What's Changed

• Minor code cleanups to decompress interceptor by @domenic in #4754
• fix(h2): fix flaky stream end handling on macOS by @mcollina in #4762
• return response when receiving 401 instead of network error by @KhafraDev in #4769
• fix: properly close idle connections in test server cleanup by @mcollina in #4764
• fix: decode HTTP headers as latin1 instead of utf8 by @mcollina in #4768
• fix: submodule update by @Uzlopak in #4648
• build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 by @dependabot[bot] in #4720

New Contributors

• @domenic made their first contribution in #4754

Full Changelog: v7.19.1...v7.19.2

What's Changed

• fix: use commit hash when generating release (#4757) by @fenichelar in #4759
• fix fetch 401 loop by @KhafraDev in #4761

New Contributors

• @fenichelar made their first contribution in #4759

Full Changelog: v7.19.0...v7.19.1

What's Changed

• fix: Handle FormData body type correctly in RetryAgent retried requests by @eliotschu in #4692
• feat(client): expose HTTP/2 flow-control options by @pabloelisseo in #4706
• Implement origin normalization in MockAgent for case-insensitivity and URL handling by @SksOp in #4731
• fix websocket basic auth by @KhafraDev in #4747
• fix(cache): regenerate stream from source when cache.match is called after GC by @mcollina in #4713
• chore: use testcontext for test:cache by @Uzlopak in #4571
• chore: use testcontext for subresource integrity tests by @Uzlopak in #4575
• feat(cache): add origins option for whitelist filtering by @mcollina in #4739
• ci: test shared-builtin only on Node.js 24 and 25 by @mcollina in #4746
• fix websocketstream open error by @KhafraDev in #4748

New Contributors

• @eliotschu made their first contribution in #4692
• @pabloelisseo made their first contribution in #4706
• @SksOp made their first contribution in #4731

Full Changelog: v7.18.2...v7.19.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in #4729

Full Changelog: v7.18.1...v7.18.2

What's Changed

• Test and Fix running without SSL by @mcollina in #4727
• docs: add security warning for strictContentLength option by @mcollina in #4726
• build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in #4718
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #4719

