Replace vendored http-proxy with httpxy (#96060)

[`httpxy`](https://github.com/unjs/httpxy) is a faster and actively
maintained variant of `http-proxy`. It also doesn't need any manual
patches to avoid security vulnerabilities in Next.js.

`httpxy` is used by Nuxt and maintained by the Nitro team.

package.json

@@ -340,7 +340,6 @@
       "@types/[email protected]": "patches/@[email protected]",
       "[email protected]": "patches/[email protected]",
       "[email protected]": "patches/[email protected]",
-      "[email protected]": "patches/[email protected]",
       "[email protected]": "patches/[email protected]",
       "@rspack/[email protected]": "patches/@[email protected]",
       "@modelcontextprotocol/sdk": "patches/@modelcontextprotocol__sdk.patch",

packages/next/package.json

@@ -267,10 +267,10 @@
     "fresh": "0.5.2",
     "glob": "7.1.7",
     "gzip-size": "5.1.1",
-    "http-proxy": "1.18.1",
     "http-proxy-agent": "5.0.0",
     "https-browserify": "1.0.0",
     "https-proxy-agent": "5.0.1",
+    "httpxy": "0.5.5",
     "icss-utils": "5.1.0",
     "ignore-loader": "0.1.2",
     "image-size": "1.2.1",

packages/next/src/bundles/httpxy/index.js

@@ -0,0 +1,3 @@
+// httpxy only ships an ESM entry point. Re-export it through this CJS entry
+// so ncc emits a CommonJS bundle that the server runtime can `require()`.
+module.exports = require('httpxy')

packages/next/src/compiled/http-proxy/LICENSE

@@ -1,23 +0,0 @@
-
-  node-http-proxy
-
-  Copyright (c) 2010-2016 Charlie Robbins, Jarrett Cruger & the Contributors.
-
-  Permission is hereby granted, free of charge, to any person obtaining
-  a copy of this software and associated documentation files (the
-  "Software"), to deal in the Software without restriction, including
-  without limitation the rights to use, copy, modify, merge, publish,
-  distribute, sublicense, and/or sell copies of the Software, and to
-  permit persons to whom the Software is furnished to do so, subject to
-  the following conditions:
-
-  The above copyright notice and this permission notice shall be
-  included in all copies or substantial portions of the Software.
-
-  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-  LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-  WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

packages/next/src/compiled/http-proxy/package.json

@@ -1 +0,0 @@
-{"name":"http-proxy","main":"index.js","author":"Charlie Robbins <[email protected]>","license":"MIT"}

packages/next/src/compiled/httpxy/LICENSE

@@ -0,0 +1,46 @@
+MIT License
+
+Copyright (c) Pooya Parsa <[email protected]>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+----
+
+Based on http-party/node-http-proxy (9b96cd7)
+
+Copyright (c) 2010-2016 Charlie Robbins, Jarrett Cruger & the Contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

packages/next/src/compiled/httpxy/package.json

@@ -0,0 +1 @@
+{"name":"httpxy","main":"index.js","license":"MIT"}

packages/next/src/server/lib/router-utils/proxy-request.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'http'
+import type { Socket } from 'net'
 import type { NextUrlWithParsedQuery } from '../../request-meta'
 
 import url from 'url'
@@ -18,15 +19,15 @@ export async function proxyRequest(
   delete (parsedUrl as any).query
   parsedUrl.search = stringifyQuery(req as any, query)
 
-  const target = url.format(parsedUrl)
   // Keep in mind that a WHATWG URL's hostname and the parsedUrl's hostname
   // are not strictly equal due to lowercasing, IDN translation, IPv4 and IPv6 normalization, etc.
-  // We just make sure this is a valid URL since http-proxy doesn't validate.
-  new URL(target)
-  const HttpProxy =
-    require('next/dist/compiled/http-proxy') as typeof import('next/dist/compiled/http-proxy')
+  // We just make sure this is a valid URL since httpxy would only parse it
+  // lazily on the `web()`/`ws()` call.
+  const target = new URL(url.format(parsedUrl))
+  const { ProxyServer } =
+    require('next/dist/compiled/httpxy') as typeof import('next/dist/compiled/httpxy')
 
