v7.2.3

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

• Fix typo in update cache tests action by @flakey5 in #4008

Full Changelog: v7.2.2...v7.2.3

v6.21.1

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

• fix(#3736): back-port 183f8e9 to v6.x by @ggoodman in #3855
• fix(#3817): send servername for SNI on TLS (#3821) [backport] by @metcoder95 in #3864
• fix: sending formdata bodies with http2 (#3863) [backport] by @metcoder95 in #3866
• [Backport v6.x] fix: Fixed the issue that there is no running request when http2 goaway by @github-actions in #3877
• types: [backport] Update return type of RetryCallback (#3851) by @metcoder95 in #3876

Full Changelog: v6.21.0...v6.21.1

v5.28.5

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

Full Changelog: v5.28.4...v5.28.5

v7.2.2

What's Changed

• Update WPT by @github-actions in #3991
• fix: dual-stack retries infinite loop by @luddd3 in #4001
• build(deps): bump codecov/codecov-action from 5.0.7 to 5.1.2 by @dependabot in #3980
• build(deps): bump github/codeql-action from 3.27.0 to 3.28.1 by @dependabot in #4003
• tests: Update Cache Tests by @github-actions in #3965
• ReadableStreamFrom pull until cannot on empty enqueu by @KhafraDev in #4002
• Resolve circular dependency by @mcollina in #4006

Full Changelog: v7.2.1...v7.2.2

v7.2.1

What's Changed

• fix(3951): typo on errorede dns lookup by @metcoder95 in #3956
• feat: add missing error type by @Gigioliva in #3964
• websocket: improve frame parsing by @tsctx in #3447
• fix(#3966): account for network errors by @metcoder95 in #3967
• build(deps-dev): bump @fastify/busboy from 3.1.0 to 3.1.1 by @dependabot in #3971
• Update WPT by @github-actions in #3954
• docs: fix dispatcher stream example links by @luddd3 in #3972
• fix: undici:request:headers does not indicate completion of a response by @legendecas in #3974
• build(deps): bump cronometro from 3.0.2 to 4.0.1 in /benchmarks by @dependabot in #3976
• fix(#3975): do not unref timeout by @metcoder95 in #3977
• fix: bad response on h2 server by @metcoder95 in #3978
• build(deps): bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 by @dependabot in #3981
• build(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 by @dependabot in #3983
• chore: ensure automated v7 release compared to v7 by @trivikr in #3986
• test: ignore test for CITGM by @metcoder95 in #3993
• fix: retry flaky test by @metcoder95 in #3992

New Contributors

• @legendecas made their first contribution in #3974

Full Changelog: v7.2.0...v7.2.1

v7.2.0

What's Changed

• fix: dns interceptor undefined function by @luddd3 in #3958
• More cache fixes by @flakey5 in #3955
• [Release] v7.2.0 by @github-actions in #3962

Full Changelog: v7.1.1...v7.2.0

v7.1.1

What's Changed

• fix: publish undici:client:sendHeaders message on H2 by @fengmk2 in #3921
• Add support schedule by @mcollina in #3923
• cache: do not set undefined etag by @mcollina in #3925
• test: cleanup cache tests by @flakey5 in #3926
• fix mimetype parser wrong operator by @tsctx in #3924
• correctly set if-none-match by @mcollina in #3933
• Add example for request + "Garbage Collection" by @WTCT-TOP in #3916
• fix: response error interceptor by @Gigioliva in #3930
• build(deps-dev): bump neostandard from 0.11.9 to 0.12.0 by @dependabot in #3938
• fix(#3937): respect correct host header by @metcoder95 in #3940
• fix: handle case no content type by @Gigioliva in #3931
• support array of headers in WrapHandler by @KhafraDev in #3941
• build(deps): bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #3911
• test: Update WPT by @github-actions in #3888
• build(deps-dev): bump @fastify/busboy from 3.0.0 to 3.1.0 by @dependabot in #3939
• Support SQLite unflagged without useless warnings by @mcollina in #3947
• docs: enhance documentation by @metcoder95 in #3945

