# What changed in @whatwg-node/fetch

> 13 changes in @whatwg-node/fetch 0.11 to 0.12 from its official release notes, upgrade guides and advisories: 9 breaking, 1 security. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/@whatwg-node/fetch/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @whatwg-node/fetch 0.12

### Breaking changes

- Redirect following now stops after 20 hops and rejects with TypeError and code TooManyRedirects; a chain of 20 redirects followed by a normal response still completes. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)
- redirect: 'error' rejects with TypeError; redirects to schemes other than http or https also reject, while redirect: 'manual' returns the redirect response. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)
- 307 and 308 redirects preserve method and body when the body can be resent; redirects reject when the body is a one-shot stream. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)
- Cross-origin redirects to URLs containing a username or password reject with TypeError when the request mode is cors. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)
- The package, createFetch, and FetchAPI no longer export crypto. Use globalThis.crypto instead; it is available on all supported runtimes (Node.js >=22.15). (0.12.0) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0120)

### Security

- Cross-origin redirects remove Authorization, Proxy-Authorization, Cookie, Cookie2, and explicit Host headers, including when the scheme changes; same-origin redirects retain them, and the caller's Headers object is unchanged. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)

### Fixes and other changes

- 301 and 302 redirects for POST, and 303 redirects for methods other than GET or HEAD, resend as GET without a body or body-related headers. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)
- When a FormData body is resent, it is encoded with a new multipart boundary of the same length; Content-Type is replaced to name that boundary and Content-Length remains valid. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)
- Response.redirect serializes absolute URLs in Location and throws TypeError for unparseable URLs; relative URLs are stored as given, only statuses 301, 302, 303, 307, and 308 are accepted, and status text is empty. (0.12.1) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0121)

## @whatwg-node/fetch 0.11

### Breaking changes

- The `require("crypto").webcrypto` fallback was dropped; supported runtimes always use `globalThis.crypto`. (0.11.0) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0110)
- The minimum supported Node.js version is now 22.15.0; Node.js 18 and 20 are no longer supported. (0.11.0) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0110)
- HTTP/2 support previously provided by `node-libcurl` is no longer available in this release. (0.11.0) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0110)
- The optional dependency and its `fetchCurl` path were removed; the ponyfill HTTP transport now uses `node:http` / `node:https`. (0.11.0) — [release notes](https://github.com/ardatan/whatwg-node/blob/050a5fdddfcca13415b2087b5258f8c9f0e7482b/packages/fetch/CHANGELOG.md#0110)