-  const proxy = new HttpProxy({
+  const proxy = new ProxyServer({
     target,
     changeOrigin: true,
     ignorePath: true,
@@ -41,7 +42,7 @@ export async function proxyRequest(
 
   let finished = false
 
-  // http-proxy does not properly detect a client disconnect in newer
+  // httpxy does not properly detect a client disconnect in newer
   // versions of Node.js. This is caused because it only listens for the
   // `aborted` event on the our request object, but it also fully reads
   // and closes the request object. Node **will not** fire `aborted` when
@@ -81,10 +82,10 @@ export async function proxyRequest(
 
   const detached = new DetachedPromise<boolean>()
 
-  proxy.on('error', (err) => {
-    console.error(`Failed to proxy ${target}`, err)
+  const onProxyError = (err: Error) => {
     if (!finished) {
       finished = true
+      console.error(`Failed to proxy ${target}`, err)
       detached.reject(err)
 
       if (!res.destroyed) {
@@ -95,7 +96,9 @@ export async function proxyRequest(
         res.end('Internal Server Error')
       }
     }
-  })
+  }
+
+  proxy.on('error', onProxyError)
 
   // If upgrade head is present or the response is a Duplex stream, treat as
   // WebSocket request.
@@ -108,7 +111,9 @@ export async function proxyRequest(
         }
       })
     })
-    proxy.ws(req, res, upgradeHead)
+    // The returned promise rejects on errors of the client socket (e.g. an
+    // abrupt client disconnect) even when an `error` listener is registered.
+    proxy.ws(req, res as Socket, {}, upgradeHead).catch(onProxyError)
     detached.resolve(true)
   } else {
     proxy.on('proxyReq', (proxyReq) => {
@@ -119,9 +124,14 @@ export async function proxyRequest(
         }
       })
     })
-    proxy.web(req, res, {
-      buffer: reqBody,
-    })
+    // The returned promise rejects on errors of the client response stream
+    // (e.g. an abrupt client disconnect) even when an `error` listener is
+    // registered.
+    proxy
+      .web(req, res, {
+        buffer: reqBody,
+      })
+      .catch(onProxyError)
   }
 
   // When the proxy finishes proxying the request, shut down the proxy.

packages/next/taskfile.js

@@ -1216,17 +1216,13 @@ export async function ncc_gzip_size(task, opts) {
     .ncc({ packageName: 'gzip-size', externals })
     .target('src/compiled/gzip-size')
 }
-externals['http-proxy'] = 'next/dist/compiled/http-proxy'
-// The patched http-proxy (patches/[email protected]) uses Next.js'
-// parseUrl instead of the deprecated url.parse. Keep that import pointing at
-// next's own dist instead of bundling a copy.
-externals['next/dist/shared/lib/router/utils/parse-url'] =
-  'next/dist/shared/lib/router/utils/parse-url'
-export async function ncc_http_proxy(task, opts) {
+externals['httpxy'] = 'next/dist/compiled/httpxy'
+export async function ncc_httpxy(task, opts) {
   await task
-    .source(relative(__dirname, require.resolve('http-proxy')))
-    .ncc({ packageName: 'http-proxy', externals })
-    .target('src/compiled/http-proxy')
+    // httpxy is ESM-only, compile to CJS through a stub entry
+    .source('src/bundles/httpxy/index.js')
+    .ncc({ packageName: 'httpxy', externals, esm: false })
+    .target('src/compiled/httpxy')
 }
 externals['ignore-loader'] = 'next/dist/compiled/ignore-loader'
 export async function ncc_ignore_loader(task, opts) {
@@ -2305,7 +2301,7 @@ export async function ncc(task, opts) {
         'ncc_fresh',
         'ncc_glob',
         'ncc_gzip_size',
-        'ncc_http_proxy',
+        'ncc_httpxy',
         'ncc_ignore_loader',
         'ncc_is_animated',
         'ncc_ipaddr_js',

