[proxymeshai]

Minor release 0.4.0 (0.3.0 → 0.4.0). The branch name stays release/0.3.1. The GitHub tag is read from package.json on merge (.github/workflows/release-on-merge.yml), so this publishes as v-0.4.0, not v-0.3.1.

0.3.1 is the wrong number. Everything user-facing since tag v-0.3.0 (commit fa48928) is a bug or security fix, but #82 also adds public undici options and changes got behavior that callers have to handle. This package is still pre-1.0, so that is a minor bump.

User-facing

Undici and got stay on the configured proxy (#82)

Undici. HTTPS request() completed CONNECT, then ignored the tunnel and dialed the origin directly. connect: { socket } is a TLS option, not undici’s pre-connected tunnel API. Origin TLS is now wrapped on the CONNECT socket with buildConnector and httpSocket. Bytes that arrive with the CONNECT response are paused and unshifted so they are not dropped before TLS.

New optional fields on request() / UndiciRequestOptions (types/undici.d.ts, docs/undici.md):

• tlsOptions — TLS options for the origin connection over the CONNECT tunnel.
• connectTimeout — origin CONNECT/TLS handshake timeout in milliseconds. It is applied as the connector timeout because undici ignores the client connectTimeout when connect is a function. proxyTlsOptions was already accepted.

Got. Only agent.https was set, so http:// URLs and HTTPS→HTTP redirects used got’s default HTTP agent and connected directly. The adapter now throws TypeError: javascript-proxy-headers/got only supports HTTPS; HTTP would bypass the proxy for those URLs, and pins agent.http to the same proxy agent so a missed hook cannot fall back to a direct connect. Callers that passed plain HTTP, or that followed a downgrade redirect, need to stay on HTTPS.

ky returns a native Response (#81)

ky 2.2+ throws The fetch option must resolve with a Response when the custom fetch resolves with a node-fetch response. The adapter now returns a native global Response with the proxy proxyHeaders Map attached.

• Hop-by-hop headers, content-encoding, and content-length are dropped when those headers are copied onto the native Response (node-fetch has already decompressed the body; leaving content-encoding would decode twice).
• proxyHeaders is an own property and is not copied by response.clone().

That landed in #81, in the same commit as the ky 2.2.0 devDependency bump. #77’s commit message listed ky 2.2.0, but the lockfile stayed on 2.1.0 until this Response check was supported. #79 is the ubuntu-24.04 CI pin, not this fix.

Also on main since v-0.3.0 (not user-facing)

• CI jobs pinned to ubuntu-24.04 (ci: pin GitHub Actions jobs to ubuntu-24.04 #79).
• Dev-only dependency bumps: dev-minor-patch group chore(deps-dev): Bump the dev-minor-patch group with 4 updates #77 (eslint, got, ky message / undici; lockfile ky stayed 2.1.0), chore(deps-dev): Bump the dev-minor-patch group with 2 updates #81 (ky 2.1.0 → 2.2.0, undici 8.12.2 → 8.12.3), and chore(deps-dev): Bump the dev-minor-patch group with 3 updates #86 (axios 1.20.0 → 1.21.0, eslint 10.13.0 → 10.14.0, got 16.1.0 → 16.2.0). follow-redirects 1.16.1 → 1.16.2 (chore(deps-dev): Bump follow-redirects from 1.16.1 to 1.16.2 #83).
• qs lockfile bump 6.16.0 → 6.17.1 (chore(deps): Bump qs from 6.16.0 to 6.17.1 #84).

Version fields updated together: package.json, jsr.json, and the root version fields in package-lock.json. The repo has no CHANGELOG.md. README / getting-started “0.3.0 breaking changes” notes still describe the 0.3.0 header isolation; #82 added the got HTTPS-only and undici tunnel sentences under that heading and those were left as-is.

Merging release/0.3.1 into main is what creates GitHub release v-0.4.0 and then publishes to npm and JSR. Auto-merge is not enabled. The repo owner's merge is the approval. Nothing is published by this PR.