fix(scripts): ignore loose audit content length headers

scripts/pre-commit/pnpm-audit-prod.mjs

@@ -729,8 +729,10 @@ async function withBulkAdvisoryTimeout({ label, timeoutMs, run }) {
 }
 
 async function readBoundedResponseText(response, maxBytes, label) {
-  const contentLength = Number.parseInt(response.headers?.get?.("content-length") ?? "", 10);
-  if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+  const rawContentLength = response.headers?.get?.("content-length");
+  const contentLength =
+    rawContentLength && /^\d+$/u.test(rawContentLength) ? Number(rawContentLength) : undefined;
+  if (Number.isSafeInteger(contentLength) && contentLength > maxBytes) {
     await response.body?.cancel().catch(() => undefined);
     throw Object.assign(new Error(`${label} exceeded ${maxBytes} bytes`), { code: "ETOOBIG" });
   }

test/scripts/pnpm-audit-prod.test.ts

@@ -297,6 +297,33 @@ snapshots:
     expect(cancelled).toBe(true);
   });
 
+  it("streams non-decimal bulk advisory content-length values through the body cap", async () => {
+    let readStarted = false;
+    let cancelled = false;
+    const body = new ReadableStream({
+      pull(controller) {
+        readStarted = true;
+        controller.enqueue(new TextEncoder().encode("12345"));
+      },
+      cancel() {
+        cancelled = true;
+      },
+    });
+    const request = fetchBulkAdvisories({
+      payload: { axios: ["1.0.0"] },
+      responseBodyMaxBytes: 4,
+      fetchImpl: async () =>
+        new Response(body, {
+          status: 200,
+          headers: { "content-length": "5junk" },
+        }),
+    });
+
+    await expect(request).rejects.toThrow(/Bulk advisory response body exceeded 4 bytes/u);
+    expect(readStarted).toBe(true);
+    expect(cancelled).toBe(true);
+  });
+
   it("fails closed on empty successful bulk advisory response bodies", async () => {
     const request = fetchBulkAdvisories({
       payload: { axios: ["1.0.0"] },