µs max=5.95ms   p(90)=18.99µs  p(95)=23.12µs 
     http_req_sending...............: avg=3.29µs   min=1.91µs  med=2.66µs  max=6.58ms   p(90)=5.04µs   p(95)=6.38µs  
     http_req_tls_handshaking.......: avg=0s       min=0s      med=0s      max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=59.25µs  min=31.67µs med=54.98µs max=5.25ms   p(90)=69.06µs  p(95)=77.85µs 
     http_reqs......................: 837725  9308.047082/s
     iteration_duration.............: avg=104.45µs min=60.87µs med=95.24µs max=7.17ms   p(90)=129.03µs p(95)=144.96µs
     iterations.....................: 837725  9308.047082/s
     vus............................: 1       min=1         max=1   
     vus_max........................: 1       min=1         max=1

github-actions · 2026-07-02T17:38:54Z

✅ `@benchmarks/server` results (undici)

     ✓ response code was 200
     ✓ valid response structure

   ✓ checks.........................: 100.00% ✓ 613366      ✗ 0     
     data_received..................: 61 MB   678 kB/s
     data_sent......................: 46 MB   508 kB/s
     http_req_blocked...............: avg=1.21µs   min=862ns    med=1.06µs   max=235.86µs p(90)=1.28µs   p(95)=1.55µs  
     http_req_connecting............: avg=0ns      min=0s       med=0s       max=135.21µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=238.43µs min=191.21µs med=227.64µs max=17.33ms  p(90)=254.95µs p(95)=268.49µs
       { expected_response:true }...: avg=238.43µs min=191.21µs med=227.64µs max=17.33ms  p(90)=254.95µs p(95)=268.49µs
     http_req_failed................: 0.00%   ✓ 0           ✗ 306683
     http_req_receiving.............: avg=26.36µs  min=14.56µs  med=26µs     max=2.57ms   p(90)=29.06µs  p(95)=31.53µs 
     http_req_sending...............: avg=6.75µs   min=5.08µs   med=5.79µs   max=4.37ms   p(90)=7.19µs   p(95)=8.46µs  
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=205.3µs  min=158.18µs med=195.34µs max=17.24ms  p(90)=220.92µs p(95)=232.35µs
     http_reqs......................: 306683  3407.580415/s
     iteration_duration.............: avg=288.29µs min=236.96µs med=276.57µs max=17.5ms   p(90)=310.99µs p(95)=328.2µs 
     iterations.....................: 306683  3407.580415/s
     vus............................: 1       min=1         max=1   
     vus_max........................: 1       min=1         max=1

github-actions · 2026-07-02T17:38:55Z

✅ `@benchmarks/server` results (vanilla)

     ✓ response code was 200
     ✓ valid response structure

   ✓ checks.........................: 100.00% ✓ 856624      ✗ 0     
     data_received..................: 78 MB   866 kB/s
     data_sent......................: 64 MB   709 kB/s
     http_req_blocked...............: avg=1.25µs   min=831ns    med=1.07µs   max=1.2ms    p(90)=1.58µs   p(95)=1.74µs  
     http_req_connecting............: avg=0ns      min=0s       med=0s       max=112.92µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=151.34µs min=107.83µs med=148.43µs max=5.61ms   p(90)=171.2µs  p(95)=178.51µs
       { expected_response:true }...: avg=151.34µs min=107.83µs med=148.43µs max=5.61ms   p(90)=171.2µs  p(95)=178.51µs
     http_req_failed................: 0.00%   ✓ 0           ✗ 428312
     http_req_receiving.............: avg=23.15µs  min=11.95µs  med=23.39µs  max=5.47ms   p(90)=28.99µs  p(95)=33.04µs 
     http_req_sending...............: avg=7.24µs   min=4.92µs   med=6.31µs   max=5.29ms   p(90)=9.06µs   p(95)=10.51µs 
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=120.94µs min=81.04µs  med=117.55µs max=5.25ms   p(90)=136.76µs p(95)=143.45µs
     http_reqs......................: 428312  4759.014355/s
     iteration_duration.............: avg=204.74µs min=149.94µs med=203.11µs max=8.64ms   p(90)=230.12µs p(95)=240.15µs
     iterations.....................: 428312  4759.014355/s
     vus............................: 1       min=1         max=1   
     vus_max........................: 1       min=1         max=1

github-actions · 2026-07-02T17:38:59Z

✅ `@benchmarks/server` results (uws)

