Update dependency got to v16

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
got	^14 → ^16.0.0

---

Release Notes

sindresorhus/got (got)

v16.0.0

Compare Source

Breaking changes

• Rewrite HTTP/2 support and drop the http2-wrapper dependency (#​2464) 1e157c4
  • Got now has a built-in HTTP/2 client: ALPN negotiation, a pooled session cache with multiplexing, GOAWAY retirement, request and response trailers, informational (1xx) responses, abort signals, response caching, IPv6 authorities, and h2c through h2session.
  • agent.http2 is no longer an agent slot. It is only an opt-out flag now: pass false to skip session pooling. Passing an agent instance throws.
  • Response headers no longer contain HTTP/2 pseudo-headers. Use response.statusCode instead of response.headers[':status'].
  • A custom agent.https combined with http2: true makes Got use the native HTTP/1.1 path, because the built-in session pool does not support custom HTTPS agents.
  • HTTP/2 proxy support is gone. It came from http2-wrapper. It was very buggy anyway.
  • If options.request returns a request or response, it controls the transport and the HTTP/2 client is bypassed. Return undefined to fall back to Got's own transport.
• Rewrite DNS cache and drop the cacheable-lookup dependency (#​2463) bfc400b
  • dnsCache: true now uses Got's own cache. The option accepts any object with a lookup function and an optional clear(hostname?) function, so an existing CacheableLookup instance still works if you keep the dependency yourself.
  • The built-in cache resolves A and AAAA records separately, so it cannot preserve OS-specific verbatim address ordering from dns.lookup().
• A beforeRequest hook, an afterResponse retry, or a pagination step that moves the request to a different origin now strips credentials and drops the body (#​2465) dd3b295
  • authorization, cookie, cookie2, host, and proxy-authorization are removed, URL credentials are dropped, and an unchanged body is cleared. Set the headers or body explicitly inside the hook if you want them to cross the origin boundary.
  • This applies whether the origin changes through url or through prefixUrl.
• copyPipedHeaders no longer copies credentials 1d233ba
  • authorization, cookie, cookie2, set-cookie, and set-cookie2 are now omitted along with host, the hop-by-hop headers, and anything nominated by Connection / Proxy-Connection. Pass credentials explicitly in headers when the upstream is trusted.
• Remove the deprecated searchParameters, followRedirects, and auth option stubs 1d233ba
  • They only existed to throw a guidance message. Passing them now throws Unexpected option: ….
• Remove the OptionsOfUnknownResponseBody type 1d233ba
  • It was a pure alias for StrictOptions.

Improvements

• Add support for the QUERY HTTP method (#​2466) e3924aa
  • Adds got.query() and got.stream.query(). QUERY is safe and idempotent, so it is retried by default and keeps a replayable body across 301 and 302 redirects as well as 307 and 308. It is not stored by the built-in cache, because correct QUERY caching needs cache keys that include the request content.
• allowGetBody now also works over HTTP/2 1e157c4
• timeout.socket now applies during HTTP/2 TLS negotiation and session setup c6bbb8a
  • It was previously folded into the connection setup timeout and reported as a request timeout. It now produces a real socket timeout and no longer counts DNS lookup time.
• Two fewer dependencies: cacheable-lookup and http2-wrapper bfc400b 1e157c4

Fixes

• Retry on connection errors reported by request.end() instead of failing the request (#​2470) 67919b2
• Retry immediately when the server answers with Retry-After: 0 instead of falling back to the backoff delay (#​2471) d35ce87
• Preserve the response body when a cookie jar write throws c6bbb8a
  • error.response.body is now complete, decompressed, and decoded with the configured encoding, and a decoding failure no longer masks the original error.
• Wait for async cookie jar writes on terminal redirect responses, for example with followRedirect: false c6bbb8a
• Only buffer the response body for cookie handling when the response actually sends set-cookie c6bbb8a
• Fix got.stream finalizing the response before the response event and before piped server response headers are set c6bbb8a
• Fix strictContentLength counting bytes from responses that were not actually decompressed c6bbb8a
• Freeze hooks.beforeCache along with the other hook arrays on non-mutable defaults 1d233ba
• Keep URL credentials when prefixUrl is changed to a same-origin value, and treat credentials in prefixUrl as explicit dd3b295

Migration guide

HTTP/2

Remove http2-wrapper from your code. Got's HTTP/2 client is built in.

