fix: handle frozen globalThis in setGlobalDispatcher

[mhayk]

Problem

When Object.freeze(globalThis) is called before undici globals are accessed for the first time, the lazy initialisation inside setGlobalDispatcher throws:

TypeError: Cannot define property Symbol(undici.globalDispatcher.2),
           object is not extensible

This is particularly problematic because the Node.js security best practices guide explicitly recommends Object.freeze(globalThis) as a defence against monkey-patching (CWE-349).

Root Cause

setGlobalDispatcher unconditionally calls Object.defineProperty(globalThis, ...). When globalThis is not extensible, the call throws instead of degrading gracefully.

Solution

Wrap the Object.defineProperty calls in setGlobalDispatcher with a try/catch. When globalThis is not extensible the dispatcher is stored in a module-level fallback variable. getGlobalDispatcher is updated to return globalThis[symbol] ?? fallbackDispatcher so the normal (extensible) path is unchanged.

Testing

A test verifies that:

1. setGlobalDispatcher succeeds even with frozen globalThis
2. getGlobalDispatcher returns the correct dispatcher
3. The fallback mechanism works correctly

[mcollina]

Thanks for opening a PR! Can you please add a unit test?

[mhayk]

Thanks for the feedback! I've now added comprehensive unit tests as requested:

• Test 1: Verifies that setGlobalDispatcher does not throw when globalThis is frozen
• Test 2: Verifies that getGlobalDispatcher continues to return a valid dispatcher with frozen globalThis

The tests are in the new file test/global-frozen.js and verify the fallback mechanism works correctly.

Tests now passing ✅

[mcollina]

please use t.plan()

[codecov-commenter]

Codecov Report

❌ Patch coverage is 80.55556% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.46%. Comparing base (1383989) to head (73a96f6).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/global.js	80.55%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5574      +/-   ##
==========================================
- Coverage   93.47%   93.46%   -0.01%     
==========================================
  Files         110      110              
  Lines       37560    37581      +21     
==========================================
+ Hits        35108    35124      +16     
- Misses       2452     2457       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mhayk]

I've improved the test coverage with more comprehensive test cases:

• ✅ Test 1: Verifies setGlobalDispatcher succeeds without throwing
• ✅ Test 2: Verifies getGlobalDispatcher works correctly with frozen globalThis
• ✅ Test 3: Verifies fallback dispatcher persists across multiple calls

All tests passing. Tests follow undici conventions using tspl.

[mcollina]

lgtm