Full Changelog: v7.18.0...v7.18.1

What's Changed

Full Changelog: v7.17.0...v7.18.0

What's Changed

• chore: extract infra and encoding methods by @Uzlopak in #4523
• ci: remove h2 by @Uzlopak in #4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in #4535
• ci: fix nightly shared library case by @Uzlopak in #4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in #4528
• docs: add Cache Interceptor example to README by @tawseefnabi in #4393
• test: remove node20 version check by @Uzlopak in #4544
• types: use MessagePort instance type in MessageEvent by @Renegade334 in #4546
• ci: set write permissions on job level by @Uzlopak in #4537
• lint: activate n/no-process-exit by @Uzlopak in #4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in #4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in #4547
• feat(H2): correct CONNECT behaviour by @metcoder95 in #4541
• test: fix plans by @Uzlopak in #4550
• feat: add runtime feature "detection" by @Uzlopak in #4545
• perf: use less promises in extractBody by @Uzlopak in #4458
• fix(proxy-agent): add missing return after callback-call by @Uzlopak in #4553
• fix: remove redundant line in retry-handler by @Uzlopak in #4554
• ci: add no-wasm-simd option by @Uzlopak in #4533
• fix: use lazyloaders for runtime feature detection by @Uzlopak in #4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in #4556
• http2: refactor and split tests of http2.js into multiple files by @Uzlopak in #4561
• fix: dns-interceptor test should await plan to complete by @Uzlopak in #4560
• chore: remove istanbul instructions by @Uzlopak in #4559
• fix: keep promise chains intact by @Uzlopak in #4558
• build(deps): bump wait-on from 8.0.5 to 9.0.1 in /benchmarks by @dependabot[bot] in #4567
• chore: remove tspl from eventsource by @Uzlopak in #4569
• chore: remove tspl from fetch by @Uzlopak in #4570
• feat: add getUpstream() method to BalancedPool by @mcollina in #4586
• fetch: handle invalid priority values properly by @Uzlopak in #4522
• ci: fix test coverage for codecov by @Uzlopak in #4520
• types: optional status in Response.redirect by @gineika in #4591
• docs: unix socket add-on by @FelixVaughan in #4587
• build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #4601
• build(deps): bump hendrikmuhs/ccache-action from 1.2.18 to 1.2.19 by @dependabot[bot] in #4600
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #4603
• build(deps): bump actions/setup-node from 4.0.2 to 5.0.0 by @dependabot[bot] in #4604
• build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #4602
• build(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #4598
• build(deps): bump github/codeql-action from 3.30.0 to 3.30.5 by @dependabot[bot] in #4599
• build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #4597
• fix: cacheStores types and usage in README by @lucalooz in #4605
• Feat dns interceptor storage by @SuperOleg39 in #4589
• docs: add crawling best practices by @Uzlopak in #4590
• fix: 304 not modified reply upon revalidation did not update cache. by @daan944 in #4617
• chore: use testcontext for test:infra by @Uzlopak in #4579
• fetch: improve regexes in data-uri.js by @Uzlopak in #4483
• perf: optimize validate http token by @PandaWorker in #4608
• test: improve long-lived-abort-controller test by @Uzlopak in #4621
• ci: add node.js 25 to test matrix by @shivarm in #4626
• chore: use testcontext for test/utils tests by @Uzlopak in #4577
• chore: remove tspl from websocket by @Uzlopak in #4568
• fix(ws) onSocketClose being called multiple times by @KhafraDev in #4632
• fix: prevent duplicate debug logs when multiple undici instances exist by @mcollina in #4630
• chore: use testcontext for busboy tests by @Uzlopak in #4572
• test: fix flaky http2-dispatcher test by @mcollina in #4633
• build(deps): bump uWebSockets.js from v20.52.0 to v20.54.0 in /benchmarks by @dependabot[bot] in #4635
• Run the gc() in long-lived-abort-controller test by @mcollina in #4638
• Do not destroy the HTTP2 stream twice in tests by @mcollina in #4637
• Fix http2-dispatcher test by @mcollina in #4640
• fix: fetch blob with range off-by-one error by @platypii in #4643
• fix: ensure HTTP/2 sends Content-Length for empty POST requests by @mcollina in #4613
• build(deps): bump uWebSockets.js from v20.54.0 to v20.55.0 in /benchmarks by @dependabot[bot] in #4645
• feat(#2458): WebSocket through HTTP/2 by @metcoder95 in #4540
• docs(README): correct the example code for the consumption of respons… by @tenkirin in #4658
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #4653
• build(deps): bump fastify/github-action-merge-dependabot from 3.11.1 to 3.11.2 by @dependabot[bot] in #4655
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #4652
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #4651
• build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @dependabot[bot] in #4654
• don't freeze urlList for opaque filtered responses by @KhafraDev in #4656
• fix fd parsing unquoted attribute values by @KhafraDev in #4662
• build(deps): bump uWebSockets.js from v20.55.0 to v20.56.0 in /benchmarks by @dependabot[bot] in #4665
• feat(dispatcher/proxy-agent): new diagnostics event 'undici:proxy:connected' by @SuperOleg39 in #4659
• Feat/round robin pool by @FelixVaughan in #4650
• Formdata ignore epilogue preamble by @KhafraDev in #4672
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #4682
• fix: snapshot url exclusion by @FelixVaughan in #4670
• feat: support h2c over unix domain sockets by @chrros95 in #4690
• fix(docs): remove unused TypeScript example code block by @kerolloz in #4701
• feat: add deduplicate interceptor for request deduplication by @mcollina in #4679
• chore: use testcontext for mock tests by @Uzlopak in #4582
• fix(test): remove hardcoded folder name in client-error-stack-trace test by @mcollina in #4707

New Contributors

• @gineika made their first contribution in #4591
• @lucalooz made their first contribution in #4605
• @SuperOleg39 made their first contribution in #4589
• @daan944 made their first contribution in #4617
• @PandaWorker made their first contribution in #4608
• @platypii made their first contribution in #4643
• @tenkirin made their first contribution in #4658
• @kerolloz made...

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: v6.22.0...v6.23.0

What's Changed

• fix: fix wrong stream canceled up after cloning (v6) by @snyamathi in #4414
• [Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @github-actions[bot] in #4432
• feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180) by @metcoder95 in #4433
• feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#4180) (#4340) by @metcoder95 in #4445
• Backport 4472 to v6.x by @Uzlopak in #4480