Before:

import http2wrapper from 'http2-wrapper';

const {headers} = await got(url, {
	http2: true,
	request: http2wrapper.auto,
	agent: {
		http2: new http2wrapper.Agent()
	}
});

console.log(headers[':status']);

After:

const {statusCode} = await got(url, {http2: true});

console.log(statusCode);

To opt out of HTTP/2 session pooling for a request, set agent.http2 to false.

If you need an HTTP/2 proxy, keep using http2-wrapper through the request option. Returning a request from request bypasses Got's HTTP/2 client.

h2c

The h2session hook example no longer needs request or http2.

Before:

import http2 from 'http2-wrapper';

got.extend({
	hooks: {
		beforeRequest: [
			options => {
				options.h2session = getSession(options.url);
				options.http2 = true;
				options.request = http2.request;
			}
		]
	}
});

After:

got.extend({
	hooks: {
		beforeRequest: [
			options => {
				options.h2session = getSession(options.url);
			}
		]
	}
});

dnsCache

dnsCache: true keeps working and now uses Got's built-in cache. If you depend on cacheable-lookup specific options, install it yourself and pass the instance:

import CacheableLookup from 'cacheable-lookup';

const dnsCache = new CacheableLookup({maxTtl: 60});

await got(url, {dnsCache});

Cross-origin hooks

If a beforeRequest hook, an afterResponse retry, or a pagination step sends the request to a different origin, set the headers and body you want to keep explicitly:

got.extend({
	hooks: {
		beforeRequest: [
			options => {
				options.url = new URL('https://other.example.com/path');
				options.headers.authorization = 'Bearer …';
			}
		]
	}
});

copyPipedHeaders

Credentials are no longer forwarded from a piped request. Pass them explicitly when the upstream is trusted:

got.stream(url, {
	copyPipedHeaders: true,
	headers: {
		authorization: request.headers.authorization
	}
});

---

v15.1.0

Compare Source

• Add allowAbsoluteUrls option (#​2462) 1c88e88

---

v15.0.7

Compare Source

• Fix: Preserve request body on cross-origin 307 and 308 redirects (#​2460) aee9249

---

v15.0.6

Compare Source

• Fix searchParams setter dropping the value when a URL is set (#​2454) 5772bf2

---

v15.0.5

Compare Source

• Fix: Handle abort signals added by handlers 74e3167

---

v15.0.4

Compare Source

• Fix aborting during download progress 11a2202

---

v15.0.3

Compare Source

• Fix false ReadError on responses without Content-Length 071ea07

---

v15.0.2

Compare Source

• Fix stream cookie jar completion race b170125

---

v15.0.1

Compare Source

• Fix init types 20633bc

---

v15.0.0

Compare Source

Breaking changes

• Require Node.js 22 b933476
• Remove promise cancel API a06ac6c
  • promise.cancel() is gone. Use the signal option with AbortController instead.
• Remove isStream option c241c6c
  • Use got.stream() directly.
• Use native FormData global 670b228
  • Use the Web API FormData global directly (available in Node.js 18+).
• responseType: 'buffer' returns Uint8Array instead of Buffer 309e36d
  • response.rawBody and promise.buffer() now return a Uint8Array. Buffer is a subclass of Uint8Array, so most code will continue to work, but strict type checks will need updating.
• strictContentLength defaults to true 08e9dff
  • Got now throws a ContentLengthMismatchError by default if Content-Length doesn't match the actual body size. Set {strictContentLength: false} to restore the old behavior.
• retry.enforceRetryRules defaults to true 9bc8dfb
  • Custom calculateDelay functions are now only called when a retry is actually allowed by limit, methods, statusCodes, and errorCodes. If your calculateDelay was previously used to override retry eligibility unconditionally, set {retry: {enforceRetryRules: false}}.
• Piped header copying is now opt-in 8e392f3
  • Got no longer automatically copies headers from a piped stream. Set {copyPipedHeaders: true} to re-enable. Hop-by-hop headers are never copied even when enabled (RFC 9110 §7.6.1).
• url removed from public options objects 87de8d6
  • The url property is no longer present on the options object passed to hooks. Use response.url or request.requestUrl instead.
• 300 and 304 responses are no longer auto-followed 5fccaab
  • Per RFC 9110, 304 is a conditional-GET hint, not a redirect, and 300 is only a SHOULD for user agents. Got now returns these responses as-is. Handle them manually if needed.
• Removed the undocumented named export for Got.
  • Got has always been a default export. The named export was there only for buggy build tools during the ESM migration times.