     ✓ response code was 200
     ✓ valid response structure

   ✓ checks.........................: 100.00% ✓ 1171924     ✗ 0     
     data_received..................: 98 MB   1.1 MB/s
     data_sent......................: 87 MB   970 kB/s
     http_req_blocked...............: avg=986ns    min=394ns   med=869ns    max=395.48µs p(90)=1.31µs   p(95)=1.55µs  
     http_req_connecting............: avg=0ns      min=0s      med=0s       max=333.5µs  p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=107.66µs min=50.14µs med=96.3µs   max=11.78ms  p(90)=135.82µs p(95)=158.44µs
       { expected_response:true }...: avg=107.66µs min=50.14µs med=96.3µs   max=11.78ms  p(90)=135.82µs p(95)=158.44µs
     http_req_failed................: 0.00%   ✓ 0           ✗ 585962
     http_req_receiving.............: avg=17.3µs   min=5.32µs  med=14.19µs  max=5.6ms    p(90)=28.5µs   p(95)=32.55µs 
     http_req_sending...............: avg=4.91µs   min=2.29µs  med=4.05µs   max=6.41ms   p(90)=7.09µs   p(95)=8.83µs  
     http_req_tls_handshaking.......: avg=0s       min=0s      med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=85.45µs  min=38.12µs med=75.31µs  max=11.74ms  p(90)=107.21µs p(95)=127.16µs
     http_reqs......................: 585962  6510.673773/s
     iteration_duration.............: avg=149.53µs min=73.76µs med=137.22µs max=11.86ms  p(90)=187.74µs p(95)=214.85µs
     iterations.....................: 585962  6510.673773/s
     vus............................: 1       min=1         max=1   
     vus_max........................: 1       min=1         max=1

ardatan · 2026-07-03T12:47:11Z

@copilot resolve the merge conflicts in this pull request

Copilot · 2026-07-03T12:58:48Z

@copilot resolve the merge conflicts in this pull request

Resolved in c3222e3.

ardatan · 2026-07-13T16:21:08Z

@dependabot recreate

dependabot · 2026-07-13T16:31:59Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Bumps [node-libcurl](https://github.com/JCMais/node-libcurl) from 4.1.0 to 5.1.2. - [Release notes](https://github.com/JCMais/node-libcurl/releases) - [Changelog](https://github.com/JCMais/node-libcurl/blob/develop/CHANGELOG.md) - [Commits](JCMais/node-libcurl@v4.1.0...v5.1.2) --- updated-dependencies: - dependency-name: node-libcurl dependency-version: 5.1.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

node-libcurl 5 / libcurl 8 no longer tears down the TCP connection when pausing receive, so AbortSignal never reached the server and left open handles that broke Jest leak detection. Co-authored-by: Cursor <cursoragent@cursor.com>

Bun exercises native fetch on this path, and httpbin.org HTTPS hangs from GitHub Actions runners. Co-authored-by: Cursor <cursoragent@cursor.com>

node-libcurl 5 leaves a process-wide Multi that cannot be cleaned up (globalCleanup is a noop), which makes --detectLeaks fail for any suite that exercises it. Unit tests still cover the libcurl path. Co-authored-by: Cursor <cursoragent@cursor.com>

Stop short-circuiting to native Blobs, wrap native streams, and destroy body readers when collection finishes so Jest leak detection can GC. Co-authored-by: Cursor <cursoragent@cursor.com>

The package main entry eagerly requires node-libcurl, which reinstates the shared Multi even when Jest itself skips loading it for LEAK_TEST. Co-authored-by: Cursor <cursoragent@cursor.com>

libcurl 8 rejects the self-signed cert used by the http2 suite unless verification is disabled for that test. External httpbin HTTPS is skipped in CI in favor of the local httpbin service. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Re-enable libcurl for Jest --detectLeaks. node-libcurl 5 made Curl.globalCleanup() a noop, so patch it to close the default Multi (lazy-created) and drain deferred cleanup after libcurl suites. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

node-libcurl 5 only installs on supported Node versions; patch-package must not fail CI on older runtimes where the optional dependency is missing. Co-authored-by: Cursor <cursoragent@cursor.com>

