ref: Use undici to download binary #2993

JPeer264 · 2025-11-27T14:59:49Z

This removes node-fetch entirely. We could have upgrade to node-fetch@3, but this one requires ESM-only, which we can't support (we still need CJS support for our @sentry/* bundler packages).

With this PR we use now undici which also has a ProxyAgent included, so we got rid of https-proxy-agent as well.

Closes #1810
Closes CLI-25

scripts/install.js

+        // Check if we have a total size to validate against
+        if (totalBytes > 0 && downloadedBytes < totalBytes) {
          reject(new Error('connection interrupted'));
+        } else {
+          resolve();
        }


andreiborza · 2025-12-02T15:40:36Z

CHANGELOG.md


+### Internal changes
+
+- Removed `node-fetch` dependency when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))


Suggested change

- Removed `node-fetch` dependency when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))

- Removed `node-fetch` and `https-proxy-agent` dependencies when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))

linear · 2025-12-02T15:49:04Z

CLI-25 Upgrade to node-fetch v3 to avoid punycode deprecation warning

szokeasaurusrex · 2025-12-02T15:51:33Z

CHANGELOG.md

+### Internal changes
+
+- Removed `node-fetch` dependency when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))


Since this is an internal change, we should not include it in the changelog imo.

Suggested change

### Internal changes

- Removed `node-fetch` dependency when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))

I would also update the PR title from feat: to ref:, as it is not really a new feature from the user perspective. And, that way, the DangerJS action will not complain about a missing changelog entry, since changelog entries are not required for ref: PRs.

I removed it and renamed the PR

scripts/install.js

+      .on('finish', () => {
+        // Check if we have a total size to validate against
+        if (totalBytes > 0 && downloadedBytes < totalBytes) {
          reject(new Error('connection interrupted'));
+        } else {
+          resolve();
        }
      });


scripts/install.js

+      .on('finish', () => {
+        // Check if we have a total size to validate against
+        if (totalBytes > 0 && downloadedBytes < totalBytes) {
          reject(new Error('connection interrupted'));
+        } else {
+          resolve();
        }


scripts/install.js

This removes `node-fetch` entirely. We could have upgrade to `node-fetch@3`, but this one requires ESM-only, which we can't support (we still need CJS support for our `@sentry/*` bundler packages). With this PR we use now `undici` which also has a `ProxyAgent` included, so we got rid of `https-proxy-agent` as well. Closes #1810 Closes [CLI-25](https://linear.app/getsentry/issue/CLI-25/upgrade-to-node-fetch-v3-to-avoid-punycode-deprecation-warning)

cursor · 2025-12-15T10:49:47Z

scripts/install.js

+        } else {
+          resolve();
        }
      });


Bug: Download integrity check unreliable with compressed responses

The connection interrupted check compares downloadedBytes against totalBytes to detect truncated downloads. However, with undici's transparent decompression, downloadedBytes counts decompressed bytes while totalBytes may still be the compressed content-length (undici preserves this header). If a connection interrupts mid-transfer but enough compressed data was already received to decompress to more bytes than the compressed size, the check downloadedBytes < totalBytes evaluates to false, causing the download to be incorrectly accepted as complete. The old code avoided this by setting compress: false and tracking compressed bytes. While checksum validation provides a safety net, users who set SENTRYCLI_SKIP_CHECKSUM_VALIDATION=1 lose protection against corrupted downloads in this scenario.

Additional Locations (1)

scripts/install.js#L255-L257

JPeer264 requested review from andreiborza and szokeasaurusrex November 27, 2025 14:59

JPeer264 requested review from a team as code owners November 27, 2025 14:59

JPeer264 requested review from Lms24 and removed request for a team November 27, 2025 14:59

JPeer264 force-pushed the jp/upgrade-node-fetch branch from b341615 to 99bef89 Compare November 27, 2025 15:04

JPeer264 added the v3.0 Breaking changes to include in version 3.0.0 of Sentry CLI label Dec 1, 2025

JPeer264 force-pushed the jp/upgrade-node-fetch branch from 15cb52d to 0c9cd59 Compare December 2, 2025 13:06

sentry bot reviewed Dec 2, 2025

View reviewed changes

scripts/install.js

Comment on lines +278 to 283

// Check if we have a total size to validate against

if (totalBytes > 0 && downloadedBytes < totalBytes) {

reject(new Error('connection interrupted'));

} else {

resolve();

}

This comment was marked as outdated.