Full Changelog: v6.21.3...v6.22.0

What's Changed

• Drop npm token, use OIDC instead by @mcollina in #4447
• fetch: instantiate readableStream in extractBody with sync methods by @Uzlopak in #4350
• fix: remove async on [kClose] and [kDestroy], only return Promise by @Uzlopak in #4450
• fetch: make consumeBody sync by @Uzlopak in #4449
• perf: make client.connect() sync by @Uzlopak in #4455
• fetch: remove promise in exported fetch by @Uzlopak in #4452
• fix(#4451): implement http2 cookie support by @metcoder95 in #4453
• test: cache store tests should properly be skipped by @Uzlopak in #4463
• test: fix IPv6 skip check for test/client.js by @Uzlopak in #4466
• test: remove skip check for AbortSignal.timeout, as it exists since node18 by @Uzlopak in #4464
• test: investigate macos failing by @Uzlopak in #4467
• test: remove obsolete < node v18 test case for http2 by @Uzlopak in #4461
• perf: avoid intermediate promise on BodyReadable.dump by @Uzlopak in #4459
• test: remove skip check for long-lived-abort-controller test (was flaky 10 months ago) by @Uzlopak in #4465
• test: remove skip checks for existance of global available Blob and File by @Uzlopak in #4460
• perf (fetch): use less promises for ReadableStream by @Uzlopak in #4457
• fix: catch synchronous errors in request callbacks by @mcollina in #4443
• fix: avoid instanceof MockNotMatchedError by @Uzlopak in #4474
• eventsource: remove promise for #reconnect method by @Uzlopak in #4469
• feat: make UndiciErrors reliable to instanceof by @Uzlopak in #4472
• chore: call super() after type checks by @Uzlopak in #4475
• chore: FixedQueue does not need special constructor by @Uzlopak in #4476
• fix: buildAndValidateMockOptions should always get an object passed and always return an object by @Uzlopak in #4479
• fix: remove unused ResponseStatusCodeError by @Uzlopak in #4473
• chore: pool and dispatcherbase dont need constructor, use no array helper functions by @Uzlopak in #4477
• lint: avoid unintented use of globals in code and tests, improve test for installing/overwriting globals by @Uzlopak in #4478
• test: fix macos flakyness by @Uzlopak in #4468
• fix: 'no-referrer-when-downgrade' in determineRequestsReferrer should return referrerURL by @Uzlopak in #4482
• fix: deflake cache-fastimers-fix.js by @Uzlopak in #4491
• fix: improve validation of IP addresses as trustworthy, correct ipv4 check by @Uzlopak in #4489
• test (pool.js): fix flakyness of clientTtl test by @Uzlopak in #4494
• test (eventsource): refactor tests for eventsource, speed them up by @Uzlopak in #4493
• fix: remove useless catch in client-h1.js by @Uzlopak in #4481
• test: skip flaky encoding test on macos and node20 by @Uzlopak in #4497
• fix: implement proper stale-while-revalidate behavior per RFC 5861 by @mcollina in #4492
• test (websocket): speed up test/websocket/issue-2679.js by @Uzlopak in #4501
• webidl: fix existing and add missing buffer source converters by @Renegade334 in #4503
• use real wpt test server by @KhafraDev in #4486
• test: another try to fix flaky macos and node 20 by @Uzlopak in #4490
• build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #4507
• build(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.3 by @dependabot[bot] in #4509
• fix writing to websocketstream with SharedArrayBuffer/SharedArrayBuff… by @KhafraDev in #4504
• test: use faketimers for test/client-keep-alive, refactor a little by @Uzlopak in #4499
• build(deps): bump github/codeql-action from 3.29.7 to 3.30.0 by @dependabot[bot] in #4510
• build(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in #4508
• fix(h2): adjust :scheme on h2 requests by @metcoder95 in #4454
• chore: use lowercase filenames, remove unused verifyVersion.js by @Uzlopak in #4514
• chore: refactor workflows by @Uzlopak in #4513
• chore: use [] instead of new Array(0) by @Uzlopak in #4435
• change webidl attribute to bitwise flag by @KhafraDev in #4505
• chore: make also cache-tests integrated as a submodule by @Uzlopak in #4517
• ci: fine grained test nodejs workflow by @Uzlopak in #4516
• feat: Support for capping the number of origins in Agent by @JoshMock in #4365
• wpt: properly handle write permissions errors in wpt-runner setup by @Uzlopak in #4518
• fetch: process content-encoding header only if relevant by @Uzlopak in #4496
• websocket: always emit error event by @KhafraDev in #4521
• refactor: parseHttpDate by @Uzlopak in #4421
• fix: wpt should use master branch by @Uzlopak in #4524
• fix: shell command built from environment values by @ptrgits in #4392
• example: use metcoders https-pem for the example by @Uzlopak in #4436
• Disable SIMD for PPC64 architecture, add UNDICI_NO_WASM_SIMD env to facilitate testing by @mcollina in #4530
• fix: make error symbols non enumerable by @Uzlopak in #4531

New Contributors

• @Renegade334 made their first contribution in #4503
• @JoshMock made their first contribution in #4365
• @ptrgits made their first contribution in #4392

Full Changelog: v7.15.0...v7.16.0