Skipping these cases under LEAK_TEST hides real registry/blob leaks; rely on revokeObjectURL cleanup instead. Co-authored-by: Cursor <cursoragent@cursor.com>

Multi.close() in v5 stops the timeout but leaves the uv handle and ObjectWrap Ref alive, which pins Jest --detectLeaks isolates. Call CloseTimerAsync via a small N-API helper after dispose. Co-authored-by: Cursor <cursoragent@cursor.com>

Silent no-op left Jest detectLeaks red when the addon failed to load. Co-authored-by: Cursor <cursoragent@cursor.com>

Use Curl.setMulti with a package-owned Multi and release its uv timer via CloseTimerAsync so Jest --detectLeaks can collect suites that use libcurl. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Closing Multi while Easy handles are still draining leaves uv/socket state that pins Jest --detectLeaks isolates. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Duplicate CJS/ESM module instances under Jest left dispose unable to see the Multi created by fetchCurl, so CloseTimerAsync never ran. Co-authored-by: Cursor <cursoragent@cursor.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 26, 2026

ardatan force-pushed the master branch from a8643d9 to 56e2dbe Compare June 27, 2026 10:20

dependabot Bot force-pushed the dependabot/npm_and_yarn/node-libcurl-5.1.2 branch 3 times, most recently from 18d44d4 to 14555a4 Compare July 1, 2026 15:33

Copilot started work on behalf of ardatan July 2, 2026 17:12 View session

Copilot AI requested a review from ardatan July 2, 2026 17:35

Copilot finished work on behalf of ardatan July 2, 2026 17:35

Copilot started work on behalf of ardatan July 3, 2026 12:08 View session

github-advanced-security AI found potential problems Jul 3, 2026

View reviewed changes

Comment thread packages/node-fetch/tests/http2.spec.ts Dismissed

Copilot finished work on behalf of ardatan July 3, 2026 12:15

Copilot started work on behalf of ardatan July 3, 2026 12:53 View session

Copilot finished work on behalf of ardatan July 3, 2026 12:59

Copilot started work on behalf of ardatan July 3, 2026 13:04 View session

Copilot finished work on behalf of ardatan July 3, 2026 13:06

Copilot started work on behalf of ardatan July 3, 2026 13:10 View session

Copilot finished work on behalf of ardatan July 3, 2026 13:12

github-advanced-security AI found potential problems Jul 3, 2026

View reviewed changes

Comment thread packages/node-fetch/tests/http2.spec.ts Fixed

Copilot started work on behalf of ardatan July 4, 2026 00:50 View session

Copilot finished work on behalf of ardatan July 4, 2026 01:43

Copilot started work on behalf of ardatan July 6, 2026 21:25 View session

Copilot finished work on behalf of ardatan July 6, 2026 21:43

Copilot started work on behalf of ardatan July 6, 2026 22:53 View session

Copilot finished work on behalf of ardatan July 6, 2026 22:58

Repository owner deleted a comment from Copilot AI Jul 6, 2026

ardatan force-pushed the dependabot/npm_and_yarn/node-libcurl-5.1.2 branch from e204244 to ad0a4b9 Compare July 14, 2026 11:56

ardatan and others added 6 commits July 14, 2026 15:07

test: skip flaky external https cleanup check on Bun

b189e1d

Bun exercises native fetch on this path, and httpbin.org HTTPS hangs from GitHub Actions runners. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(node-fetch): avoid native Blob stream/reader leaks on Node 24+

7aa5185

Stop short-circuiting to native Blobs, wrap native streams, and destroy body readers when collection finishes so Jest leak detection can GC. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(fetch): do not load node-libcurl during leak tests

