build(deps): bump ky from 1.12.0 to 2.2.0

[dependabot]

Bumps ky from 1.12.0 to 2.2.0.

Release notes

Sourced from ky's releases.

v2.2.0

[!NOTE] In init hooks, options.headers now has lowercase names. Read and delete headers with lowercase names, for example delete options.headers.authorization.

Improvements

• Add maxResponseSize option 0d59458
  • Limits the response body size in bytes, counted after decompression. Exceeding it throws the new ResponseSizeError.
• Let beforeRetry hooks change options for the next attempts (#885) 242c327
  • Return {options: {...}} to change onUploadProgress, onDownloadProgress, timeout, fetch, or throwHttpErrors. For example, retry a failed upload without upload progress.
• Respect Retry-After and rate-limit headers when retry.shouldRetry returns true d1c921f
• Run beforeError hooks for errors thrown while reading the response body 323b98f 50c3810
  • A connection that drops while .json(), .text(), etc. reads the body is now a NetworkError.
• Support onUploadProgress and streamed Request bodies in Bun and Deno 83c711c
• Validate options and report clear errors 3ded2aa
  • Invalid options now throw a TypeError that names the option, instead of being silently ignored or failing later with an internal error. This includes null, non-array hooks, and invalid timeout and retry values.
  • Invalid options and errors thrown by init hooks now reject the returned promise instead of throwing synchronously.
• Improve TypeScript types 51b3177 52b8f93 f4886ca 481f6f7
  • Accept readonly arrays and explicit undefined for all options, allow custom error names, and fix the .clone() and .bytes() return types.

Fixes

• Fix aborts and timeouts in many edge cases e1b088e 2f0a3fb 7c1272b 82fa84c 3f0e330
  • User aborts and timeouts now also cancel requests returned from hooks, interrupt pending hooks and body reads, and are no longer reported as NetworkError and retried in Chromium. totalTimeout is now enforced when the response or body arrives after the deadline.
• Fix searchParams with a Request input dropping its body and options such as credentials b4bdecc 4e0bf0b
• Fix option merging in .extend() and init hooks e06d351 0655b9d c5dc4e6 88e2432
  • Class instances, such as an undici Agent as dispatcher or a Date in json, are no longer turned into plain objects. Header names are now matched case-insensitively. Changes made in .extend() callbacks and init hooks no longer leak into other requests.
• Fix many replaceOption() edge cases cc9b5a3 d6e049a deb5a33
• Fix parseJson being ignored by response.clone().json() and when using onDownloadProgress c6c5dbf 015ef95
• Fix progress events, including wrong totalBytes for compressed responses and missing response properties with onDownloadProgress d89c8c8 e893f16 de278ae
• Fix onUploadProgress breaking uploads without request stream support, and keepalive and no-cors requests 6520f64 06ebf18
• Fix fetch: window.fetch throwing "Illegal invocation" in browsers 92ef60e
• Fix isTimeoutError() and the other type guards matching unrelated errors with the same name d636438
• Fix request on Ky errors being an internal clone instead of the request that was sent 619c427 ec3d17f

---

sindresorhus/ky@v2.1.0...v2.2.0

v2.1.0

Improvements

• Add QUERY method support (#873) 6edddd9
• Allow parseJson to handle empty bodies (#877) 294fe63
• Reject malformed HTTP URLs with baseUrl be60db5
• Improve Retry-After handling (#874) 3419113
• Harden retry c426f19

Fixes

... (truncated)

Commits

• 3541888 2.2.0
• 242c327 Let a beforeRetry hook change per-attempt options
• d9ddb03 Fix CI
• d93adf8 Run the browser tests and static checks once in CI
• a5ed57b Refactor
• 7f0137d Report the sent request for a hook's response, and finish the cross-realm and...
• 13c8da5 Stop surfacing progress callback errors
• 55599c8 Run beforeError for a beforeRetry abort and share the body-wrapping check
• 3ded2aa Tweaks
• 692c435 Restore the retry-only marker condition and cover the remaining cases
• Additional commits viewable in compare view

[grzanka]

@dependabot rebase

[grzanka]

@dependabot rebase

[grzanka]

@dependabot rebase

[martastn]

@dependabot rebase

[grzanka]

@dependabot rebase

[martastn]

@dependabot rebase

[martastn]

@dependabot rebase

[martastn]

Review: ky 1.12.0 → 2.2.0

Verdict: safe to merge after fix, do not merge as-is: the build fails, and even a forced build sends no request to the backend.

TL;DR

ky is the HTTP client behind all frontend ↔ backend communication: login and logout, the "Connected" indicator, the simulations list, submitting and deleting simulations, results and the error snackbars. 2.0 is a major release with breaking API changes, and two of them hit our only ky setup in src/services/AuthService.tsx. The proposed patch (AuthService.tsx only, ~30 lines) moves us to the new API and keeps current behavior exactly. That is verified request by request against v1.

How we use ky

• One instance is created in src/services/AuthService.tsx:101 (ky.create) with:
  • prefixUrl: backendUrl: every call is relative to the backend URL.
  • a custom parseJson: converts snake_case to camelCase on every response.
  • an afterResponse hook: on status >300 it reads the backend message, shows it as an error snackbar and rejects with the Response.
  • .extend({ retry: 0 }): used for the periodic "is the server alive" and token refresh calls.
• The same instance is passed to RemoteWorkerSimulationService (jobs, inputs, results, estimators, logfiles, user simulations, delete).
• Nothing else imports ky. The editor, examples, converter and demo mode don't use it.

