feat!: update undici to v8 (Node.js >=22.19), configurable request timeouts

[line-o]

Closes #398, closes #401. Supersedes #392.

Three commits, meant to be merged as they are (not squashed) so semantic-release sees the breaking change, the feature and the fix.

1. feat!: require Node.js 22.19 and update undici to v8

• undici ^8.10.2, engines >=22.19.0 (not ^22.19.0, which would exclude Node 24 and 26)
• CI matrix [22, 24, 26], Node 20 dropped
• undici 8 fails on import under Node 20 (TypeError: webidl.util.markAsUncloneable is not a function, see the CI of chore: bump undici from 7.25.0 to 8.5.0 #392), so this is a real breaking change
• undici 8's breaking changes checked against our usage: legacy handler wrappers are gone (our interceptors only pass the handler through), non-real Blob bodies are rejected (not used), interceptors.responseError is unchanged
• HTTP/2 is now negotiated by default: eXist 6 answers with HTTP/1.1, eXist 7 selects h2 on its TLS port, and REST and XML-RPC both work over it

2. feat: make request timeouts configurable, wait indefinitely by default

undici aborts a request after 300 seconds without response headers or without a body chunk, which cut off long running queries and package installations.

• connection option timeout in milliseconds, 0 waits indefinitely; the default is now 0
• readOptionsFromEnv reads EXISTDB_TIMEOUT
• per call: timeout in the options of queries.execute, read, readAll and REST post overrides the connection timeout and is not sent to the database; methodCall(name, params, { timeout })
• app.upload, install, deploy and remove never time out
• documented in the README
• REST post no longer deletes attribute options from the object passed in

3. fix(rest): send non-ASCII strings with put and post

put and post set content-length to body.length, which counts characters, not bytes. Any non-ASCII string failed with UND_ERR_REQ_CONTENT_LENGTH_MISMATCH, with undici 7 as well. undici derives the header from the body itself, so it is no longer set by hand. Streams were already sent without it.

Testing

Locally against existdb/existdb:6.4.0:

Node	suite
22.19.0	123/123
24.10.0	123/123
26.8.1	123/123

New specs: spec/tests/timeout.js (24 tests) and a non-ASCII block in spec/tests/rest.js (3 tests).

Against existdb/existdb:latest (7.0.0-SNAPSHOT, h2): timeout.js 24/24 and the non-ASCII REST tests pass. The full suite fails 7 tests there, identically with undici 7 on main: eXist 7 behaviour changes (EXPATH007 error message, XML declaration serialized by default, REST start/max/cache), see #339.

The release cells in CI have failed on every PR since June (e.g. #391, #394), independent of this change.

Downstream

xst and gulp-exist depend on ^7.0.0 and keep working until they opt in. Adopting 8.0.0 requires Node.js >=22.19 there as well.

🤖 Generated with Claude Code

https://claude.ai/code/session_016bdrW9vpnvJkeBtS1UZ92E

[codacy-production]

Not up to standards ⛔

🔴 Issues 8 minor

Alerts:
⚠ 8 issues (≤ 0 issues of at least minor severity)

Results:
8 new issues

Category	Results
CodeStyle	8 minor

View in Codacy

🟢 Metrics 34 complexity · 0 duplication

Metric	Results
Complexity	34
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}