6e1722d

The package main entry eagerly requires node-libcurl, which reinstates the shared Multi even when Jest itself skips loading it for LEAK_TEST. Co-authored-by: Cursor <cursoragent@cursor.com>

github-advanced-security AI found potential problems Jul 14, 2026

View reviewed changes

Comment thread packages/node-fetch/tests/http2.spec.ts Fixed

ardatan and others added 12 commits July 14, 2026 17:24

test: use CodeQL line suppression for http2 TLS override

1f71c19

Co-authored-by: Cursor <cursoragent@cursor.com>

chore: drop native binary from node-libcurl patch

58177ac

Co-authored-by: Cursor <cursoragent@cursor.com>

fix: allow postinstall when optional node-libcurl is absent

a37f5be

node-libcurl 5 only installs on supported Node versions; patch-package must not fail CI on older runtimes where the optional dependency is missing. Co-authored-by: Cursor <cursoragent@cursor.com>

test: keep object URL fetch coverage under leak detection

443e72d

Skipping these cases under LEAK_TEST hides real registry/blob leaks; rely on revokeObjectURL cleanup instead. Co-authored-by: Cursor <cursoragent@cursor.com>

fix: fail loudly if libcurl Multi timer helper is missing

db9672d

Silent no-op left Jest detectLeaks red when the addon failed to load. Co-authored-by: Cursor <cursoragent@cursor.com>

fix: dispose app-owned libcurl Multi after tests

b19ff1f

Use Curl.setMulti with a package-owned Multi and release its uv timer via CloseTimerAsync so Jest --detectLeaks can collect suites that use libcurl. Co-authored-by: Cursor <cursoragent@cursor.com>

fix: satisfy TypeScript for shared libcurl Multi getter

cfbf1f9

Co-authored-by: Cursor <cursoragent@cursor.com>

fix: wait for empty libcurl Multi pool before dispose

42454d1

Closing Multi while Easy handles are still draining leaves uv/socket state that pins Jest --detectLeaks isolates. Co-authored-by: Cursor <cursoragent@cursor.com>

fix: use timers/promises setTimeout in libcurl test cleanup

7f7f145

Co-authored-by: Cursor <cursoragent@cursor.com>

fix: share libcurl Multi state on globalThis across module copies

5475512

Duplicate CJS/ESM module instances under Jest left dispose unable to see the Multi created by fetchCurl, so CloseTimerAsync never ran. Co-authored-by: Cursor <cursoragent@cursor.com>

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.1.2

Fixed

v5.1.1

Fixed

Changed

v5.1.0

Fixed

Added

Changed

v5.0.2

Fixed

v5.0.1

Fixed

v5.0.0

Breaking Change

[5.1.2] - 2026-06-08

Fixed

[5.1.1] - 2026-06-05

Fixed

Changed

[5.1.0] - 2026-05-31

Fixed

Added

Changed

[5.0.2] - 2026-01-15

Fixed

[5.0.1] - 2025-11-13

Fixed

[5.0.0] - 2025-01-13

Breaking Change

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ @benchmarks/node-fetch results (noConsumeBody)

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ @benchmarks/node-fetch results (consumeBody)

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ @benchmarks/server results (native)

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ @benchmarks/server results (ponyfill)

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ @benchmarks/server results (undici)

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ @benchmarks/server results (vanilla)

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ @benchmarks/server results (uws)

Uh oh!

Uh oh!

ardatan commented Jul 3, 2026

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

Uh oh!

ardatan commented Jul 13, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dependabot Bot commented on behalf of github Jun 26, 2026 •

edited

Loading

github-actions Bot commented Jul 2, 2026 •

edited

Loading

✅ `@benchmarks/node-fetch` results (noConsumeBody)

github-actions Bot commented Jul 2, 2026 •

edited

Loading

✅ `@benchmarks/node-fetch` results (consumeBody)

github-actions Bot commented Jul 2, 2026 •

edited

Loading

✅ `@benchmarks/server` results (native)

github-actions Bot commented Jul 2, 2026 •

edited

Loading

✅ `@benchmarks/server` results (ponyfill)

github-actions Bot commented Jul 2, 2026 •

edited

Loading

✅ `@benchmarks/server` results (undici)

github-actions Bot commented Jul 2, 2026 •

edited

Loading

✅ `@benchmarks/server` results (vanilla)

github-actions Bot commented Jul 2, 2026 •

edited

Loading

✅ `@benchmarks/server` results (uws)