On Node 26, tang auth login failed for any handle with no _atproto DNS record, with "Failed to resolve identity". The same login worked under Bun.
Cause. The OAuth client resolves a handle's /.well-known/atproto-did through @atproto-labs/fetch-node, whose SSRF guard installs its own undici dispatcher. The lockfile held fetch-node 0.3.0, which brings undici 6. Node 26's fetch is undici 8 and rejects that dispatcher's handler (UND_ERR_INVALID_ARG, "invalid onError method"). The handle resolver swallows the error and reports that the handle does not resolve.
Change. @atproto/oauth-client-node goes from ^0.4.0 to ^0.4.9, still within 0.4. The lockfile now resolves @atproto-labs/handle-resolver-node 0.2.15 and fetch-node 0.4.3, which carries an undici for each Node it supports. No source change.
Test. tests/lib/oauth-runtime.test.ts finds the guarded fetch through the client's own dependency chain and asks it for https://localhost/. That must end in the guard's own refusal, which shows the dispatcher ran, not in undici's error. It is red on the old lockfile and green now. A real login on Node 26.13 with a handle served only by its well-known now succeeds.
bun run check passes (449 tests) under an English locale. Two formatDate tests fail under de_DE on main as well, since they expect US date formatting. They are left as they are.
🤖 Generated with Claude Code