📦 deps(app): update undici

Author: scttbnsn

app/authentications/providers/oidc/Oidc.test.ts

@@ -112,6 +112,23 @@ function expectDefaultRedirectPayload(res: any) {
   });
 }
 
+function getUndiciAgentOptions(dispatcher: unknown): Record<string, unknown> | undefined {
+  if (!dispatcher || typeof dispatcher !== 'object') {
+    return undefined;
+  }
+
+  const optionsSymbol = Object.getOwnPropertySymbols(dispatcher).find(
+    (symbol) => symbol.description === 'options',
+  );
+  if (!optionsSymbol) {
+    return undefined;
+  }
+
+  return (dispatcher as Record<symbol, unknown>)[optionsSymbol] as
+    | Record<string, unknown>
+    | undefined;
+}
+
 /** Perform a redirect flow and return the session with pending state */
 async function performRedirect(oidcInstance: any, mock: any, session?: any) {
   const sess = session || { save: vi.fn((cb) => cb()) };
@@ -1560,6 +1577,10 @@ test('initAuthentication should configure custom fetch when cafile is set', asyn
       'https://idp.example.com/.well-known/openid-configuration',
       expect.objectContaining({ dispatcher: expect.anything() }),
     );
+    const requestInit = fetchSpy.mock.calls[0][1] as { dispatcher?: unknown };
+    expect(getUndiciAgentOptions(requestInit.dispatcher)).toEqual(
+      expect.objectContaining({ allowH2: false }),
+    );
   } finally {
     fetchSpy.mockRestore();
     await cleanup();
@@ -1598,6 +1619,10 @@ test('initAuthentication should configure custom fetch and warn when insecure TL
       'https://idp.example.com/.well-known/openid-configuration',
       expect.objectContaining({ dispatcher: expect.anything() }),
     );
+    const requestInit = fetchSpy.mock.calls[0][1] as { dispatcher?: unknown };
+    expect(getUndiciAgentOptions(requestInit.dispatcher)).toEqual(
+      expect.objectContaining({ allowH2: false }),
+    );
   } finally {
     fetchSpy.mockRestore();
   }

app/authentications/providers/oidc/Oidc.ts

@@ -455,7 +455,10 @@ class Oidc extends Authentication<OidcConfiguration> {
         this.log.warn('TLS certificate verification disabled for OIDC - do not use in production');
         connectOptions.rejectUnauthorized = false;
       }
-      const dispatcher = new Agent({ connect: connectOptions });
+      const dispatcher = new Agent({
+        allowH2: false,
+        connect: connectOptions,
+      });
       const oidcFetch: openidClientLibrary.CustomFetch = (input, init) =>
         fetch(
           input as RequestInfo | URL,

app/package-lock.json

@@ -66,7 +66,7 @@
     "semver": "7.8.0",
     "set-value": "4.1.0",
     "sort-es": "1.7.18",
-    "undici": "7.24.6",
+    "undici": "8.2.0",
     "unix-crypt-td-js": "1.1.4",
     "uuid": "14.0.0",
     "ws": "8.20.1",