[Bug]: core header helpers convert undefined values into empty headers

[omerbek]

Affected package or area

@sapiom/core header utilities (packages/core/src/utils/utils.ts)

Affected version, release, or commit

Current main at sapiom/sapiom-js as of 2026-08-13.

Environment

Node.js: 20+ / 22+
Package manager and version: pnpm 10.34.3
Operating system: platform-independent
Runtime or framework: header maps passed through SDK HTTP integrations

Minimal reproduction and steps

The helpers accept Record<string, string | string[] | undefined>, where undefined represents an omitted header in Node/HTTP-style maps.

import { setHeader, removeHeader } from "@sapiom/core";

const headers = {
  Authorization: undefined,
  "Content-Type": "text/plain",
};

setHeader(headers, "X-Sapiom-Transaction-Id", "tx_123");
removeHeader(headers, "Content-Type");

Expected behavior

Unrelated headers with undefined values should remain omitted when copying headers into the returned object. The returned header map should not contain Authorization in the example above.

Actual behavior

Both setHeader and removeHeader copy unrelated headers with this expression:

newHeaders[key] = Array.isArray(val) ? val[0] || "" : val || "";

That coerces undefined to "", turning an absent header into a present-but-empty header. Downstream HTTP clients can then send an empty Authorization or similar header instead of omitting it.

Logs, screenshots, and additional context

This is separate from #10, which normalized a completely missing request.headers object in @sapiom/node-http. This report is about individual undefined values inside an existing header object in @sapiom/core utilities. A focused fix would skip val === undefined while copying non-target headers and add regression tests in packages/core/src/utils/utils.test.ts.

Acknowledgements

• I searched existing open and closed issues for this problem.
• This report does not describe a suspected security vulnerability; I will use the Security Policy for private reporting.
• I removed secrets, credentials, personal data, and other sensitive information from this report.