Upgrade http dependencies (elastic#180986)

Co-authored-by: florent-leborgne <[email protected]>
Co-authored-by: Rudolf Meijering <[email protected]>

docs/setup/settings.asciidoc

@@ -450,7 +450,7 @@ responses to the client from the {kib} server, and specifies what value is used.
 Header names and values to send on all responses to the client from the {kib} server. *Default: `{}`*
 
 [[server-shutdownTimeout]] `server.shutdownTimeout`::
-Sets the grace period for {kib} to attempt to resolve any ongoing HTTP requests after receiving a `SIGTERM`/`SIGINT` signal, and before shutting down. Any new HTTP requests received during this period are rejected with a `503` response. *Default: `30s`*
+Sets the grace period for {kib} to attempt to resolve any ongoing HTTP requests after receiving a `SIGTERM`/`SIGINT` signal, and before shutting down. Any new HTTP requests received during this period are rejected, because the incoming socket is closed without further processing. *Default: `30s`*
 
 [[server-host]] `server.host`::
 This setting specifies the host of the

package.json

@@ -142,14 +142,14 @@
     "@formatjs/ts-transformer": "^3.13.14",
     "@google/generative-ai": "^0.7.0",
     "@grpc/grpc-js": "^1.8.22",
-    "@hapi/accept": "^5.0.2",
-    "@hapi/boom": "^9.1.4",
-    "@hapi/cookie": "^11.0.2",
-    "@hapi/h2o2": "^9.1.0",
-    "@hapi/hapi": "^20.2.2",
-    "@hapi/hoek": "^9.2.1",
-    "@hapi/inert": "^6.0.4",
-    "@hapi/wreck": "^17.1.0",
+    "@hapi/accept": "^6.0.3",
+    "@hapi/boom": "^10.0.1",
+    "@hapi/cookie": "^12.0.1",
+    "@hapi/h2o2": "^10.0.4",
+    "@hapi/hapi": "^21.3.10",
+    "@hapi/hoek": "^11.0.4",
+    "@hapi/inert": "^7.1.0",
+    "@hapi/wreck": "^18.1.0",
     "@hello-pangea/dnd": "16.6.0",
     "@kbn/aad-fixtures-plugin": "link:x-pack/test/alerting_api_integration/common/plugins/aad",
     "@kbn/ace": "link:packages/kbn-ace",
@@ -1058,7 +1058,7 @@
     "blurhash": "^2.0.1",
     "borc": "3.0.0",
     "brace": "0.11.1",
-    "brok": "^5.0.2",
+    "brok": "^6.0.0",
     "byte-size": "^8.1.0",
     "cacheable-lookup": "6",
     "camelcase-keys": "7.0.2",
@@ -1553,10 +1553,7 @@
     "@types/geojson": "^7946.0.10",
     "@types/getos": "^3.0.0",
     "@types/gulp": "^4.0.6",
-    "@types/hapi__cookie": "^10.1.3",
-    "@types/hapi__h2o2": "^8.3.3",
-    "@types/hapi__hapi": "^20.0.9",
-    "@types/hapi__inert": "^5.2.3",
+    "@types/hapi__cookie": "^12.0.5",
     "@types/has-ansi": "^3.0.0",
     "@types/he": "^1.1.1",
     "@types/history": "^4.7.9",

packages/core/http/core-http-router-server-internal/src/router.ts

@@ -270,18 +270,24 @@ export class Router<Context extends RequestHandlerContextBase = RequestHandlerCo
   }: {
     request: Request;
     responseToolkit: ResponseToolkit;
-    handler: RequestHandlerEnhanced<P, Q, B, typeof request.method>;
+    handler: RequestHandlerEnhanced<
+      P,
+      Q,
+      B,
+      // request.method's type contains way more verbs than we currently support
+      typeof request.method extends RouteMethod ? typeof request.method : any
+    >;
     routeSchemas?: RouteValidator<P, Q, B>;
   }) {
-    let kibanaRequest: KibanaRequest<P, Q, B, typeof request.method>;
+    let kibanaRequest: KibanaRequest<
+      P,
+      Q,
+      B,
+      typeof request.method extends RouteMethod ? typeof request.method : any
+    >;
     const hapiResponseAdapter = new HapiResponseAdapter(responseToolkit);
     try {
-      kibanaRequest = CoreKibanaRequest.from(request, routeSchemas) as KibanaRequest<
-        P,
-        Q,
-        B,
-        typeof request.method
-      >;
+      kibanaRequest = CoreKibanaRequest.from(request, routeSchemas);
     } catch (error) {
       this.logError('400 Bad Request', 400, { request, error });
       return hapiResponseAdapter.toBadRequest(error.message);

packages/core/http/core-http-server-internal/src/cookie_session_storage.ts

@@ -121,12 +121,12 @@ export async function createCookieSessionStorageFactory<T extends object>(
         }
       },
     },
-    validateFunc: async (req: Request, session: T | T[]) => {
+    validate: async (req: Request, session: T | T[]) => {
       const result = cookieOptions.validate(session);
       if (!result.isValid) {
         clearInvalidCookie(req, result.path);
       }
-      return { valid: result.isValid };
+      return { isValid: result.isValid };
     },
   });
 

