npm / got
got
What changed in got 15 to 16, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
22 breaking6 new APIs and options9 behavior and defaults31 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initgot 1667 changes
Breaking changes 22
Default body, json, and form payloads are no longer sent with every request; payloads are never merged with defaults.
A handlers entry that is not a function now throws an error.
A HEAD request remains HEAD after a 301, 302, or 303 redirect instead of becoming GET.
Negative or fractional values now throw an error.
An empty method now throws an error instead of being accepted.
A prefix URL containing a query string or fragment now throws an error.
The promise response event now fires only for the final response, not for each retry attempt.
Response bodies no longer retain a leading UTF-8 byte order mark.
Negative or fractional retry limits now throw an error.
Hop-by-hop headers are no longer copied to a piped ServerResponse.
agent.http2 is now an opt-out flag; set it to false to skip session pooling. Passing an agent instance throws.
The deprecated auth option stub was removed; passing it now throws Unexpected option.
Piped headers no longer copy credentials, including authorization, cookie, cookie2, set-cookie, and set-cookie2; pass credentials explicitly when the upstream is trusted.
When a hook, retry, or pagination step changes origin, Got strips credentials and clears an unchanged body; set headers or body explicitly to retain them.
The deprecated followRedirects option stub was removed; passing it now throws Unexpected option.
HTTP/2 proxy support is no longer provided by Got; the notes say to keep using http2-wrapper through the request option if needed.
Got now has a built-in HTTP/2 client with session pooling and multiplexing, and no longer relies on http2-wrapper.
The OptionsOfUnknownResponseBody type was removed; it was an alias for StrictOptions.
Use response.statusCode for the status because HTTP/2 response headers no longer contain pseudo-headers.
A server response with Retry-After: 0 now retries immediately instead of using the backoff delay.
The deprecated searchParameters option stub was removed; passing it now throws Unexpected option.
timeout.socket now applies during HTTP/2 TLS negotiation and session setup, reports a socket timeout, and no longer counts DNS lookup time.
New APIs and options 5
The DnsCacheLookup type is now exported.
The DnsCacheOptions type is now exported.
The Timings type is now exported.
Adds got.query() for the QUERY method, which is safe and idempotent, retried by default, and keeps replayable bodies across redirects; the built-in cache does not store QUERY responses.
Adds got.stream.query() for the QUERY method, which is safe and idempotent, retried by default, and keeps replayable bodies across redirects; the built-in cache does not store QUERY responses.
Behavior and default changes 9
The followRedirect option is evaluated once per response.
Headers now accept number values.
Extending an instance now inherits the parent's mutableDefaults setting, like got.extend(instance).
Stacked content codings are now supported.
The x-gzip content coding is now supported.
With http2: true, a custom HTTPS agent makes Got use the native HTTP/1.1 path because the built-in session pool does not support custom HTTPS agents.
dnsCache: true uses Got's built-in cache; the option also accepts objects with lookup and optional clear functions. The cache resolves A and AAAA records separately and cannot preserve OS-specific verbatim ordering.
URL credentials are preserved when prefixUrl changes to a same-origin value, and credentials in prefixUrl are treated as explicit.
If options.request returns a request or response, it controls the transport and bypasses Got's HTTP/2 client; return undefined to use Got's transport.
Fixes and other changes 31
Hook edge cases are fixed.
Hook edge cases are fixed.
Hook edge cases are fixed.
Streams configured with a body, json, or form option now reject writes, matching documented behavior.
Content-Length remains correct when a hook replaces the body during a redirect.
Cookie edge cases with retries, redirects, and async cookie jars are fixed.
Upload handling now respects DataView byte ranges.
Diagnostics channel coverage now includes retries and terminal errors.
Custom DNS cache lookups and DNS records without a valid TTL are fixed.
FormData request bodies are retried by re-serializing them instead of failing.
HTTP/2 edge cases are fixed, including requests that could hang forever when a response or request was destroyed.
Infinity timeouts no longer fire immediately or throw.
JSON containing a byte order mark now parses.
Default pagination now handles real-world Link headers, with pagination option and limit edge cases also fixed.
Redirects now keep the URL fragment.
Retries with replaced or non-replayable bodies are fixed.
Error stacks now report the real error class instead of RequestError; other error cause edge cases are fixed.
Response body decoding and parsing edge cases are fixed.
Retry delay edge cases are fixed, including invalid Retry-After values and calculateDelay for afterResponse retries.
Stream handling now respects backpressure.
The request timeout no longer restarts on each redirect; timeout phase edge cases are also fixed.
TypeScript types now match runtime values.
Streams stop forwarding after unpipe.
Upload progress total is fixed for Content-Length: 0.
Web ReadableStream request bodies can now be cancelled correctly.
allowGetBody now works over HTTP/2.
Got waits for asynchronous cookie jar writes on terminal redirect responses, including when followRedirect is false.
When a cookie jar write throws, error.response.body is complete, decompressed, and decoded with the configured encoding; decoding failures no longer mask the original error.
got.stream no longer finalizes the response before the response event or before piped server response headers are set.
Connection errors reported by request.end() are retried instead of failing the request.
strictContentLength no longer counts bytes from responses that were not actually decompressed.
got 151 changes
New APIs and options 1
Adds the allowAbsoluteUrls option.