CI runs `npm install --production` against a lock last synced 2026-07-18, so it re-resolved caret ranges: 0.3.90 shipped bare-http1 4.6.1, bare-https 3.1.0 and bare-tls 3.1.10 instead of the 4.5.7 / 3.0.0 / 3.1.7 that 0.3.88 ran and that 0.3.90's leak fix was tested against. Two breaks, both measured on stortron: - bare-http1 4.6.1 hands a repeated response header over as an ARRAY and bare-fetch 3.0.1 calls .trim() on it: "value.trim is not a function", SIGABRT ~15-20 s after boot, every boot. - the idle reaper no longer fires: 4000 timed-out fetches left 4017 fds open. Pinned exactly, with overrides so no transitive copy drifts either. bare-https is now declared: lib/bounded-fetch.js imports it directly and reaches into bare-tls, so both are part of this package's contract, not incidental. CI-equivalent install from git archive: one copy each at the pinned versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>