packages/core/http/core-http-server-internal/src/http_server.ts

@@ -15,7 +15,6 @@ import { createServer, getServerOptions, setTlsConfig, getRequestId } from '@kbn
 import type { Duration } from 'moment';
 import { Observable, Subscription, firstValueFrom, pairwise, take } from 'rxjs';
 import apm from 'elastic-apm-node';
-// @ts-expect-error no type definition
 import Brok from 'brok';
 import type { Logger, LoggerFactory } from '@kbn/logging';
 import type { InternalExecutionContextSetup } from '@kbn/core-execution-context-server-internal';
@@ -722,7 +721,6 @@ export class HttpServer {
         // validation applied in ./http_tools#getServerOptions
         // (All NP routes are already required to specify their own validation in order to access the payload)
         validate,
-        // @ts-expect-error Types are outdated and doesn't allow `payload.multipart` to be `true`
         payload: [allow, override, maxBytes, output, parse, timeout?.payload].some(
           (x) => x !== undefined
         )

packages/kbn-securitysolution-es-utils/src/transform_error/index.ts

@@ -8,7 +8,7 @@
  */
 
 import { errors } from '@elastic/elasticsearch';
-import Boom from '@hapi/boom';
+import type { Boom } from '@hapi/boom';
 import { stringifyZodError } from '@kbn/zod-helpers';
 import { ZodError } from '@kbn/zod';
 import { BadRequestError } from '../bad_request_error';
@@ -18,8 +18,15 @@ export interface OutputError {
   statusCode: number;
 }
 
+// We can't import `isBoom` from @hapi/boom today because we get transpilation errors in Webpack 4
+// due to the usage of the operator ?? inside the `@hapi/boom` library and its dependencies.
+// TODO: Might be able to use the library's `isBoom` when Webpack 5 is merged (https://github.com/elastic/kibana/pull/191106)
+function isBoom(err: unknown): err is Boom {
+  return err instanceof Error && `isBoom` in err && !!err.isBoom;
+}
+
 export const transformError = (err: Error & Partial<errors.ResponseError>): OutputError => {
-  if (Boom.isBoom(err)) {
+  if (isBoom(err)) {
     return {
       message: err.output.payload.message,
       statusCode: err.output.statusCode,

packages/kbn-server-http-tools/src/default_validation_error_handler.ts

@@ -7,7 +7,7 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-import { Lifecycle, Request, ResponseToolkit, Util } from '@hapi/hapi';
+import { Lifecycle, Request, ResponseToolkit, Utils } from '@hapi/hapi';
 import { ValidationError } from 'joi';
 import Hoek from '@hapi/hoek';
 
@@ -17,7 +17,7 @@ import Hoek from '@hapi/hoek';
 export interface HapiValidationError extends ValidationError {
   output: {
     statusCode: number;
-    headers: Util.Dictionary<string | string[]>;
+    headers: Utils.Dictionary<string | string[]>;
     payload: {
       statusCode: number;
       error: string;

renovate.json

@@ -134,6 +134,15 @@
       "minimumReleaseAge": "7 days",
       "enabled": true
     },
+    {
+      "groupName": "HAPI ecosystem",
+      "matchDepNames": ["@hapi/**", "brok"],
+      "reviewers": ["team:kibana-core"],
+      "matchBaseBranches": ["main"],
+      "labels": ["release_note:skip", "Team:Core", "backport:prev-minor"],
+      "minimumReleaseAge": "7 days",
+      "enabled": true
+    },
     {
       "groupName": "babel",
       "matchDepNames": ["@types/babel__core"],

src/core/server/integration_tests/http/http_server.test.ts

@@ -99,8 +99,8 @@ describe('Http server', () => {
       expect(response.header.connection).toBe('close');
     });
 
-    test('any requests triggered while stopping should be rejected with 503', async () => {
-      const [, , response] = await Promise.all([
+    test('any requests triggered while stopping should be rejected', async () => {
+      await Promise.all([
         // Trigger a request that should hold the server from stopping until fulfilled (otherwise the server will stop straight away)
         supertest(innerServerListener).post('/'),
         // Stop the server while the request is in progress
@@ -111,16 +111,11 @@ describe('Http server', () => {
         // Trigger a new request while shutting down (should be rejected)
         (async () => {
           await new Promise((resolve) => setTimeout(resolve, (2 * shutdownTimeout) / 3));
-          return supertest(innerServerListener).post('/');
+          const request = supertest(innerServerListener).post('/');
+          await expect(request).rejects.toThrow('socket hang up');
+          await request.catch((err) => expect(err.code).toBe('ECONNRESET'));
         })(),
       ]);
-      expect(response.status).toBe(503);
-      expect(response.body).toStrictEqual({
-        statusCode: 503,
-        error: 'Service Unavailable',
-        message: 'Kibana is shutting down and not accepting new incoming requests',
-      });
-      expect(response.header.connection).toBe('close');
     });
 
     test('when no ongoing connections, the server should stop without waiting any longer', async () => {

x-pack/plugins/security_solution/scripts/endpoint/api_emulator/lib/emulator_server.types.ts

@@ -31,7 +31,7 @@ export interface EmulatorServerPluginRegisterOptions<TServices extends Record<st
 }
 
 export interface EmulatorServerPlugin<TServices extends Record<string, any> = any>
-  extends Omit<HapiTypes.PluginBase<unknown>, 'register'> {
+  extends Omit<HapiTypes.PluginBase<unknown, unknown>, 'register'> {
   register: (options: EmulatorServerPluginRegisterOptions<TServices>) => void | Promise<void>;
   name: string;
   /**