v7.21.0

What's Changed

• build(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by @dependabot[bot] in #4796
• test: restore global dispatcher after fetch tests by @mcollina in #4790
• Add missing close method to WebSocketStream interface by @piotr-cz in #4802
• fix: error stream instead of canceling by @KhafraDev in #4804
• Fix clientTtl cleanup race in Agent by @mcollina in #4807
• feat(#4230): Implement pingInterval for dispatching PING frames by @metcoder95 in #4296
• fix: handle undefined __filename in bundled environments by @mcollina in #4812
• fix: set finalizer only for fetch responses by @tsctx in #4803

New Contributors

• @piotr-cz made their first contribution in #4802

Full Changelog: v7.20.0...v7.21.0

v7.20.0

What's Changed

• fix: preserve fetch stack traces by @mcollina in #4778
• Fix error handling in MockPool example by @dave-kennedy in #4781
• feat: expose statusText in request() ResponseData by @domenic in #4784
• test: reduce retry-after invalid date flake by @mcollina in #4788
• extractBody fixes by @KhafraDev in #4791
• fix: MockAgent delayed response with AbortSignal (#4693) by @mcollina in #4772
• fix: onParserTimeout potentially accessing undefined by @vbfox in #4758

New Contributors

• @dave-kennedy made their first contribution in #4781
• @vbfox made their first contribution in #4758

Full Changelog: v7.19.2...v7.20.0

v7.19.2

What's Changed

• Minor code cleanups to decompress interceptor by @domenic in #4754
• fix(h2): fix flaky stream end handling on macOS by @mcollina in #4762
• return response when receiving 401 instead of network error by @KhafraDev in #4769
• fix: properly close idle connections in test server cleanup by @mcollina in #4764
• fix: decode HTTP headers as latin1 instead of utf8 by @mcollina in #4768
• fix: submodule update by @Uzlopak in #4648
• build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 by @dependabot[bot] in #4720

New Contributors

• @domenic made their first contribution in #4754

Full Changelog: v7.19.1...v7.19.2

v7.19.1

What's Changed

• fix: use commit hash when generating release (#4757) by @fenichelar in #4759
• fix fetch 401 loop by @KhafraDev in #4761

New Contributors

• @fenichelar made their first contribution in #4759

Full Changelog: v7.19.0...v7.19.1

v7.19.0

What's Changed

• fix: Handle FormData body type correctly in RetryAgent retried requests by @eliotschu in #4692
• feat(client): expose HTTP/2 flow-control options by @pabloelisseo in #4706
• Implement origin normalization in MockAgent for case-insensitivity and URL handling by @SksOp in #4731
• fix websocket basic auth by @KhafraDev in #4747
• fix(cache): regenerate stream from source when cache.match is called after GC by @mcollina in #4713
• chore: use testcontext for test:cache by @Uzlopak in #4571
• chore: use testcontext for subresource integrity tests by @Uzlopak in #4575
• feat(cache): add origins option for whitelist filtering by @mcollina in #4739
• ci: test shared-builtin only on Node.js 24 and 25 by @mcollina in #4746
• fix websocketstream open error by @KhafraDev in #4748

New Contributors

• @eliotschu made their first contribution in #4692
• @pabloelisseo made their first contribution in #4706
• @SksOp made their first contribution in #4731

Full Changelog: v7.18.2...v7.19.0

v7.18.2

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in #4729

Full Changelog: v7.18.1...v7.18.2

v7.18.1

What's Changed

• Test and Fix running without SSL by @mcollina in #4727
• docs: add security warning for strictContentLength option by @mcollina in #4726
• build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in #4718
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4719

Full Changelog: v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: v7.17.0...v7.18.0

