fix(formdata): preserve typed array bytes in Node multipart uploads - #11443

Summary

Node multipart uploads lose the binary representation of multi-byte typed arrays: Buffer.from(typedArray) converts each numeric element to one byte, and nonempty BigInt typed arrays throw. Convert the view's exact byte range to Uint8Array before copying into Buffer, matching the existing native Blob conversion.

For example, Uint16Array([0x1234, 0xabcd]) currently serializes as two bytes instead of four.

Linked issue

Follow-up to #11255, closed by its author without merging. Credit to @snooze26h for the prior report and proposed fix. Independently reproduced on v1.x at 1fcaf82dd3637afd57454fc5abd5e3458f619bcf, then rebased and revalidated against 83426bc8bc03be4cab5396d554d52c4863bd8eff. No open PR covering this conversion was found.

Changes

• Preserve binary contents, byte offsets and lengths in the Node FormData fallback.
• Add 28 unit regressions: seven typed-array types with full, partial and empty views, an ArrayBuffer control, DataView and cross-realm view cases, and a real local HTTP upload comparison with legacy and native FormData. Also add a browser regression for a DataView slice.
• Add prerelease changelog and deferred documentation entries.

Validation

Windows, Node.js 24.19.0, npm 11.17.0:

• npm ci --ignore-scripts --no-audit --no-fund: passed.
• New regression file before the fix: 13 failed, 10 passed, including the HTTP upload.
• Related unit tests after the fix: 51 passed.
• npm run lint and npm run build: passed.
• Review follow-up: five added DataView/cross-realm cases failed before changing the conversion guard to isArrayBufferView.
• npm run test:vitest:unit -- --reporter=dot: 1,799 passed across 76 files after the review follow-up (2026-11-11).
• Prettier on changed files and git diff --check: passed.
• Standard npm run test:vitest:browser:headless -- --reporter=dot: blocked before tests because pinned browsers are unavailable. Browser installation was attempted twice, but its first download stalled.
• Earlier browser validation on the original base used a config outside the repository to run the unchanged browser suite with installed Chrome 156.0.8078.74, with file parallelism disabled: 354 passed, 1 skipped, 1 failed. The failure is defaults.browser.test.js > should send a literal Date Link header alongside method defaults: the Chinese timezone name is stripped from the header. It reproduced identically after temporarily removing this fix. This earlier full-suite result is not a claim about the updated base.
• Focused toFormData.browser.test.js: 10 passed, including the new DataView regression (2026-11-11).
• Firefox and WebKit remain unverified. The initial parallel Chrome attempt crashed; the serial run produced the results above.
• Checks observed on head f81da1c after creation: Socket Security Pull Request Alerts and Project Report passed; cubic and Greptile reviews are running. No build/test GitHub Actions runs are listed yet. Security/review checks do not establish build/test matrix success. This PR remains draft pending required browser validation.

Compatibility and documentation

Patch correction in the Node FormData fallback. Uint8Array and ArrayBuffer behavior are covered by controls. Multi-byte arrays now serialize their binary representation instead of lossy element conversions. No public API, export, dependency or type changes.

PRE_RELEASE_DOCS.md records the release-time documentation change. Module and packaging smoke tests are not applicable because exports, declarations and packaging are unchanged.

Checklist

• Scope, target branch, and linked issue/rationale checked
• PRE_RELEASE_CHANGELOG.md entry added
• Regression tests and relevant negative/platform cases covered
• Applicable local checks completed: browser matrix incomplete as described above
• Deferred release docs and ESM/CJS types reviewed
• Semver impact stated and intentional behavior change explained
• Final diff reviewed for unrelated changes, generated artifacts and test/debug leftovers
• Latest GitHub checks status recorded separately from review/security results; build/test matrix has not run

AI assisted with investigation, implementation, tests and this description. All reported checks were executed locally. Adding the existing ai-assisted label returned HTTP 403; a maintainer needs to apply it.