.eslintignore

 node_modules
-dist/**

.eslintrc.js

+/* eslint-env node */
+module.exports = {
+    "env": {
+        "browser": true,
+        "es2021": true
+    },
+    "extends": "eslint:recommended",
+    "parserOptions": {
+        "ecmaVersion": 12,
+        "sourceType": "module"
+    },
+    "rules": {
+    }
+};

.eslintrc.json

-{
-  "parserOptions": {
-    "ecmaVersion": 2015,
-    "sourceType": "module"
-  },
-  "globals": {
-    "WHATWGFetch": true,
-    "ArrayBuffer": true,
-    "DataView": true,
-    "Promise": true,
-    "Symbol": true,
-    "Uint8Array": true,
-    "globalThis": true
-  },
-  "extends": [
-    "plugin:github/browser"
-  ],
-  "rules": {
-    "object-shorthand": "off"
-  },
-  "overrides": [
-    {
-      "files": ["test/*.js"],
-      "env": {
-        "browser": true,
-        "mocha": true
-      },
-      "globals": {
-        "assert": true,
-        "chai": true,
-        "FileReaderSync": true,
-        "Mocha": true
-      }
-    },
-    {
-      "files": ["test/{karma,server}*.js"],
-      "env": {
-        "node": true
-      }
-    },
-    {
-      "files": ["test/worker.js"],
-      "env": {
-        "worker": true
-      }
-    }
-  ]
-}

.github/workflows/lock.yml

@@ -4,9 +4,14 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions: {}
+
 jobs:
   lock:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: dessant/lock-threads@v2
         with:

.github/workflows/node.js.yml

@@ -8,6 +8,9 @@ on:
     branches: [ master ]
   pull_request:
     branches: [ master ]
+    
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -16,7 +19,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [10.x, 12.x, 14.x]
+        node-version: [18.x, 20.x]
 
     steps:
     - uses: actions/checkout@v2

LICENSE

-Copyright (c) 2014-2016 GitHub, Inc.
+Copyright (c) 2014-2023 GitHub, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

fetch.js

-var global =
+/* eslint-disable no-prototype-builtins */
+var g =
   (typeof globalThis !== 'undefined' && globalThis) ||
   (typeof self !== 'undefined' && self) ||
+  // eslint-disable-next-line no-undef
   (typeof global !== 'undefined' && global) ||
   {}
 
 var support = {
-  searchParams: 'URLSearchParams' in global,
-  iterable: 'Symbol' in global && 'iterator' in Symbol,
+  searchParams: 'URLSearchParams' in g,
+  iterable: 'Symbol' in g && 'iterator' in Symbol,
   blob:
-    'FileReader' in global &&
-    'Blob' in global &&
+    'FileReader' in g &&
+    'Blob' in g &&
     (function() {
       try {
         new Blob()
@@ -18,8 +20,8 @@ var support = {
         return false
       }
     })(),
-  formData: 'FormData' in global,
-  arrayBuffer: 'ArrayBuffer' in global
+  formData: 'FormData' in g,
+  arrayBuffer: 'ArrayBuffer' in g
 }
 
 function isDataView(obj) {
@@ -90,6 +92,9 @@ export function Headers(headers) {
     }, this)
   } else if (Array.isArray(headers)) {
     headers.forEach(function(header) {
+      if (header.length != 2) {
+        throw new TypeError('Headers constructor: expected name/value pair to be length 2, found' + header.length)
+      }
       this.append(header[0], header[1])
     }, this)
   } else if (headers) {
@@ -160,6 +165,7 @@ if (support.iterable) {
 }
 
 function consumed(body) {
+  if (body._noBody) return
   if (body.bodyUsed) {
     return Promise.reject(new TypeError('Already read'))
   }
@@ -187,7 +193,9 @@ function readBlobAsArrayBuffer(blob) {
 function readBlobAsText(blob) {
   var reader = new FileReader()
   var promise = fileReaderReady(reader)
-  reader.readAsText(blob)
+  var match = /charset=([A-Za-z0-9_-]+)/.exec(blob.type)
+  var encoding = match ? match[1] : 'utf-8'
+  reader.readAsText(blob, encoding)
   return promise
 }
 
@@ -225,9 +233,11 @@ function Body() {
       semantic of setting Request.bodyUsed in the constructor before
       _initBody is called.
     */
+    // eslint-disable-next-line no-self-assign
     this.bodyUsed = this.bodyUsed
     this._bodyInit = body
     if (!body) {
+      this._noBody = true;
       this._bodyText = ''
     } else if (typeof body === 'string') {
       this._bodyText = body
@@ -275,26 +285,27 @@ function Body() {
         return Promise.resolve(new Blob([this._bodyText]))
       }
     }
+  }
 