v7.17.0

What's Changed

• chore: extract infra and encoding methods by @Uzlopak in #4523
• ci: remove h2 by @Uzlopak in #4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in #4535
• ci: fix nightly shared library case by @Uzlopak in #4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in #4528
• docs: add Cache Interceptor example to README by @tawseefnabi in #4393
• test: remove node20 version check by @Uzlopak in #4544
• types: use MessagePort instance type in MessageEvent by @Renegade334 in #4546
• ci: set write permissions on job level by @Uzlopak in #4537
• lint: activate n/no-process-exit by @Uzlopak in #4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in #4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in #4547
• feat(H2): correct CONNECT behaviour by @metcoder95 in #4541
• test: fix plans by @Uzlopak in #4550
• feat: add runtime feature "detection" by @Uzlopak in #4545
• perf: use less promises in extractBody by @Uzlopak in #4458
• fix(proxy-agent): add missing return after callback-call by @Uzlopak in #4553
• fix: remove redundant line in retry-handler by @Uzlopak in #4554
• ci: add no-wasm-simd option by @Uzlopak in #4533
• fix: use lazyloaders for runtime feature detection by @Uzlopak in #4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in #4556
• http2: refactor and split tests of http2.js into multiple files by @Uzlopak in #4561
• fix: dns-interceptor test should await plan to complete by @Uzlopak in #4560
• chore: remove istanbul instructions by @Uzlopak in #4559
• fix: keep promise chains intact by @Uzlopak in #4558
• build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @dependabot[bot] in #4567
• chore: remove tspl from eventsource by @Uzlopak in #4569
• chore: remove tspl from fetch by @Uzlopak in #4570
• feat: add getUpstream() method to BalancedPool by @mcollina in #4586
• fetch: handle invalid priority values properly by @Uzlopak in #4522
• ci: fix test coverage for codecov by @Uzlopak in #4520
• types: optional status in Response.redirect by @gineika in #4591
• docs: unix socket add-on by @FelixVaughan in #4587
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #4601
• build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @dependabot[bot] in #4600
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4603
• build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @dependabot[bot] in #4604
• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #4602
• build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #4598
• build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @dependabot[bot] in #4599
• build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #4597
• fix: cacheStores types and usage in README by @lucalooz in #4605
• Feat dns interceptor storage by @SuperOleg39 in #4589
• docs: add crawling best practices by @Uzlopak in #4590
• fix: 304 not modified reply upon revalidation did not update cache. by @daan944 in #4617
• chore: use testcontext for test:infra by @Uzlopak in #4579
• fetch: improve regexes in data-uri.js by @Uzlopak in #4483
• perf: optimize validate http token by @PandaWorker in #4608
• test: improve long-lived-abort-controller test by @Uzlopak in #4621
• ci: add node.js 25 to test matrix by @shivarm in #4626
• chore: use testcontext for test/utils tests by @Uzlopak in #4577
• chore: remove tspl from websocket by @Uzlopak in #4568
• fix(ws) onSocketClose being called multiple times by @KhafraDev in #4632
• fix: prevent duplicate debug logs when multiple undici instances exist by @mcollina in #4630
• chore: use testcontext for busboy tests by @Uzlopak in #4572
• test: fix flaky http2-dispatcher test by @mcollina in #4633
• build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @dependabot[bot] in #4635
• Run the gc() in long-lived-abort-controller test by @mcollina in #4638
• Do not destroy the HTTP2 stream twice in tests by @mcollina in #4637
• Fix http2-dispatcher test by @mcollina in #4640
• fix: fetch blob with range off-by-one error by @platypii in #4643
• fix: ensure HTTP/2 sends Content-Length for empty POST requests by @mcollina in #4613
• build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @dependabot[bot] in #4645
• feat(#2458): WebSocket through HTTP/2 by @metcoder95 in #4540
• docs(README): correct the example code for the consumption of respons… by @tenkirin in #4658
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #4653
• build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @dependabot[bot] in #4655
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #4652
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #4651
• build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @dependabot[bot] in #4654
• don't freeze urlList for opaque filtered responses by @KhafraDev in #4656
• fix fd parsing unquoted attribute values by @KhafraDev in #4662
• build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @dependabot[bot] in #4665
• feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @SuperOleg39 in #4659
• Feat/round robin pool by @FelixVaughan in #4650
• Formdata ignore epilogue preamble by @KhafraDev in #4672
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #4682
• fix: snapshot url exclusion by @FelixVaughan in #4670
• feat: support h2c over unix domain sockets by @chrros95 in #4690
• fix(docs): remove unused TypeScript example code block by @kerolloz in #4701
• feat: add deduplicate interceptor for request deduplication by @mcollina in #4679
• chore: use testcontext for mock tests by @Uzlopak in #4582
• fix(test): remove hardcoded folder name in client-error-stack-trace test by @mcollina in #4707

New Contributors

• @gineika made their first contribution in #4591
• @lucalooz made their first contribution in #4605
• @SuperOleg39 made their first contribution in #4589
• @daan944 made their first contribution in #4617
• @PandaWorker made their first contribution in #4608
• @platypii made their first contribution in #4643
• @tenkirin made their first contribution in #4658
• @kerolloz made...

v6.23.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: v6.22.0...v6.23.0