refactor: replace node-fetch/nock with undici by sjinks · Pull Request #2837 · Automattic/vip-cli

sjinks · 2026-05-11T23:21:09Z

Description

nock is unreliable and does not play well with Jest. There is an unresolved issue: nock/nock#2802, and we're fighting with nock in #7153 and #2821 in API repo.

We remove nock and node-fetch in favor of undici. The best thing about undici is that it comes with built-in testing capabilities, and we don't need another dependency that may or may not work with our test setup.

Remove node-fetch, nock, and fetch-retry dependencies
Add undici as the sole fetch/mock runtime
Migrate all runtime fetch calls (api/http, analytics, dev-environment-core, client-file-uploader) to undici fetch
Replace CommonJS fetch-retry wrapper with a local exponential backoff helper in client-file-uploader
Use node:timers/promises setTimeout in retry.ts and client-file-uploader (eliminates manual Promise wrapping)
Add src/lib/http/proxy-dispatcher.ts for undici-compatible proxy support (ProxyAgent)
Replace jest.setup.js nock setup with undici MockAgent as a global dispatcher; add test-utils/undici-mock.js helper
Migrate all nock-based tests to undici MockPool interceptors
Remove nock lifecycle calls from DevEnv E2E specs

Pull request checklist

Update SETUP.md with any new environmental variables.
Update the documentation.
Manually test the relevant changes.
Follow the pull request checklist
Add/update automated tests as needed.

New release checklist

Automated tests pass.
The Preparing for release checklist is completed.

Steps to Test

Surprisingly, CI must pass.

github-actions · 2026-05-11T23:21:29Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

package.json

Package	Version	License	Issue Type
undici	^7.0.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/undici	^7.0.0	Unknown	Unknown

Scanned Files

package.json

Copilot

Pull request overview

This PR migrates VIP CLI’s HTTP stack from node-fetch + nock to undici for both runtime fetches and test-time request mocking, and introduces an undici-compatible proxy dispatcher.

Changes:

Replace node-fetch usage across runtime codepaths with undici.fetch, including proxy support via a new createProxyDispatcher().
Replace nock-based Jest test mocking with an undici MockAgent global dispatcher and MockPool interceptors.
Remove fetch-retry and implement a local retry helper (plus node:timers/promises usage) for upload operations.

Reviewed changes

Copilot reviewed 29 out of 30 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
test-utils/undici-mock.js	Adds helpers to access/reset the global undici mock dispatcher/pools in tests.
src/lib/tracker.ts	Removes `node-fetch` import while keeping analytics tracking plumbing.
src/lib/retry.ts	Switches delay implementation to `node:timers/promises` `setTimeout`.
src/lib/http/proxy-dispatcher.ts	New undici `ProxyAgent`-based dispatcher factory for proxy support.
src/lib/dev-environment/dev-environment-core.ts	Migrates WordPress versions manifest fetch to undici + dispatcher proxy support.
src/lib/client-file-uploader.ts	Migrates to undici `fetch` and replaces `fetch-retry` with a local retry loop.
src/lib/api/http.ts	Migrates API HTTP wrapper from `node-fetch` to undici + proxy dispatcher.
src/lib/api.ts	Removes `FetchError` dependency and adjusts retry predicate for connection-refused errors.
src/lib/analytics/index.ts	Removes `node-fetch` type import while keeping analytics aggregation logic.
src/lib/analytics/clients/tracks.ts	Migrates Tracks client to undici `fetch` and keeps Response typing local.
src/lib/analytics/clients/pendo.ts	Removes `node-fetch` type import for Pendo client.
src/lib/analytics/clients/client.ts	Removes `node-fetch` type import from the analytics client interface.
package.json	Drops `node-fetch`, `nock`, `fetch-retry`; adds `undici`.
npm-shrinkwrap.json	Updates lockfile to reflect dependency removals/additions (including undici).
jest.setup.js	Replaces nock global setup with undici `MockAgent` dispatcher + proxy env cleanup.
tests/lib/validations/sql.js	Removes `node-fetch` mocking previously used in this suite.
tests/lib/validations/is-multisite-domain-mapped.js	Migrates GraphQL request mocking from nock to undici MockPool.
tests/lib/search-and-replace.js	Removes `node-fetch` mocking previously used in this suite.
tests/lib/dev-environment/dev-environment-cli.js	Replaces nock-based versions manifest mocking with a `getVersionList` spy.
tests/lib/api-retry.ts	Updates retry tests to no longer depend on `FetchError`.
tests/lib/analytics/clients/tracks.js	Migrates Tracks client tests from nock to undici MockPool assertions.
tests/devenv-e2e/002-destroy.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/003-start.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/004-stop.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/006-list.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/007-info.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/008-exec.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/010-import-sql.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/011-logs.spec.js	Removes nock lifecycle calls from dev-env E2E spec.
tests/devenv-e2e/012-shell.spec.js	Removes nock lifecycle calls from dev-env E2E spec.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

Copilot

Pull request overview

Copilot reviewed 30 out of 31 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

Copilot

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

Copilot

Pull request overview

Copilot reviewed 33 out of 34 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

Copilot

Pull request overview

Copilot reviewed 33 out of 34 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

Copilot

Pull request overview

Copilot reviewed 33 out of 34 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

Copilot

Pull request overview

Copilot reviewed 33 out of 34 changed files in this pull request and generated no new comments.

Files not reviewed (1)

npm-shrinkwrap.json: Language not supported

sjinks · 2026-05-12T02:37:39Z

This will close #2821

- Remove node-fetch, nock, and fetch-retry dependencies - Add undici as the sole fetch/mock runtime - Migrate all runtime fetch calls (api/http, analytics, dev-environment-core, client-file-uploader) to undici fetch - Replace CommonJS fetch-retry wrapper with a local exponential backoff helper in client-file-uploader - Use node:timers/promises setTimeout in retry.ts and client-file-uploader (eliminates manual Promise wrapping) - Add src/lib/http/proxy-dispatcher.ts for undici-compatible proxy support (ProxyAgent) - Replace jest.setup.js nock setup with undici MockAgent as global dispatcher; add test-utils/undici-mock.js helper - Migrate all nock-based tests to undici MockPool interceptors - Remove nock lifecycle calls from devenv e2e specs

sonarqubecloud · 2026-06-09T19:44:47Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…e client trunk replaced node-fetch with undici (#2837), so in the PR merge ref the node-fetch types no longer resolve and type-aware lint flags every member access as unsafe. Derive the response type from http() instead, which tracks whichever fetch implementation the merged tree uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sjinks self-assigned this May 11, 2026

github-advanced-security AI found potential problems May 11, 2026

View reviewed changes

Comment thread src/lib/client-file-uploader.ts Fixed

Comment thread src/lib/client-file-uploader.ts Fixed

sjinks force-pushed the migrate/undici branch from fb20648 to 9a6c6b4 Compare May 11, 2026 23:41

sjinks marked this pull request as ready for review May 11, 2026 23:46

Copilot AI review requested due to automatic review settings May 11, 2026 23:46

Copilot started reviewing on behalf of sjinks May 11, 2026 23:47 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

sjinks force-pushed the migrate/undici branch from 7fcce7d to ce88817 Compare May 12, 2026 00:26

sjinks requested a review from Copilot May 12, 2026 00:26

Copilot started reviewing on behalf of sjinks May 12, 2026 00:27 View session