Skip to content

Fix https breakage of resolved ips#184

Merged
ospfranco merged 7 commits into
mainfrom
fix-https-breakage-of-resolved-ips
Jul 3, 2026
Merged

Fix https breakage of resolved ips#184
ospfranco merged 7 commits into
mainfrom
fix-https-breakage-of-resolved-ips

Conversation

@ospfranco

@ospfranco ospfranco commented Jul 3, 2026

Copy link
Copy Markdown
Collaborator

Addresses #182

By also adding undici as a dep we now break other runtimes. This PR also tries to add a new entrypoint /mobile that does not require undici and skips all the DNS protection code because mobile runtimes do not run localhost servers, so they should be redundant

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses the HTTPS/TLS regression introduced by DNS-rebinding hardening when resolveDNSHost returns an IP, and restructures the package into explicit Node vs mobile entrypoints to avoid bundler/runtime breakage from Node-only dependencies.

Changes:

  • Introduces a Node-specific entrypoint that pins HTTPS connections to the validated IP at the connection layer (via undici dispatcher) while preserving the original hostname for SNI/TLS.
  • Adds a /mobile entrypoint that avoids undici/Node-only dependencies and omits resolveDNSHost.
  • Updates package exports/build/test tooling to support the new entrypoints and migrate tests to bun:test.

Reviewed changes

Copilot reviewed 14 out of 17 changed files in this pull request and generated 11 comments.

Show a summary per file
File Description
tsconfig.json Switches TS ambient types to Bun (impacts editor/test typing).
tsconfig.build.json Adds a build-specific TS config excluding tests.
shared.ts Extracts shared parsing/types used by both entrypoints.
README.md Documents the new entrypoints and clarifies HTTPS hostname/SNI behavior.
package.json Adds exports for /node and /mobile, adds undici, changes scripts/engines/version.
node.ts New Node entrypoint implementing dispatcher-based HTTPS pinning.
mobile.ts New mobile/browser-safe entrypoint without Node-only deps or DNS pinning.
mise.toml Adds Bun tool configuration.
jest.config.js Removes Jest configuration (tests moved off Jest).
index.ts Makes the default entrypoint re-export the Node entrypoint.
bun.lock Updates lockfile for Bun + new dependencies.
bump-version.sh Removes version bump script.
.github/workflows/tests.yml Updates CI setup to use mise and run Bun tests.
tests/mobile.spec.ts Adds tests for the /mobile entrypoint behavior and dependency constraints.
tests/index.spec.ts Updates tests for Bun and adds coverage for the HTTPS pinning regression.
tests/fixtures/verify-undici-pinning.node.cjs Adds a Node-only fixture to verify undici lookup override behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread __tests__/index.spec.ts
Comment thread __tests__/index.spec.ts
Comment thread __tests__/index.spec.ts
Comment thread __tests__/index.spec.ts
Comment thread __tests__/index.spec.ts
Comment thread __tests__/index.spec.ts
Comment thread __tests__/index.spec.ts
Comment thread __tests__/index.spec.ts
Comment thread node.ts
Comment thread package.json
@ospfranco ospfranco merged commit 4da3a58 into main Jul 3, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants