Replace vendored http-proxy with httpxy

package.json

@@ -338,7 +338,6 @@
       "@types/node@20.17.6": "patches/@types__node@20.17.6.patch",
       "taskr@1.1.0": "patches/taskr@1.1.0.patch",
       "minizlib@3.1.0": "patches/minizlib@3.1.0.patch",
-      "http-proxy@1.18.1": "patches/http-proxy@1.18.1.patch",
       "web-vitals@4.2.1": "patches/web-vitals@4.2.1.patch",
       "@rspack/core@1.6.7": "patches/@rspack__core@1.6.7.patch",
       "@modelcontextprotocol/sdk": "patches/@modelcontextprotocol__sdk.patch",

packages/next/package.json

@@ -267,10 +267,10 @@
     "fresh": "0.5.2",
     "glob": "7.1.7",
     "gzip-size": "5.1.1",
-    "http-proxy": "1.18.1",
     "http-proxy-agent": "5.0.0",
     "https-browserify": "1.0.0",
     "https-proxy-agent": "5.0.1",
+    "httpxy": "0.5.5",
     "icss-utils": "5.1.0",
     "ignore-loader": "0.1.2",
     "image-size": "1.2.1",

packages/next/src/bundles/httpxy/index.js

@@ -0,0 +1,3 @@
+// httpxy only ships an ESM entry point. Re-export it through this CJS entry
+// so ncc emits a CommonJS bundle that the server runtime can `require()`.
+module.exports = require('httpxy')

packages/next/src/compiled/httpxy/LICENSE

@@ -0,0 +1,46 @@
+MIT License
+
+Copyright (c) Pooya Parsa <pooya@pi0.io>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+----
+
+Based on http-party/node-http-proxy (9b96cd7)
+
+Copyright (c) 2010-2016 Charlie Robbins, Jarrett Cruger & the Contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

packages/next/src/compiled/httpxy/package.json

@@ -0,0 +1 @@
+{"name":"httpxy","main":"index.js","license":"MIT"}

packages/next/src/server/lib/router-utils/proxy-request.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'http'
+import type { Socket } from 'net'
 import type { NextUrlWithParsedQuery } from '../../request-meta'
 
 import url from 'url'
@@ -19,14 +20,10 @@ export async function proxyRequest(
   parsedUrl.search = stringifyQuery(req as any, query)
 
   const target = url.format(parsedUrl)
-  // Keep in mind that a WHATWG URL's hostname and the parsedUrl's hostname
-  // are not strictly equal due to lowercasing, IDN translation, IPv4 and IPv6 normalization, etc.
-  // We just make sure this is a valid URL since http-proxy doesn't validate.
-  new URL(target)
-  const HttpProxy =
-    require('next/dist/compiled/http-proxy') as typeof import('next/dist/compiled/http-proxy')
-
-  const proxy = new HttpProxy({
+  const { ProxyServer } =
+    require('next/dist/compiled/httpxy') as typeof import('next/dist/compiled/httpxy')
+
+  const proxy = new ProxyServer({
     target,
     changeOrigin: true,
     ignorePath: true,
@@ -41,7 +38,7 @@ export async function proxyRequest(
 
   let finished = false
 
-  // http-proxy does not properly detect a client disconnect in newer
+  // httpxy does not properly detect a client disconnect in newer
   // versions of Node.js. This is caused because it only listens for the
   // `aborted` event on the our request object, but it also fully reads
   // and closes the request object. Node **will not** fire `aborted` when
@@ -108,7 +105,7 @@ export async function proxyRequest(
         }
       })
     })
-    proxy.ws(req, res, upgradeHead)
+    proxy.ws(req, res as Socket, {}, upgradeHead)
     detached.resolve(true)
   } else {
     proxy.on('proxyReq', (proxyReq) => {

packages/next/taskfile.js

@@ -1202,17 +1202,13 @@ export async function ncc_gzip_size(task, opts) {
     .ncc({ packageName: 'gzip-size', externals })
     .target('src/compiled/gzip-size')
 }
-externals['http-proxy'] = 'next/dist/compiled/http-proxy'
-// The patched http-proxy (patches/http-proxy@1.18.1.patch) uses Next.js'
-// parseUrl instead of the deprecated url.parse. Keep that import pointing at
-// next's own dist instead of bundling a copy.
-externals['next/dist/shared/lib/router/utils/parse-url'] =
-  'next/dist/shared/lib/router/utils/parse-url'
-export async function ncc_http_proxy(task, opts) {
-  await task
-    .source(relative(__dirname, require.resolve('http-proxy')))
-    .ncc({ packageName: 'http-proxy', externals })
-    .target('src/compiled/http-proxy')
+externals['httpxy'] = 'next/dist/compiled/httpxy'
+export async function ncc_httpxy(task, opts) {
+  await task
+    // httpxy is ESM-only, compile to CJS through a stub entry
+    .source('src/bundles/httpxy/index.js')
+    .ncc({ packageName: 'httpxy', externals, esm: false })
+    .target('src/compiled/httpxy')
 }
 externals['ignore-loader'] = 'next/dist/compiled/ignore-loader'
 export async function ncc_ignore_loader(task, opts) {
@@ -2291,7 +2287,7 @@ export async function ncc(task, opts) {
         'ncc_fresh',
         'ncc_glob',
         'ncc_gzip_size',
-        'ncc_http_proxy',
+        'ncc_httpxy',
         'ncc_ignore_loader',
         'ncc_is_animated',
         'ncc_ipaddr_js',

packages/next/types/$$compiled.internal.d.ts

@@ -682,8 +682,8 @@ declare module 'next/dist/compiled/gzip-size' {
   import m from 'gzip-size'
   export = m
 }
-declare module 'next/dist/compiled/http-proxy' {
-  import m from 'http-proxy'
+declare module 'next/dist/compiled/httpxy' {
+  import * as m from 'httpxy'
   export = m
 }
 declare module 'next/dist/compiled/is-docker' {