packages/next/types/$$compiled.internal.d.ts

@@ -682,8 +682,8 @@ declare module 'next/dist/compiled/gzip-size' {
   import m from 'gzip-size'
   export = m
 }
-declare module 'next/dist/compiled/http-proxy' {
-  import m from 'http-proxy'
+declare module 'next/dist/compiled/httpxy' {
+  import * as m from 'httpxy'
   export = m
 }
 declare module 'next/dist/compiled/is-docker' {

patches/http-proxy@1.18.1.patch

@@ -1,156 +0,0 @@
-diff --git a/lib/http-proxy/common.js b/lib/http-proxy/common.js
-index 6513e81d80d5250ea249ea833f819ece67897c7e..b839d0a0cc69674f3d53c1e5eec07ea8cc7c4796 100644
---- a/lib/http-proxy/common.js
-+++ b/lib/http-proxy/common.js
-@@ -1,15 +1,35 @@
- var common   = exports,
--    url      = require('url'),
--    extend   = require('util')._extend,
-+    parseUrl = require('next/dist/shared/lib/router/utils/parse-url').parseUrl,
-     required = require('requires-port');
- 
- var upgradeHeader = /(^|,)\s*upgrade\s*($|,)/i,
-+    hopByHopTransferEncodingHeader = /(^|,)\s*transfer-encoding\s*($|,)/i,
-     isSSL = /^https|wss/;
- 
- /**
-  * Simple Regex for testing if protocol is https
-  */
- common.isSSL = isSSL;
-+
-+/**
-+ * Parses a url with Next.js' WHATWG-based `parseUrl` and adapts the result to
-+ * the legacy `url.parse` shape http-proxy relies on (`host`, `path`, and a
-+ * bracket-less `hostname` for IPv6).
-+ */
-+common.parseUrl = function(urlValue) {
-+  var parsed = parseUrl(urlValue);
-+  var bracketedHostname = parsed.hostname;
-+  return Object.assign(parsed, {
-+    host: bracketedHostname
-+      ? bracketedHostname + (parsed.port ? ':' + parsed.port : '')
-+      : bracketedHostname,
-+    hostname:
-+      bracketedHostname && bracketedHostname.startsWith('[')
-+        ? bracketedHostname.slice(1, -1)
-+        : bracketedHostname,
-+    path: parsed.pathname + parsed.search,
-+  });
-+};
- /**
-  * Copies the right headers from `options` and `req` to
-  * `outgoing` which is then used to fire the proxied
-@@ -40,10 +60,10 @@ common.setupOutgoing = function(outgoing, options, req, forward) {
-   );
- 
-   outgoing.method = options.method || req.method;
--  outgoing.headers = extend({}, req.headers);
-+  outgoing.headers = Object.assign({}, req.headers);
- 
-   if (options.headers){
--    extend(outgoing.headers, options.headers);
-+    Object.assign(outgoing.headers, options.headers);
-   }
- 
-   if (options.auth) {
-@@ -61,13 +81,22 @@ common.setupOutgoing = function(outgoing, options, req, forward) {
- 
-   outgoing.agent = options.agent || false;
-   outgoing.localAddress = options.localAddress;
-+  outgoing.headers = outgoing.headers || {};
-+  var hasTransferEncodingHeader = Object.keys(outgoing.headers).some(function (header) {
-+    return header.toLowerCase() === 'transfer-encoding'
-+      && typeof outgoing.headers[header] !== 'undefined';
-+  });
-+
-+  if (hasTransferEncodingHeader
-+      || (typeof outgoing.headers.connection === 'string'
-+          && hopByHopTransferEncodingHeader.test(outgoing.headers.connection))
-+     ) { outgoing.headers.connection = 'close'; }
- 
-   //
-   // Remark: If we are false and not upgrading, set the connection: close. This is the right thing to do
-   // as node core doesn't handle this COMPLETELY properly yet.
-   //
-   if (!outgoing.agent) {
