From eec82a059dcbbe0506cc7b9fffd7cae5cfc77712 Mon Sep 17 00:00:00 2001 From: Kevin Zhao Date: Tue, 14 Apr 2026 10:31:41 +0000 Subject: [PATCH] fix: drain redirect response and resolve relative URLs in downloadFile The `downloadFile` function in `github.ts` has the same two issues that were fixed in `fetchJson` (#24896): 1. The redirect response body is not consumed, which can cause socket exhaustion under repeated redirects (Node.js keeps the socket open until the response is drained or garbage collected). 2. `res.headers.location` is passed directly to the recursive call without resolving against the current URL. Relative `Location` headers (e.g. `/path/to/file`) would fail with `ERR_INVALID_URL` since `https.get` expects an absolute URL. Both fixes mirror the approach already applied to `fetchJson`. --- packages/cli/src/config/extensions/github.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/cli/src/config/extensions/github.ts b/packages/cli/src/config/extensions/github.ts index 06cf344a0d3..96b89c456a1 100644 --- a/packages/cli/src/config/extensions/github.ts +++ b/packages/cli/src/config/extensions/github.ts @@ -543,7 +543,9 @@ export async function downloadFile( new Error('Redirect response missing Location header'), ); } - downloadFile(res.headers.location, dest, options, redirectCount + 1) + res.resume(); // Drain response body to free the socket + const redirectUrl = new URL(res.headers.location, url).toString(); + downloadFile(redirectUrl, dest, options, redirectCount + 1) .then(resolve) .catch(reject); return;