-    this.arrayBuffer = function() {
-      if (this._bodyArrayBuffer) {
-        var isConsumed = consumed(this)
-        if (isConsumed) {
-          return isConsumed
-        }
-        if (ArrayBuffer.isView(this._bodyArrayBuffer)) {
-          return Promise.resolve(
-            this._bodyArrayBuffer.buffer.slice(
-              this._bodyArrayBuffer.byteOffset,
-              this._bodyArrayBuffer.byteOffset + this._bodyArrayBuffer.byteLength
-            )
+  this.arrayBuffer = function() {
+    if (this._bodyArrayBuffer) {
+      var isConsumed = consumed(this)
+      if (isConsumed) {
+        return isConsumed
+      } else if (ArrayBuffer.isView(this._bodyArrayBuffer)) {
+        return Promise.resolve(
+          this._bodyArrayBuffer.buffer.slice(
+            this._bodyArrayBuffer.byteOffset,
+            this._bodyArrayBuffer.byteOffset + this._bodyArrayBuffer.byteLength
           )
-        } else {
-          return Promise.resolve(this._bodyArrayBuffer)
-        }
+        )
       } else {
-        return this.blob().then(readBlobAsArrayBuffer)
+        return Promise.resolve(this._bodyArrayBuffer)
       }
+    } else if (support.blob) {
+      return this.blob().then(readBlobAsArrayBuffer)
+    } else {
+      throw new Error('could not read as ArrayBuffer')
     }
   }
 
@@ -371,7 +382,7 @@ export function Request(input, options) {
   this.method = normalizeMethod(options.method || this.method || 'GET')
   this.mode = options.mode || this.mode || null
   this.signal = options.signal || this.signal || (function () {
-    if ('AbortController' in global) {
+    if ('AbortController' in g) {
       var ctrl = new AbortController();
       return ctrl.signal;
     }
@@ -459,6 +470,9 @@ export function Response(bodyInit, options) {
 
   this.type = 'default'
   this.status = options.status === undefined ? 200 : options.status
+  if (this.status < 200 || this.status > 599) {
+    throw new RangeError("Failed to construct 'Response': The status provided (0) is outside the range [200, 599].")
+  }
   this.ok = this.status >= 200 && this.status < 300
   this.statusText = options.statusText === undefined ? '' : '' + options.statusText
   this.headers = new Headers(options.headers)
@@ -478,7 +492,8 @@ Response.prototype.clone = function() {
 }
 
 Response.error = function() {
-  var response = new Response(null, {status: 0, statusText: ''})
+  var response = new Response(null, {status: 200, statusText: ''})
+  response.status = 0
   response.type = 'error'
   return response
 }
@@ -493,7 +508,7 @@ Response.redirect = function(url, status) {
   return new Response(null, {status: status, headers: {location: url}})
 }
 
-export var DOMException = global.DOMException
+export var DOMException = g.DOMException
 try {
   new DOMException()
 } catch (err) {
@@ -554,7 +569,7 @@ export function fetch(input, init) {
 
     function fixUrl(url) {
       try {
-        return url === '' && global.location.href ? global.location.href : url
+        return url === '' && g.location.href ? g.location.href : url
       } catch (e) {
         return url
       }
@@ -572,18 +587,23 @@ export function fetch(input, init) {
       if (support.blob) {
         xhr.responseType = 'blob'
       } else if (
-        support.arrayBuffer &&
-        request.headers.get('Content-Type') &&
-        request.headers.get('Content-Type').indexOf('application/octet-stream') !== -1
+        support.arrayBuffer
       ) {
         xhr.responseType = 'arraybuffer'
       }
     }
 
-    if (init && typeof init.headers === 'object' && !(init.headers instanceof Headers)) {
+    if (init && typeof init.headers === 'object' && !(init.headers instanceof Headers || (g.Headers && init.headers instanceof g.Headers))) {
+      var names = [];
       Object.getOwnPropertyNames(init.headers).forEach(function(name) {
+        names.push(normalizeName(name))
         xhr.setRequestHeader(name, normalizeValue(init.headers[name]))
       })
+      request.headers.forEach(function(value, name) {
+        if (names.indexOf(name) === -1) {
+          xhr.setRequestHeader(name, value)
+        }
+      })
     } else {
       request.headers.forEach(function(value, name) {
         xhr.setRequestHeader(name, value)
@@ -607,9 +627,9 @@ export function fetch(input, init) {
 
 fetch.polyfill = true
 
-if (!global.fetch) {
-  global.fetch = fetch
-  global.Headers = Headers
-  global.Request = Request
-  global.Response = Response
+if (!g.fetch) {
+  g.fetch = fetch
+  g.Headers = Headers
+  g.Request = Request
+  g.Response = Response
 }