--    outgoing.headers = outgoing.headers || {};
-     if (typeof outgoing.headers.connection !== 'string'
-         || !upgradeHeader.test(outgoing.headers.connection)
-        ) { outgoing.headers.connection = 'close'; }
-@@ -80,11 +109,8 @@ common.setupOutgoing = function(outgoing, options, req, forward) {
-     ? (target.path || '')
-     : '';
- 
--  //
--  // Remark: Can we somehow not use url.parse as a perf optimization?
--  //
-   var outgoingPath = !options.toProxy
--    ? (url.parse(req.url).path || '')
-+    ? (common.parseUrl(req.url).path || '')
-     : req.url;
- 
-   //
-diff --git a/lib/http-proxy/index.js b/lib/http-proxy/index.js
-index 977a4b3622b9eaac27689f06347ea4c5173a96cd..9d94a5198155fbb517a243d6f0fd5e115c77daff 100644
---- a/lib/http-proxy/index.js
-+++ b/lib/http-proxy/index.js
-@@ -1,6 +1,5 @@
- var httpProxy = module.exports,
--    extend    = require('util')._extend,
--    parse_url = require('url').parse,
-+    parse_url = require('./common').parseUrl,
-     EE3       = require('eventemitter3'),
-     http      = require('http'),
-     https     = require('https'),
-@@ -47,9 +46,9 @@ function createRightProxy(type) {
-         args[cntr] !== res
-       ) {
-         //Copy global options
--        requestOptions = extend({}, options);
-+        requestOptions = Object.assign({}, options);
-         //Overwrite with request options
--        extend(requestOptions, args[cntr]);
-+        Object.assign(requestOptions, args[cntr]);
- 
-         cntr--;
-       }
-diff --git a/lib/http-proxy/passes/web-incoming.js b/lib/http-proxy/passes/web-incoming.js
-index 7ae735514190eea569c605fff7d27c045fe8d601..c7c25e7228b21c76b3c7115af82ddcbf13a8e3ec 100644
---- a/lib/http-proxy/passes/web-incoming.js
-+++ b/lib/http-proxy/passes/web-incoming.js
-@@ -33,9 +33,9 @@ module.exports = {
- 
-   deleteLength: function deleteLength(req, res, options) {
-     if((req.method === 'DELETE' || req.method === 'OPTIONS')
--       && !req.headers['content-length']) {
-+       && typeof req.headers['content-length'] === 'undefined'
-+       && typeof req.headers['transfer-encoding'] === 'undefined') {
-       req.headers['content-length'] = '0';
--      delete req.headers['transfer-encoding'];
-     }
-   },
- 
-diff --git a/lib/http-proxy/passes/web-outgoing.js b/lib/http-proxy/passes/web-outgoing.js
-index 46352f6e377affc701773328d528bd7e4352f242..cabd340c7d66c6a5d464262d88c698d2781697b3 100644
---- a/lib/http-proxy/passes/web-outgoing.js
-+++ b/lib/http-proxy/passes/web-outgoing.js
-@@ -51,8 +51,8 @@ module.exports = { // <--
-     if ((options.hostRewrite || options.autoRewrite || options.protocolRewrite)
-         && proxyRes.headers['location']
-         && redirectRegex.test(proxyRes.statusCode)) {
--      var target = url.parse(options.target);
--      var u = url.parse(proxyRes.headers['location']);
-+      var target = common.parseUrl(options.target);
-+      var u = common.parseUrl(proxyRes.headers['location']);
- 
-       // make sure the redirected host matches the target host before rewriting
-       if (target.host != u.host) {
-@@ -68,7 +68,7 @@ module.exports = { // <--
-         u.protocol = options.protocolRewrite;
-       }
- 
--      proxyRes.headers['location'] = u.format();
-+      proxyRes.headers['location'] = url.format(u);
-     }
-   },
-   /**

