[brianathere]

Developers can exercise HTTP/3 asset requests while webpack-dev-server keeps its normal HTTP/2/HTTP/1.1 listener, middleware, and WSS hot updates. This draft adds a standalone, opt-in example using @currentspace/http3 0.9.3. Related to the historical QUIC request in #4976 and its suggested extension approach.

The primary server advertises a loopback HTTP/3 companion through Alt-Svc. The companion forwards requests through verified HTTPS to the existing middleware, preserves compressed bytes and cookies, and closes its upstream streams on cancellation. Stopping it withdraws the advertisement and leaves the primary listener available for HTTP/2 fallback.

The example has its own pinned dependencies and npm lockfile. The published webpack-dev-server package, core server implementation, default dependencies, and Node requirement are unchanged. This is a draft for feedback on whether this optional example belongs here; it does not add a new built-in server option.

Validation

On macOS ARM64, all six focused tests passed on Node 24.22.1 and again on Node 26.12.1:

• Native and WASM HTTP/3 assets and uploads; HTTP/2 and HTTP/1.1 fallback.
• Compression, repeated cookies, HEAD, redirects, and the existing host rejection.
• UDP-bind startup rollback, upstream certificate rejection, cancelled-stream cleanup, and TCP/UDP port reuse.
• Chromium 156: actual h3 document, bundle, and hot-update responses; WSS HMR without a page reload; HTTP/2 fallback after stopping the companion.

Clean npm ci --ignore-scripts, the documented CLI with verified HTTPS and SIGTERM shutdown, Prettier 3.2.4, CSpell 10.3.3, and git diff --check passed. The full upstream suite has not been run locally; its ESLint configuration excludes examples. The focused tests are run separately from the root suite.

Reproduce from examples/server/http3:

npm ci --ignore-scripts
npm test
npx playwright install chromium
npm run test:browser

Measured results and limits

These are 25 sequential loopback requests per protocol on one machine. HTTP/3 includes an extra HTTPS proxy hop. They are diagnostic measurements, not a general performance claim.

Node	HTTP/3 runtime	Direct HTTP/2 median	HTTP/3 companion median	Shutdown and port reuse
24.22.1	portable	0.48 ms	0.74 ms	9.1 ms
24.22.1	wasm	0.46 ms	1.01 ms	8.7 ms
26.12.1	portable	0.44 ms	0.76 ms	10.5 ms
26.12.1	wasm	0.50 ms	1.01 ms	8.6 ms

The README documents the local-CA Chromium requirements: a dedicated profile, a leaf SPKI pin and a host-scoped QUIC allowance. The primary origin still uses Alt-Svc discovery and can fall back to HTTP/2. The tests do not change OS trust settings or globally disable TLS verification.

The optional transport requires Node 24+, and its root package is about 46.8 MB compressed / 151.9 MB unpacked. This prototype is qualified only on macOS ARM64. Windows, other browsers, dynamic SNI, HTTP/3 WebSockets, WebTransport, trailers, and public/LAN deployment are outside its validated scope. No changeset is needed for this example-only contribution.

Summary by CodeRabbit

• New Features
  • Added a standalone HTTP/3 development example, with HTTP/3 requests alongside existing HTTP/2, HTTP/1.1, middleware, and WebSocket hot updates.
  • The example demonstrates fallback to HTTP/2 when HTTP/3 is unavailable.
• Documentation
  • Added setup, certificate, runtime, and browser-testing instructions, including the example’s Node.js requirement.

[changeset-bot]

⚠️ No Changeset found

Latest commit: fa1c759

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: brianathere / name: Brian Meek (fa1c759)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​currentspace/​http3@​0.9.3
	playwright@​1.64.1
	webpack@​5.112.2
	webpack-dev-server@​6.1.0

View full report

[coderabbitai]

Walkthrough

Adds a standalone HTTP/3 example. An HTTP/3 companion forwards requests to the example’s HTTPS development server, while the server also supports HTTP/2 and HTTP/1.1. The example includes a browser page with HMR, setup documentation, protocol tests for portable and WASM modes, and a Chromium test for HTTP/3, HMR, and HTTP/2 fallback.

Priority: Low

Merge Risk: Low · up to fa1c7

A malformed local HTTP/3 request can stop the optional example server. Fix the request error handling before relying on the example.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding an optional HTTP/3 companion example and its documentation.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 9 files. (5 skipped: 5 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8f6b27c7-b099-424e-8eaf-5ece4e645595

Commits

Reviewing files that changed from the base of the PR and between d78f183 and fa1c759.

Files ignored due to path filters: 1

• examples/server/http3/package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 14

• examples/README.md
• examples/server/http3/.gitignore
• examples/server/http3/README.md
• examples/server/http3/app.js
• examples/server/http3/companion.js
• examples/server/http3/index.html
• examples/server/http3/message.js
• examples/server/http3/package.json
• examples/server/http3/server.js
• examples/server/http3/start.js
• examples/server/http3/test/browser.test.js
• examples/server/http3/test/helpers.js
• examples/server/http3/test/protocol.test.js
• examples/server/http3/webpack.config.js

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[coderabbitai]

Minor · Stability & Availability · Quick win

Handle malformed HTTP/3 requests without throwing from the stream handler.

https.request() throws synchronously for invalid input. Two inputs can trigger this:

• forwarded.host = headers[":authority"] is undefined when the client sends a Host header but no :authority. RFC 9114 allows this. Node then throws ERR_HTTP_INVALID_HEADER_VALUE.
• A :path, :method, or header value with invalid characters throws ERR_UNESCAPED_CHARACTERS, ERR_INVALID_HTTP_TOKEN, or ERR_INVALID_CHAR.

The throw happens inside an event handler. Unless the library catches it, the throw becomes an uncaught exception and stops the dev server. The listener is on loopback only, so any local UDP client can send such a request. Use the Host header as a fallback and answer 400 when request creation fails.

🛡️ Proposed fix

--- "a/examples/server/http3/companion.js"
+++ "b/examples/server/http3/companion.js"
@@ -51,10 +51,12 @@
       return;
     }
     const forwarded = endToEndHeaders(headers);
-    forwarded.host = headers[":authority"];
+    forwarded.host = headers[":authority"] ?? headers.host;
     let response;
-    const request = https.request(
-      {
+    let request;
+    try {
+      request = https.request(
+        {
         hostname: "127.0.0.1",
         port: upstreamPort,
         servername: "localhost",

Wrap the existing https.request(...) call in try. Add this catch after the call:

    } catch {
      stream.respond({ ":status": "400" });
      stream.end();
      return;
    }

Also applies to: 56-56

[bjohansebas]

HTTP/2 and HTTP/3 use different underlying transports. A simple header won’t make HTTP/3 work in Node.js, and QUIC != TLS, so I’m going to close this. Although Bun supports HTTP/3, I think it’s best to wait for WinterTC to establish a standard.