Sign in to view

andreiborza approved these changes Dec 2, 2025

View reviewed changes

szokeasaurusrex reviewed Dec 2, 2025

View reviewed changes

JPeer264 changed the title ~~feat: use undici to download binary~~ ref: use undici to download binary Dec 4, 2025

JPeer264 changed the title ~~ref: use undici to download binary~~ ref: Use undici to download binary Dec 4, 2025

sentry bot reviewed Dec 4, 2025

View reviewed changes

cursor bot reviewed Dec 4, 2025

View reviewed changes

scripts/install.js Show resolved Hide resolved

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch from f1119df to 36bbead Compare December 10, 2025 13:31

szokeasaurusrex requested a review from a team as a code owner December 10, 2025 13:31

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch 2 times, most recently from 60bb5c0 to c7f20b7 Compare December 10, 2025 13:53

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch from a69c17c to fdc3cae Compare December 10, 2025 14:11

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch from fdc3cae to bc0a8dc Compare December 10, 2025 14:20

szokeasaurusrex removed request for a team and Lms24 December 10, 2025 14:21

szokeasaurusrex approved these changes Dec 10, 2025

View reviewed changes

sentry bot reviewed Dec 10, 2025

View reviewed changes

cursor bot reviewed Dec 10, 2025

View reviewed changes

scripts/install.js Show resolved Hide resolved

szokeasaurusrex mentioned this pull request Dec 10, 2025

meta(changelog): Update supported self-hosted version #3022

Closed

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch from c7f20b7 to d0453c4 Compare December 11, 2025 09:59

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch from bc0a8dc to 8d3aa8b Compare December 11, 2025 09:59

szokeasaurusrex mentioned this pull request Dec 11, 2025

meta(versioning): Define versioning policy #3025

Merged

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch from d0453c4 to 2c953fe Compare December 11, 2025 13:44

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch from 8d3aa8b to d7fc80e Compare December 11, 2025 13:44

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch from d7fc80e to fbd68c2 Compare December 11, 2025 16:10

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch from 2c953fe to 98e6185 Compare December 11, 2025 16:10

szokeasaurusrex mentioned this pull request Dec 11, 2025

docs(readme): Set minimum self-hosted version #3027

Merged

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch from 98e6185 to 6b32ed2 Compare December 11, 2025 16:25

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch from fbd68c2 to 004923c Compare December 11, 2025 16:25

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch from 6b32ed2 to 3679dc2 Compare December 11, 2025 17:20

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch 2 times, most recently from 5529ca5 to 7a09a4e Compare December 12, 2025 12:04

szokeasaurusrex force-pushed the jp/move-to-native-typescript branch from 0f60c1c to e06b170 Compare December 15, 2025 10:41

szokeasaurusrex force-pushed the jp/upgrade-node-fetch branch from 7a09a4e to aa1e54c Compare December 15, 2025 10:41

cursor bot reviewed Dec 15, 2025

View reviewed changes

Base automatically changed from jp/move-to-native-typescript to master December 15, 2025 11:58

szokeasaurusrex merged commit aa1e54c into master Dec 15, 2025
38 of 41 checks passed

szokeasaurusrex deleted the jp/upgrade-node-fetch branch December 15, 2025 11:59

MichaelDeBoey mentioned this pull request Jan 9, 2026

Replace fetchpolyfills with native fetch / undici e18e/ecosystem-issues#145

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

ref: Use undici to download binary #2993

ref: Use undici to download binary #2993

JPeer264 commented Nov 27, 2025 •

edited by szokeasaurusrex

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

andreiborza Dec 2, 2025

Uh oh!

linear bot commented Dec 2, 2025

Uh oh!

szokeasaurusrex Dec 2, 2025

Uh oh!

JPeer264 Dec 4, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

cursor bot Dec 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		### Internal changes

		- Removed `node-fetch` dependency when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))

	- Removed `node-fetch` dependency when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))
	- Removed `node-fetch` and `https-proxy-agent` dependencies when using the NPM package ([#2993](https://github.com/getsentry/sentry-cli/pull/2993))

Uh oh!

ref: Use undici to download binary #2993

ref: Use undici to download binary #2993

Conversation

JPeer264 commented Nov 27, 2025 • edited by szokeasaurusrex Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

andreiborza Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

linear bot commented Dec 2, 2025

Uh oh!

szokeasaurusrex Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

JPeer264 Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

cursor bot Dec 15, 2025

Choose a reason for hiding this comment

Bug: Download integrity check unreliable with compressed responses

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

JPeer264 commented Nov 27, 2025 •

edited by szokeasaurusrex

Loading