pnpm-lock.yaml

@@ -37,9 +37,6 @@ patchedDependencies:
   '@vercel/blob':
     hash: cb53bfa5effb15b3a361e176003df667cadf757b27b7c9b458c2f0fce86ea893
     path: patches/@vercel__blob.patch
-  [email protected]:
-    hash: 34b797595c63312eb8cb6e01f4b521bf5eea00315c5e48a31c3d89d866efd50f
-    path: patches/[email protected]
   [email protected]:
     hash: 587688821244aaee46680929cd869947377a284ac1b30c9ae8660a5ea7d2be67
     path: patches/[email protected]
@@ -392,7 +389,7 @@ importers:
         version: 5.1.18
       http-proxy:
         specifier: 1.18.1
-        version: 1.18.1(patch_hash=34b797595c63312eb8cb6e01f4b521bf5eea00315c5e48a31c3d89d866efd50f)
+        version: 1.18.1
       husky:
         specifier: 9.0.11
         version: 9.0.11
@@ -1492,9 +1489,6 @@ importers:
       gzip-size:
         specifier: 5.1.1
         version: 5.1.1
-      http-proxy:
-        specifier: 1.18.1
-        version: 1.18.1(patch_hash=34b797595c63312eb8cb6e01f4b521bf5eea00315c5e48a31c3d89d866efd50f)
       http-proxy-agent:
         specifier: 5.0.0
         version: 5.0.0
@@ -1504,6 +1498,9 @@ importers:
       https-proxy-agent:
         specifier: 5.0.1
         version: 5.0.1
+      httpxy:
+        specifier: 0.5.5
+        version: 0.5.5
       icss-utils:
         specifier: 5.1.0
         version: 5.1.0([email protected])
@@ -11254,6 +11251,9 @@ packages:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
+  [email protected]:
+    resolution: {integrity: sha512-uDjmnPyp1q4Sgzf3w+J/Fc6UqcCEj0x4Wjp7OqK5dGhNeDgpyrAmnS6ey8QWrX3SWDon2DMKf9sBa5X9+CVyMA==}
+
   [email protected]:
     resolution: {integrity: sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==}
     engines: {node: '>=8.12.0'}
@@ -29165,7 +29165,7 @@ snapshots:
   [email protected](@types/[email protected]):
     dependencies:
       '@types/http-proxy': 1.17.17
-      http-proxy: 1.18.1(patch_hash=34b797595c63312eb8cb6e01f4b521bf5eea00315c5e48a31c3d89d866efd50f)
+      http-proxy: 1.18.1
       is-glob: 4.0.3
       is-plain-obj: 3.0.0
       micromatch: 4.0.8
@@ -29174,7 +29174,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  [email protected](patch_hash=34b797595c63312eb8cb6e01f4b521bf5eea00315c5e48a31c3d89d866efd50f):
+  [email protected]:
     dependencies:
       eventemitter3: 4.0.7
       follow-redirects: 1.9.0
@@ -29204,6 +29204,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]: {}

pnpm-workspace.yaml

@@ -43,6 +43,7 @@ minimumReleaseAgeExclude:
   - '@vercel/*'
   - '@workflow/*'
   - babel-plugin-react-compiler
+  - [email protected]
   - next
   - react
   - react-dom

test/e2e/next-font/with-proxy/server.js

@@ -1,5 +1,5 @@
 const http = require('http')
-const httpProxy = require('next/dist/compiled/http-proxy')
+const httpProxy = require('http-proxy')
 
 const PROXY_PORT = process.env.PROXY_PORT
 const SERVER_PORT = process.env.SERVER_PORT

test/production/next-server-nft/next-server-nft.test.ts

@@ -195,7 +195,7 @@ async function readNormalizedNFT(next, name) {
            "/node_modules/next/dist/compiled/edge-runtime/index.js",
            "/node_modules/next/dist/compiled/find-up/index.js",
            "/node_modules/next/dist/compiled/fresh/index.js",
-           "/node_modules/next/dist/compiled/http-proxy/index.js",
+           "/node_modules/next/dist/compiled/httpxy/index.js",
            "/node_modules/next/dist/compiled/image-detector/detector.js",
            "/node_modules/next/dist/compiled/image-size/index.js",
            "/node_modules/next/dist/compiled/ipaddr.js/ipaddr.js",