feat: replace make-fetch-happen with built-in fetch by MarshallOfSound · Pull Request #3302 · nodejs/node-gyp

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

MarshallOfSound · 2026-04-19T10:23:52Z

Swaps make-fetch-happen for Node's built-in fetch, using undici's EnvHttpProxyAgent to keep --proxy / --noproxy / --cafile and the http_proxy / https_proxy / no_proxy env vars working. Drops 36 transitive dependencies.

This results in a ~60+% drop in module "weight" for node-gyp, this one dependency spun out into a bunch of transitive dependencies that we just don't need in node >= 20.

Pinned to undici@^6 because 7.x requires Node >=20.18.1 and we still support 20.17.0. The dispatcher uses CONNECT tunneling for both http and https targets (vs absolute-URI for http previously), real proxies handle this fine, just meant the test fixture needed updating.

Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss · 2026-04-19T10:43:46Z

The Lint Python error was fixed elsewhere.

chore: fix ruff check gyp-next#337

MarshallOfSound · 2026-04-19T11:07:52Z

@cclauss Any action from me? Pretty sure this is fully rebased.

For context on this change, I'm just going on a mission trying to shrink the blast radius of Electron's core dependency tree. Supply Chain Risk mitigation and all that 😅

cclauss · 2026-04-19T11:11:45Z

I like the goal. There is nothing to do on the Lint Python error, but the other GitHub Actions tests need to pass.

Copilot

Pull request overview

This PR replaces make-fetch-happen with Node’s built-in fetch and uses undici’s EnvHttpProxyAgent to preserve proxy and custom CA behavior, reducing transitive dependencies and updating proxy-related test fixtures accordingly.

Changes:

Switch lib/download.js to built-in fetch, adding an undici dispatcher for proxy/CA support and adapting the returned response shape to existing call sites.
Update proxy tests to validate CONNECT-tunneling behavior and assert whether the proxy was actually used.
Replace the make-fetch-happen dependency with undici.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`lib/download.js`	Implements built-in `fetch` + `EnvHttpProxyAgent`, and adapts response handling for existing installer logic.
`test/test-download.js`	Updates proxy tests to use CONNECT tunneling and verifies proxy usage/no-proxy behavior.
`package.json`	Drops `make-fetch-happen` and adds `undici@^6.25.0`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

MarshallOfSound · 2026-04-19T19:45:16Z

@cclauss Current CI failures are the same set fixed by #3300. I think this PR is in a good state

cclauss · 2026-04-19T20:08:10Z

Please fix the Python Lint issue with the f-string solution done in:

chore: fix ruff check gyp-next#337

Please fix the npm issue with the solution in

ci: fix current failures #3300

Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

MarshallOfSound · 2026-04-19T20:19:01Z

@cclauss Took those two isolated fixes into this branch as well so things should go green here 🙇 The gyp-next one will get clobbered on the next gyp-next sync but i guess that's fine the underlying fix will be in that sync too

cclauss

LGTM. Can another maintainer please review these changes?

EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA.

* feat: replace make-fetch-happen with built-in fetch Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies. * fixup: address review feedback - Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging * ci: fix Python lint and npm install in tests workflow Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151. * fix: apply cafile to proxied TLS connections EnvHttpProxyAgent forwards opts to an internal ProxyAgent for proxied requests, which reads origin TLS config from requestTls rather than connect. Set connect/requestTls/proxyTls so the custom CA is honored on both direct and proxied paths. Adds a test covering https origin behind an HTTP CONNECT proxy with a custom CA. (cherry picked from commit 393ec2b)

feat: replace make-fetch-happen with built-in fetch
8dd155c
Use Node's built-in fetch for downloading headers/tarballs, with undici's EnvHttpProxyAgent providing --proxy, --noproxy and --cafile support (plus http_proxy/https_proxy/no_proxy env var handling). Drops 36 transitive dependencies.

cclauss requested review from StefanStojanovic, Copilot and lukekarrys April 19, 2026 11:11

Copilotstarted reviewing on behalf of cclauss April 19, 2026 11:12 View session

CopilotAI reviewed Apr 19, 2026
View reviewed changes

Comment threadlib/download.js Outdated
Comment threadtest/test-download.js Outdated
Comment threadtest/test-download.js

fixup: address review feedback
f86045e
- Guard Readable.fromWeb against null body (204/304 responses) - Add socket error handlers to CONNECT tunnel in proxy test - Destroy socket in noproxy test's CONNECT handler so a regression fails fast instead of hanging

ci: fix Python lint and npm install in tests workflow
ae72094
Apply f-string fix from gyp-next#337 to resolve ruff F507 in simple_copy.py, and add npm@~11.10.0 pre-install step from nodejs#3300 to work around npm/cli#9151.

cclauss approved these changes Apr 19, 2026
View reviewed changes

cclauss requested a review from gengjiawen April 19, 2026 20:39

gengjiawen reviewed Apr 20, 2026
View reviewed changes

Comment threadlib/download.js

gengjiawen approved these changes Apr 21, 2026
View reviewed changes

gengjiawen merged commit 393ec2b into nodejs:mainApr 21, 2026
37 checks passed

nodejs-github-bot mentioned this pull request Mar 23, 2026
chore(main): release 12.3.0 #3277
Merged

cclauss mentioned this pull request Apr 21, 2026
ci: fix current failures #3300
Closed
2 tasks

This was referenced Apr 21, 2026
chore: retry downloads on retryable errors #3298
Closed
chore: retry downloads on retryable errors #3308
Merged

legendecas mentioned this pull request Jun 5, 2026
EnvHttpProxyAgent invalid onError method nodejs/node#63757
Closed