# What changed in got

> 68 changes in got 15 to 16 from its official release notes, upgrade guides and advisories: 22 breaking, 6 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/got/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## got 16

### Breaking changes

- Default body, json, and form payloads are no longer sent with every request; payloads are never merged with defaults. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- A handlers entry that is not a function now throws an error. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- A HEAD request remains HEAD after a 301, 302, or 303 redirect instead of becoming GET. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Negative or fractional values now throw an error. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- An empty method now throws an error instead of being accepted. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- A prefix URL containing a query string or fragment now throws an error. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- The promise response event now fires only for the final response, not for each retry attempt. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Response bodies no longer retain a leading UTF-8 byte order mark. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Negative or fractional retry limits now throw an error. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Hop-by-hop headers are no longer copied to a piped ServerResponse. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- agent.http2 is now an opt-out flag; set it to false to skip session pooling. Passing an agent instance throws. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- The deprecated auth option stub was removed; passing it now throws Unexpected option. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- Piped headers no longer copy credentials, including authorization, cookie, cookie2, set-cookie, and set-cookie2; pass credentials explicitly when the upstream is trusted. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- When a hook, retry, or pagination step changes origin, Got strips credentials and clears an unchanged body; set headers or body explicitly to retain them. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- The deprecated followRedirects option stub was removed; passing it now throws Unexpected option. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- HTTP/2 proxy support is no longer provided by Got; the notes say to keep using http2-wrapper through the request option if needed. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- Got now has a built-in HTTP/2 client with session pooling and multiplexing, and no longer relies on http2-wrapper. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- The OptionsOfUnknownResponseBody type was removed; it was an alias for StrictOptions. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- Use response.statusCode for the status because HTTP/2 response headers no longer contain pseudo-headers. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- A server response with Retry-After: 0 now retries immediately instead of using the backoff delay. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- The deprecated searchParameters option stub was removed; passing it now throws Unexpected option. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- timeout.socket now applies during HTTP/2 TLS negotiation and session setup, reports a socket timeout, and no longer counts DNS lookup time. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)

### New APIs and options

- The DnsCacheLookup type is now exported. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- The DnsCacheOptions type is now exported. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- The Timings type is now exported. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Adds got.query() for the QUERY method, which is safe and idempotent, retried by default, and keeps replayable bodies across redirects; the built-in cache does not store QUERY responses. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- Adds got.stream.query() for the QUERY method, which is safe and idempotent, retried by default, and keeps replayable bodies across redirects; the built-in cache does not store QUERY responses. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)

### Behavior and default changes

- The followRedirect option is evaluated once per response. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Headers now accept number values. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Extending an instance now inherits the parent's mutableDefaults setting, like got.extend(instance). (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Stacked content codings are now supported. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- The x-gzip content coding is now supported. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- With http2: true, a custom HTTPS agent makes Got use the native HTTP/1.1 path because the built-in session pool does not support custom HTTPS agents. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- dnsCache: true uses Got's built-in cache; the option also accepts objects with lookup and optional clear functions. The cache resolves A and AAAA records separately and cannot preserve OS-specific verbatim ordering. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- URL credentials are preserved when prefixUrl changes to a same-origin value, and credentials in prefixUrl are treated as explicit. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- If options.request returns a request or response, it controls the transport and bypasses Got's HTTP/2 client; return undefined to use Got's transport. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)

### Fixes and other changes

- Hook edge cases are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Hook edge cases are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Hook edge cases are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Streams configured with a body, json, or form option now reject writes, matching documented behavior. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Content-Length remains correct when a hook replaces the body during a redirect. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Cookie edge cases with retries, redirects, and async cookie jars are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Upload handling now respects DataView byte ranges. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Diagnostics channel coverage now includes retries and terminal errors. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Custom DNS cache lookups and DNS records without a valid TTL are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- FormData request bodies are retried by re-serializing them instead of failing. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- HTTP/2 edge cases are fixed, including requests that could hang forever when a response or request was destroyed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Infinity timeouts no longer fire immediately or throw. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- JSON containing a byte order mark now parses. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Default pagination now handles real-world Link headers, with pagination option and limit edge cases also fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Redirects now keep the URL fragment. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Retries with replaced or non-replayable bodies are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Error stacks now report the real error class instead of RequestError; other error cause edge cases are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Response body decoding and parsing edge cases are fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Retry delay edge cases are fixed, including invalid Retry-After values and calculateDelay for afterResponse retries. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Stream handling now respects backpressure. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- The request timeout no longer restarts on each redirect; timeout phase edge cases are also fixed. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- TypeScript types now match runtime values. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Streams stop forwarding after unpipe. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Upload progress total is fixed for Content-Length: 0. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- Web ReadableStream request bodies can now be cancelled correctly. (16.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.1.0)
- allowGetBody now works over HTTP/2. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- Got waits for asynchronous cookie jar writes on terminal redirect responses, including when followRedirect is false. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- When a cookie jar write throws, error.response.body is complete, decompressed, and decoded with the configured encoding; decoding failures no longer mask the original error. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- got.stream no longer finalizes the response before the response event or before piped server response headers are set. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- Connection errors reported by request.end() are retried instead of failing the request. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)
- strictContentLength no longer counts bytes from responses that were not actually decompressed. (16.0.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v16.0.0)

## got 15

### New APIs and options

- Adds the allowAbsoluteUrls option. (15.1.0) — [release notes](https://github.com/sindresorhus/got/releases/tag/v15.1.0)