What changed in ky (1.13 → 2.2) and whether it affects us

Change	Affects us?
prefixUrl renamed to prefix (#606). Since 2.2.0 options are validated, so passing prefixUrl rejects every request with "The prefixUrl option has been renamed prefix…" (3ded2aa).	🔴 Yes, blocking. Without the fix not a single request leaves the browser, so login, simulations and results are all broken.
Hooks get a single state object ({request, options, response, retryCount}) instead of positional args (#827).	🔴 Yes. Our 3-arg afterResponse hook fails tsc with TS2322 (AuthService.tsx:115), so npm run build fails and CI on this PR will be red. If the type error were ignored, response would be undefined and no error snackbar would ever show.
Errors thrown or rejected in afterResponse are now fatal, not retried (#834).	🟠 Yes, subtle. Our hook rejects on every error status. In v1 that rejection went through ky's retry loop, so a failing GET/DELETE was attempted 3× (at 0 / +0.3 s / +0.9 s) and showed up to 3 snackbars. v2 makes 1 attempt and shows 1 snackbar. That is a behavior and UI change, so the fix restores the v1 behavior with ky.retry().
.json() throws on empty bodies and 204 (#854); parseJson now also receives empty strings (#877).	🟠 Potentially. v1 returned '' for an empty successful response, v2 would throw SyntaxError from our JSON.parse. The fix returns '' for an empty 2xx body, as before.
searchParams are merged with an existing query string instead of replacing it (#840).	🟢 No. None of our inputs contains ?, and the generated URLs are byte-identical.
Network failures throw the new NetworkError instead of TypeError (#842).	🟢 No UI impact: we never check the error class. Only the console.error text changes (RemoteWorkerSimulationService.ts:355, :555).
beforeError gets all error types; Ky-specific options are stripped from the options passed to hooks.	🟢 No. We don't use beforeError, and the hook only reads options.retry, which is still there.
New features: baseUrl, totalTimeout, maxResponseSize, init hook, HTTPError.data, Standard Schema, QUERY method, ky.retry() (1.14).	🟢 Not used, except ky.retry() in the fix.
Many fixes for aborts, timeouts, .extend() option merging and progress events.	🟢 None changes our paths: signal, timeout: 30000 and .extend({retry: 0}) behave identically (tested).
Requires Node ≥ 22.	🟢 We use 24 (engines, Dockerfile node:24, CI 24.x).
Security / CVE	None mentioned in any release note.
CSS / markup	None: ky has no UI.
Bundle	Main chunk +21.8 kB raw / +7.2 kB gzip (~+0.4%).

Proposed fix (src/services/AuthService.tsx only)

1. prefixUrl: backendUrl → prefix: backendUrl. It builds the same URL for a base URL with a trailing slash, without one, and with a subpath.
2. The hook signature becomes async ({ request, options, response, retryCount }) => …. The hook body is unchanged, just wrapped in try/catch.
3. In catch: if the method is retriable (options.retry.methods) and retryCount < options.retry.limit, return ky.retry(); otherwise rethrow the original error (the same Response as v1). This reproduces v1's retry count, delays (300/600 ms) and snackbars. The retry: 0 instance still makes a single attempt.
4. parseJson(text, { response }): if text === '' and response.ok, return '' (v1 behavior). Empty error bodies still throw, as in v1.

Verification

	master	bump as-is	bump + fix
tsc --noEmit	baseline	+4 errors	no new errors
CI=true npm test (39) (flaky)	36 ✅ / 2 ❌	35 ✅ / 3 ❌	35 ✅ / 3 ❌
npm run build	✅	❌ TS2322	✅, same warnings

• Jest failures are environmental and not from the bump: the ShieldhitConverter fixture lives in a missing submodule, and the two Selenium tests hit whatever runs on :3000. No test imports ky.
• Node harness running our exact ky.create config with v1.12.0 and with v2.2.0 + fix against a local server: 59 scenarios identical. Covered: URLs (3 base URL forms), query params, JSON body, Authorization header, snake→camel parsing, 400/401/403/500/503 (attempt count and snackbars), 204 and empty body, abort, timeout, network down, retry: 0. The only difference is the TypeError→NetworkError class name.
• Manual UI diff vs master (production builds against a mock yaptide backend, plus demo mode): login ok and failed, "Connected" indicator, simulations list, results (JSROOT 1D/2D), submit rejected (400), delete failing (500: 3 attempts and 3 snackbars on both), examples, 3D editor, save dialog, converter output (identical text hash), light and dark theme, 375 px width. No visual or functional differences. The backend received the same requests (method, path, query, status) from both versions.
• Bump without the fix (forced build): login with valid credentials shows only "Login failed.", and the backend receives 0 requests.

Backend testing

The fix guarantees the backend receives exactly the same requests as from master, so no backend change is needed. Before merging, it's still worth a ~5-minute smoke test on dev/staging with the real backend, because this code path carries all backend traffic and the mock can't reproduce every real response:

• log in and out (local account; Keycloak/PLGrid if available)
• "Connected" indicator, and staying logged in for >3 min (token refresh)
• simulations list loads; open results (1D + 2D plots)
• submit a simulation; cancel or delete one
• wrong password shows the backend message in a snackbar, as on master