New Contributors

• @WTCT-TOP made their first contribution in #3916

Full Changelog: v7.1.0...v7.1.1

v7.1.0

What's Changed

• Mark http/2 support as stable by @mcollina in #3893
• test: fix dns interceptor flakiness by @luddd3 in #3902
• fix(#3901): migrate dns interceptor to new hooks by @metcoder95 in #3903
• feat(interceptors): migrate decorator handler to new hooks by @metcoder95 in #3905
• feat: Adjust allowed error codes for detecting node:sqlite by @xconverge in #3900
• build(deps): bump actions/dependency-review-action from 4.4.0 to 4.5.0 by @dependabot in #3913
• build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.7 by @dependabot in #3910
• Move Tomas to past collaborators by @delvedor in #3909
• docs: add advanced usage examples for ProxyAgent by @mertcanaltin in #3906
• [Release] v7.1.0 by @github-actions in #3922

Full Changelog: v7.0.0...v7.1.0

v7.0.0-alpha.8

What's Changed

• Multiple fixes for SQLiteStore, enable it in CI by @mcollina in #3881
• Update WPT by @github-actions in #3838
• cache: fix stale-while-revalidate and stale-if-error by @flakey5 in #3865
• refactor: port redirect handler to new hooks by @ronag in #3879
• Drop node v18 by @mcollina in #3880
• build(deps-dev): bump borp from 0.18.0 to 0.19.0 by @dependabot in #3882
• perf: store data as blobs in sql cache by @ronag in #3885
• test: add cache testing suite by @flakey5 in #3842

