v4.9.1

What's Changed

Security

• Do not forward credential headers (Authorization, Cookie, Proxy-Authorization) on cross-origin redirect, and clear auth/digestAuth, matching the WHATWG Fetch spec and undici's RedirectHandler (#812). Same-origin redirects are unchanged and the caller's options object is never mutated.

Dependencies

• Update runtime dependencies: undici (^7.24.0), qs, form-data, formstream, and type-fest.

Internal

• Migrate the toolchain to Vite+ (Vitest 4, Oxlint, Oxfmt, tsdown).
• Two-stage release workflow with manual approval, publishing the 4.x line to the latest-4 npm dist-tag (#817).

Full Changelog: v4.9.0...v4.9.1

v2.44.1

What's Changed

Security

• Do not forward credential headers (Authorization, Cookie, Proxy-Authorization) on cross-origin redirect, and clear auth/digestAuth before following. Same-origin redirects are unchanged and the caller's headers object is never mutated (#813).

Internal

• Two-stage release workflow with manual approval, publishing the 2.x line to the latest-2 npm dist-tag (#815).
• Use Node 24 in the release workflow for npm 11 OIDC trusted publishing.

Full Changelog: v2.44.0...v2.44.1

v4.9.0

What's Changed

• chore: enable oxfmt by @fengmk2 in #602
• chore: enable tsgo on typecheck by @fengmk2 in #605
• chore(deps): update actions/checkout action to v6 by @renovate[bot] in #600
• chore(deps): update actions/setup-node action to v6 by @renovate[bot] in #596
• chore(deps): update dependency form-data to v4.0.5 by @renovate[bot] in #606
• chore(deps): update dependency @typescript/native-preview to v7.0.0-dev.20251210.1 by @renovate[bot] in #609
• chore(deps): update dependency typescript to v5.9.3 by @renovate[bot] in #607
• chore(deps): update dependency @tsconfig/node18 to v18.2.6 by @renovate[bot] in #603
• chore(deps): update codecov/codecov-action digest to 671740a by @renovate[bot] in #608
• chore(deps): update dependency @types/node to v22.19.2 by @renovate[bot] in #610
• chore(deps): update dependency cross-env to v10.1.0 by @renovate[bot] in #612
• chore(deps): update dependency oxlint to v1.32.0 by @renovate[bot] in #614
• chore(deps): update dependency @typescript/native-preview to v7.0.0-dev.20251211.1 by @renovate[bot] in #613
• chore(deps): update dependency @tsconfig/strictest to v2.0.8 by @renovate[bot] in #604
• chore(deps): update dependency @typescript/native-preview to v7.0.0-dev.20251213.1 by @renovate[bot] in #619
• chore(deps): update pnpm to v10.25.0 by @renovate[bot] in #618
• chore(deps): update dependency undici to v7.16.0 by @renovate[bot] in #617
• feat: enable isolatedDeclarations by @fengmk2 in #615

Full Changelog: v4.8.2...v4.9.0

---

This release is also available on:

• npm package (@latest dist-tag)

v4.8.2

What's Changed

• chore: migrate from ESLint to oxlint with @eggjs/oxlint-config extension by @Copilot in #590

New Contributors

• @Copilot made their first contribution in #590

Full Changelog: v4.8.1...v4.8.2

---

This release is also available on:

• npm package (@latest dist-tag)

v4.8.1

4.8.1 (2025-08-06)

• chore: add GIT_TOKEN (baabae9)
• chore: use npm trusted publisher (#589) (8f2ed13), closes #589
• chore(deps): update dependency cross-env to v10 (#584) (ad4405a), closes #584
• chore(deps): update dependency selfsigned to v3 (#582) (9e62fb1), closes #582
• fix: patch undici File support on Node.js < 20 (#588) (0e5ad19), closes #588

---

This release is also available on:

• npm package (@latest dist-tag)

v3.27.3

3.27.3 (2025-07-22)

Bug Fixes

• global dispatcher (#583) (25e90ab)

---

This release is also available on:

• npm package (@release-3.x dist-tag)

v4.8.0

4.8.0 (2025-07-08)

Features

• add isSentByFetch/fetchOpaque to urllib message (#581) (d7e9f40)

---

This release is also available on:

• npm package (@latest dist-tag)

v4.7.1

4.7.1 (2025-07-07)

Bug Fixes

• compatible with urllib@2 timeout string format (#580) (5eaf790)

---

This release is also available on:

• npm package (@latest dist-tag)

v4.7.0

4.7.0 (2025-07-03)

Features

• support multiple fetch_factory instances (#579) (d09d316)

---

This release is also available on:

• npm package (@latest dist-tag)

v4.6.12

4.6.12 (2025-06-28)

Bug Fixes

• compatible with pool stats reading (#578) (13a29af)

---

This release is also available on:

• npm package (@latest dist-tag)