Type Safe Fetch

[Nick (ingalls)]

This pull request introduces a new type-safe, SSRF-protected fetch wrapper to the codebase, enhancing security and developer experience when making HTTP requests. The wrapper ensures URLs are validated before making requests and allows for runtime response validation using TypeBox schemas. It also updates the exports and dependencies to support this feature.

New fetch wrapper and type-safe HTTP requests:

• Added a new fetch implementation in lib/fetch.ts that validates URLs for SSRF safety by default and allows disabling this check via the safeUrl option. The wrapper uses undici for HTTP requests and provides a TypedResponse class for runtime JSON validation using TypeBox schemas.
• Exported the new fetch, TypedResponse, and FetchInit types from the package entry point in index.ts.

Dependency updates:

• Added new dependencies: @openaddresses/batch-error for error handling, @sinclair/typebox for schema validation, and undici for HTTP requests in package.json.

Documentation:

• Documented the new feature in the changelog under version 1.1.0, highlighting the implementation of a type-safe fetch wrapper to prevent SSRF vulnerabilities.

[Copilot]

Pull request overview

This PR adds a new package-level fetch wrapper intended to provide SSRF-safe URL validation and optional runtime JSON response validation using TypeBox, and wires it into the public exports along with required dependency updates.

Changes:

• Added lib/fetch.ts implementing an SSRF-checking fetch wrapper plus TypedResponse.typed() for TypeBox runtime validation.
• Exported the new fetch wrapper and types from index.ts.
• Updated dependencies and changelog to reflect the new feature.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
package.json	Adds new runtime dependencies needed for type-safe fetching and validation.
package-lock.json	Locks new dependency tree for the added fetch/validation/error packages.
lib/fetch.ts	Implements SSRF validation + typed JSON parsing/validation around undici fetch.
index.ts	Exposes the new fetch wrapper and types from the package entry point.
CHANGELOG.md	Documents the new feature under a new version heading.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 4 comments.