Full Changelog: v7.0.0-alpha.7...v7.0.0-alpha.8

v7.0.0

What's Changed

• fetch: fix content-encoding order by @tsctx in #3343
• Add regression test for broken body by @mcollina in #3346
• build(deps): bump node from 075a5cc to 9af472b in /build by @dependabot in #3355
• fix: post request signal by @Gigioliva in #3354
• Revert "fix: post request signal (#3354)" by @ronag in #3359
• websocket: don't use pooled buffer in mask pool by @tsctx in #3357
• fix: consider bytes read when dumping by @ronag in #3360
• refactor: simplify signal handling by @ronag in #3362
• fix: use explicit flag for when use has interacted with stream by @ronag in #3361
• Refactor example documentation structure and add CacheableLookup example by @DarkGL in #3363
• refactor: simplify request error handling by @ronag in #3364
• fix: ensure onConnect is always called by @ronag in #3327
• Refactor responseHeader to responseHeaders by @DarkGL in #3375
• fix: don't override user defined MaxListeners by @fawazahmed0 in #3372
• fix: forward dispatch return value by @ronag in #3368
• build(deps): bump github/codeql-action from 3.25.7 to 3.25.11 by @dependabot in #3382
• build(deps): bump codecov/codecov-action from 4.4.1 to 4.5.0 by @dependabot in #3384
• build(deps): bump actions/dependency-review-action from 4.3.2 to 4.3.3 by @dependabot in #3383
• build(deps): bump step-security/harden-runner from 2.8.0 to 2.8.1 by @dependabot in #3381
• fix: throw on retry when payload is consume by downstream by @climba03003 in #3389
• Remove file by @KhafraDev in #3367
• build(deps): bump node from 9af472b to 138d0b5 in /build by @dependabot in #3392
• feat!: upgrade llhttp to 9.2.0 (#2705) by @metcoder95 in #3388
• websocket: reduce memory usage by @tsctx in #3393
• feat: implement BodyReadable.bytes by @tsctx in #3391
• websocket: avoid using Buffer.byteLength by @tsctx in #3394
• separate whatwg websocket logic from rfc 6455 by @KhafraDev in #3396
• websocket: add fast-path for string input by @tsctx in #3395
• Add generic type for opaque object by @jfhr in #3385
• build(deps): bump node from 138d0b5 to 67225d4 in /build by @dependabot in #3398
• interceptors: move throwOnError to interceptor by @mertcanaltin in #3331
• chore!: drop interceptors by @metcoder95 in #3399
• build(deps-dev): bump @fastify/busboy from 2.1.1 to 3.0.0 by @dependabot in #3404
• fix: don't call onConnect automatically by @ronag in #3407
• In CITGM, skip tests that are flaky there by @mcollina in #3413
• Update esbuild to 0.19.10 by @mcollina in #3415
• Fix signature of RetryHandler by @JbIPS in #3416
• docs: fix ToC in CONTRIBUTING.md by @richardlau in #3420
• Fix fetch duplex docs by @Ethan-Arrowood in #3422
• fix: restore externalized Node.js dep compatibility by @richardlau in #3421
• fix: cast falsy servername to null to avoid falsy inequality by @ronag in #3426
• Add backport action by @mcollina in #3427
• build(deps): bump node from 67225d4 to 858234a in /build by @dependabot in #3411
• build(deps): bump github/codeql-action from 3.25.11 to 3.25.15 by @dependabot in #3432
• build(deps): bump actions/dependency-review-action from 4.3.3 to 4.3.4 by @dependabot in #3431
• build(deps): bump actions/upload-artifact from 4.3.3 to 4.3.4 by @dependabot in #3430
• build(deps): bump ossf/scorecard-action from 2.3.3 to 2.4.0 by @dependabot in #3428
• build(deps): bump step-security/harden-runner from 2.8.1 to 2.9.0 by @dependabot in #3429
• build(deps): bump superagent from 9.0.2 to 10.0.0 in /benchmarks by @dependabot in #3439
• build(deps): bump node from 17e6738 to 30c5be9 in /build by @dependabot in #3443
• docs: use default link of Web Streams API by @trivikr in #3446
• fix: increased memory in finalization first appearing in v6.16.0 by @snyamathi in #3445
• test: add test for memory leak by @snyamathi in #3450
• build: parametrize the location of wasm-opt by @khardix in #3454
• test: streamline test scripts in regard of without-intl and run more tests for without-intl case by @Uzlopak in #3453
• feat!: drop throwOnError by @metcoder95 in #3451
• types: allow non strict HTTPMethod by @Uzlopak in #3457
• build(deps-dev): bump borp from 0.15.0 to 0.17.0 by @dependabot in #3424
• remove core isErrored and isReadable by @KhafraDev in #3459
• use bodyUnusable to check if body is unusable by @KhafraDev in #3460
• perf: non-recursive implementation of euclidian gcd in balanced pool by @Uzlopak in #3461
• fix: do validation first before actual business logic, like super() by @Uzlopak in #3463
• use FinalizationRegistry for cloned response body by @KhafraDev in #3458
• perf: use isIPv6 for checking if hostname is isIPv6 by @Uzlopak in #3466
• fix: stripURLForReferrer jsdoc in fetch logic by @Uzlopak in #3471
• fix: remove kInterceptors in ProxyAgent by @Uzlopak in #3474
• fix: fix codesmells in retry-handler by @Uzlopak in #3475
• add autocompletable header types by @KhafraDev in #3462
• fix: add missing kOriginalDispatch Symbol in mock-logic by @Uzlopak in #3470
• fix: fix jsdoc in cookies/parse.js by @Uzlopak in #3469
• fix: remove unnecessary parameters in USVString calls by @Uzlopak in #3467
• fix: add jsdoc in tree.js, avoiding codesmells by @Uzlopak in #3476
• perf: set isLowerCase param on all calls of HeadersList.append by @Uzlopak in #3468
• fix: instantiation of ResponseError, pass headers and data correctly by @Uzlopak in #3472
• ci: add WPT updater by @Uzlopak in #3482
• meta: move nightly comment body to issue body by @redyetidev in #3484
• chore: improve jsdoc in cookies by @Uzlopak in #3478
• chore: improve jsdoc and minor changes in EventSource by @Uzlopak in #3480
• types: add Autocomplete utility type by @Uzlopak in #3479
• fix: instantiation of SecureProxyConnectionError should pass options to parent class by @Uzlopak in #3473
• chore: replace standard and snazzy with neostandard by @Uzlopak in #3485
• fix: workflow commit user by @tsctx in #3491
• build(deps): bump node from 30c5be9 to a20e858 in /build by @dependabot in #3496
• chore: add --noEmit for typescript tests by @Uzlopak in #3498
• perf: only create wasm buffer if requested by @Uzlopak in #3499
• fix(types): MockAgent accepts ProxyAgent, EnvHttpProxyAgent and RetryAgent for agent option by @Uzlopak in #3497
• stricter Headers brand checks in cookies by @KhafraDev in #3500
• Update WPT by @github-actions in #3488
• fix: setEncoding should not throw on body #1125 by @Uzlopak in #3505
• websocket: set websocket readyState on fail by @KhafraDev in #3507
• build(deps-dev): bump jsdom from 24.1.3 to 25.0.0 by @dependabot in #3511
• build(deps):...