* fix(network): strip sec-fetch-* headers to fix Azure DevOps Artifacts 400 errors
undici's fetch() automatically adds sec-fetch-* headers (e.g. sec-fetch-mode: cors)
per the Fetch spec. Azure DevOps Artifacts interprets these as browser requests and
returns HTTP 400 for uncached upstream packages. Since pnpm is a CLI tool, these
headers serve no purpose.
Adds a stripSecFetchHeaders interceptor applied to all dispatchers (global, proxy,
and non-proxy) via undici's compose() API.
Fixes#11572
* refactor: fix header types and function placement in stripSecFetchHeaders
- Widen header type from Record<string, string> to
Record<string, string | string[] | undefined> to match
Dispatcher.DispatchOptions
- Move stripSecFetchHeaders below its first use, relying on
function hoisting per codebase conventions
* refactor(network.fetch): handle iterable header form and tidy test
`Dispatcher.dispatch` accepts headers as a Map/web-Headers iterable in
addition to the flat string[] and plain object forms. The previous
object branch routed iterables through Object.entries, which would
silently drop every header for Map-like inputs. Detect Symbol.iterator
and consume the iterator directly when present.
Also drop the underscore prefix on the test's `req` parameter since it
is used.
---------
Co-authored-by: Zoltan Kochan <z@kochan.io>