package.json

 {
   "name": "whatwg-fetch",
   "description": "A window.fetch polyfill.",
-  "version": "3.6.2",
+  "version": "3.6.17",
   "main": "./dist/fetch.umd.js",
   "module": "./fetch.js",
   "repository": "github/fetch",
@@ -10,7 +10,6 @@
     "abortcontroller-polyfill": "^1.1.9",
     "chai": "^4.1.2",
     "eslint": "^7.20.0",
-    "eslint-plugin-github": "^4.1.1",
     "karma": "^3.0.0",
     "karma-chai": "^0.1.0",
     "karma-chrome-launcher": "^2.2.0",

prettier.config.js

+/* eslint-env node */
 module.exports = require('eslint-plugin-github/prettier.config')

test/karma-worker.config.js

+/* eslint-env node */
 const parentConfig = require('./karma.config')
 
 module.exports = function(config) {

test/karma.config.js

+/* eslint-env node */
 const serverEndpoints = require('./server')
 
 module.exports = function(config) {

test/server.js

+/* eslint-env node */
 const url = require('url')
 const querystring = require('querystring')
 
@@ -120,14 +121,6 @@ const routes = {
       'Content-Type': 'text/html; charset=utf-8'
     })
     res.end()
-  },
-  '/invalid-headers': function(res) {
-    res.writeHead(200, {
-      'Content-Type': 'text/plain',
-      'Invalid Header': 'valid value',
-      'Westworld-S01': "<3"
-    })
-    res.end()
   }
 }
 

test/test.js

+/* eslint-env mocha */
+/* globals chai assert FileReaderSync assert WHATWGFetch */
 var IEorEdge = /Edge\//.test(navigator.userAgent) || /MSIE/.test(navigator.userAgent)
 var Chrome = /Chrome\//.test(navigator.userAgent) && !IEorEdge
 var Safari = /Safari\//.test(navigator.userAgent) && !IEorEdge && !Chrome
@@ -104,7 +106,7 @@ if (!self.fetch.polyfill) {
 var slice = Array.prototype.slice
 
 function featureDependent(testOrSuite, condition) {
-  ;(condition ? testOrSuite : testOrSuite.skip).apply(this, slice.call(arguments, 2))
+  (condition ? testOrSuite : testOrSuite.skip).apply(this, slice.call(arguments, 2))
 }
 
 exercise.forEach(function(exerciseMode) {
@@ -201,6 +203,16 @@ exercise.forEach(function(exerciseMode) {
 
         assert.equal(headers.get('Content-Type'), 'text/xml')
         assert.equal(headers.get('Breaking-Bad'), '<3')
+        assert.throws(function() {
+          new Headers([
+            ['Content-Type'],
+          ])
+        }, TypeError)
+        assert.throws(function() {
+          new Headers([
+            ['Content-Type', 'a', 'b'],
+          ])
+        }, TypeError)
       })
       test('headers are case insensitive', function() {
         var headers = new Headers({Accept: 'application/json'})
@@ -621,6 +633,21 @@ exercise.forEach(function(exerciseMode) {
           Response('{"foo":"bar"}', {headers: {'content-type': 'application/json'}})
         })
       })
+      test('status outside inclusive range 200-599 ', function() {
+        assert.throws(function() {
+          new Response('', {status: 199})
+        })
+        for (var i = 0; i < 200; i++) {
+          assert.throws(function() {
+            new Response('', {status: i})
+          })
+        }
+        for (i = 999; i > 599; i--) {
+          assert.throws(function() {
+            new Response('', {status: i})
+          })
+        }
+      })
       test('creates Headers object from raw headers', function() {
         var r = new Response('{"foo":"bar"}', {headers: {'content-type': 'application/json'}})
         assert.equal(r.headers instanceof Headers, true)
@@ -979,6 +1006,15 @@ exercise.forEach(function(exerciseMode) {
               assert(error instanceof TypeError, 'Promise rejected after body consumed')
             })
         })
+
+        test('does not set bodyUsed to true if no body supplied', function() {
+          var response = new Response();
+          assert(response.text, 'Body does not implement text')
+          assert.equal(response.bodyUsed, false)
+          response.text()
+          assert.equal(response.bodyUsed, false)
+          return response.text()
+        })
       })
     })
 
@@ -1281,12 +1317,6 @@ exercise.forEach(function(exerciseMode) {
             assert.equal(response.headers.get('Content-Type'), 'text/html; charset=utf-8')
           })
         })
-        test('parses invalid headers', function() {
-          return fetch('/invalid-headers').then(function(response) {
-            assert.equal(response.headers.get('Content-Type'), 'text/plain')
-            assert.equal(response.headers.get('Westworld-S01'), '<3')
-          })
-        })
       })
 
       // https://fetch.spec.whatwg.org/#methods

test/worker-adapter.js

+/* eslint-env mocha */
+/* globals Mocha */
 var mochaRun = mocha.run
 mocha.run = function() {}
 

test/worker.js

+/* eslint-env worker */
+/* globals mocha chai */
 importScripts('/base/node_modules/mocha/mocha.js')
 importScripts('/base/node_modules/chai/chai.js')