unstale

npm / @whatwg-node/fetch

@whatwg-node/fetch

What changed in @whatwg-node/fetch 0.11 to 0.12, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

9 breaking1 security3 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

@whatwg-node/fetch 0.129 changes

Breaking changes 5

  • Redirect following now stops after 20 hops and rejects with TypeError and code TooManyRedirects; a chain of 20 redirects followed by a normal response still completes.

    0.12.1release notes

  • redirect: 'error' rejects with TypeError; redirects to schemes other than http or https also reject, while redirect: 'manual' returns the redirect response.

    0.12.1release notes

  • 307 and 308 redirects preserve method and body when the body can be resent; redirects reject when the body is a one-shot stream.

    0.12.1release notes

  • Cross-origin redirects to URLs containing a username or password reject with TypeError when the request mode is cors.

    0.12.1release notes

  • The package, createFetch, and FetchAPI no longer export crypto. Use globalThis.crypto instead; it is available on all supported runtimes (Node.js >=22.15).

    0.12.0release notes

Security 1

  • Cross-origin redirects remove Authorization, Proxy-Authorization, Cookie, Cookie2, and explicit Host headers, including when the scheme changes; same-origin redirects retain them, and the caller's Headers object is unchanged.

    0.12.1release notes

Fixes and other changes 3

  • 301 and 302 redirects for POST, and 303 redirects for methods other than GET or HEAD, resend as GET without a body or body-related headers.

    0.12.1release notes

  • When a FormData body is resent, it is encoded with a new multipart boundary of the same length; Content-Type is replaced to name that boundary and Content-Length remains valid.

    0.12.1release notes

  • Response.redirect serializes absolute URLs in Location and throws TypeError for unparseable URLs; relative URLs are stored as given, only statuses 301, 302, 303, 307, and 308 are accepted, and status text is empty.

    0.12.1release notes

@whatwg-node/fetch 0.114 changes

Breaking changes 4

  • The require("crypto").webcrypto fallback was dropped; supported runtimes always use globalThis.crypto.

    0.11.0release notes

  • The minimum supported Node.js version is now 22.15.0; Node.js 18 and 20 are no longer supported.

    0.11.0release notes

  • HTTP/2 support previously provided by node-libcurl is no longer available in this release.

    0.11.0release notes

  • The optional dependency and its fetchCurl path were removed; the ponyfill HTTP transport now uses node:http / node:https.

    0.11.0release notes