Bump undici to 5.28.2 (#742)

Addresses low severity `npm audit` warning:
GHSA-wqq4-5wpv-mx2g

Fixes #607
Fixes #738

Author: mrbbot

package-lock.json

@@ -38,7 +38,7 @@
     "@miniflare/core": "2.14.1",
     "@miniflare/shared": "2.14.1",
     "http-cache-semantics": "^4.1.0",
-    "undici": "5.20.0"
+    "undici": "5.28.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.14.1",

packages/cache/package.json

@@ -46,7 +46,7 @@
     "dotenv": "^10.0.0",
     "kleur": "^4.1.4",
     "set-cookie-parser": "^2.4.8",
-    "undici": "5.20.0",
+    "undici": "5.28.2",
     "urlpattern-polyfill": "^4.0.3"
   },
   "devDependencies": {

packages/core/package.json

@@ -796,14 +796,10 @@ class MiniflareDispatcher extends Dispatcher {
     options: Dispatcher.DispatchOptions,
     handler: Dispatcher.DispatchHandlers
   ): boolean {
+    // Remove any default fetch headers that the user didn't explicitly set,
+    // `headers` has the form `["key1", "value1", "key2", "value2", ...]`
     const headers = options.headers;
-    if (headers) {
-      // Note: I'm fully expecting this to break in future undici versions
-      // and need to be updated, but that's why we pin our undici version and
-      // have tests
-      assert(Array.isArray(headers));
-      // Remove any default fetch headers that the user didn't explicitly set,
-      // `headers` has the form `["key1", "value1", "key2", "value2", ...]`
+    if (Array.isArray(headers)) {
       let i = 0;
       while (i < headers.length) {
         if (this.removeHeaders.includes(headers[i].toLowerCase())) {
@@ -812,6 +808,10 @@ class MiniflareDispatcher extends Dispatcher {
           i += 2;
         }
       }
+    } else if (headers != null) {
+      for (const key in headers) {
+        if (this.removeHeaders.includes(key.toLowerCase())) delete headers[key];
+      }
     }
     return this.inner.dispatch(options, handler);
   }

packages/core/src/standards/http.ts

@@ -38,7 +38,7 @@
     "@miniflare/core": "2.14.1",
     "@miniflare/shared": "2.14.1",
     "@miniflare/storage-memory": "2.14.1",
-    "undici": "5.20.0"
+    "undici": "5.28.2"
   },
   "devDependencies": {
     "@miniflare/cache": "2.14.1",

packages/durable-objects/package.json

@@ -38,7 +38,7 @@
     "@miniflare/core": "2.14.1",
     "@miniflare/shared": "2.14.1",
     "html-rewriter-wasm": "^0.4.1",
-    "undici": "5.20.0"
+    "undici": "5.28.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.14.1"

packages/html-rewriter/package.json

@@ -40,7 +40,7 @@
     "@miniflare/web-sockets": "2.14.1",
     "kleur": "^4.1.4",
     "selfsigned": "^2.0.0",
-    "undici": "5.20.0",
+    "undici": "5.28.2",
     "ws": "^8.2.2",
     "youch": "^2.2.2"
   },

packages/http-server/package.json

@@ -66,7 +66,7 @@
     "kleur": "^4.1.4",
     "semiver": "^1.1.0",
     "source-map-support": "^0.5.20",
-    "undici": "5.20.0"
+    "undici": "5.28.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.14.1",

packages/miniflare/package.json

@@ -37,7 +37,7 @@
   "dependencies": {
     "@miniflare/core": "2.14.1",
     "@miniflare/shared": "2.14.1",
-    "undici": "5.20.0"
+    "undici": "5.28.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.14.1"

packages/r2/package.json

@@ -41,7 +41,7 @@
     "@miniflare/queues": "2.14.1",
     "@miniflare/shared": "2.14.1",
     "@miniflare/shared-test-environment": "2.14.1",
-    "undici": "5.20.0"
+    "undici": "5.28.2"
   },
   "peerDependencies": {
     "vitest": ">=0.23.0"