Improvements

• Stream decode large text/json bodies incrementally for lower peak memory usage c9a95b1
• uploadProgress now emits granular per-chunk events for json and form request bodies 13c889d

---

Migration guide

Replace promise.cancel() with AbortController

Before:

const promise = got(url);
promise.cancel();

After:

const controller = new AbortController();
const promise = got(url, {signal: controller.signal});
controller.abort();

Replace isStream: true with got.stream()

Before:

got(url, {isStream: true});

After:

got.stream(url);

Replace form-data / form-data-encoder with native FormData

Before:

import {FormData} from 'formdata-node';
// or: import {FormData} from 'formdata-polyfill/esm.min.js';

const form = new FormData();
form.set('name', 'value');
await got.post(url, {body: form});

After:

const form = new FormData();
form.set('name', 'value');
await got.post(url, {body: form});

Update Buffer usage to Uint8Array

response.rawBody and promise.buffer() now return Uint8Array instead of Buffer.

Before:

const data = await got(url).buffer();
const copy = Buffer.from(data);

After:

const data = await got(url).buffer();
const copy = new Uint8Array(data);

If you need Buffer-specific APIs, wrap with Buffer.from(data.buffer, data.byteOffset, data.byteLength).

strictContentLength is now on by default

If you send requests where the Content-Length header might not match the actual body size, opt out:

got.extend({strictContentLength: false});

retry.enforceRetryRules is now on by default

If your calculateDelay function was overriding retry eligibility (e.g. retrying on methods or status codes outside the defaults), opt out:

got.extend({
	retry: {
		enforceRetryRules: false,
		calculateDelay: ({computedValue}) => {
			// computedValue is 0 when retry is not allowed
			if (computedValue === 0) {
				return 0;
			}

			return computedValue;
		},
	},
});

Piped header copying is now opt-in

If you pipe streams into Got and rely on automatic header forwarding (e.g. Content-Type), re-enable it:

got.extend({copyPipedHeaders: true});

300 and 304 responses are no longer followed

If your code depended on Got auto-following 300 Multi-Choice or handling 304 Not Modified as a redirect, you now need to handle them yourself in an afterResponse hook or check response.statusCode manually.

---

v14.6.6

Compare Source

• Fix stream auto-end for empty PATCH/DELETE/OPTIONS 4d5168c
  • The bug was introduced in b65b0e1, where it incorrectly auto-closed streams for empty PATCH/DELETE/OPTIONS when using streams. This broke the documented use case of piping data to a got stream for these methods.
  • Docs:

    got.stream does not auto-end for OPTIONS, DELETE, or PATCH so you can pipe or write a body without getting write after end. Call stream.end() when you are not piping a body.

---

v14.6.5

Compare Source

• Fix TypeScript type inference for got.extend() with responseType option f7ab6e9

---

v14.6.4

Compare Source

• Fix dnsLookup option type to accept Node.js dns.lookup 47c3155

---

v14.6.3

Compare Source

• Fix socket reuse timing and DNS timing fb03d84 61d5e3b

---

v14.6.2

Compare Source

• Fix path segments containing colons being misidentified as absolute URLs 0a16a9c

---

v14.6.1

Compare Source

• Fix the TS code not being built in 14.6.0.

---

v14.6.0

Compare Source

Improvements

• Add beforeCache hook 1c3a041
• Add retryCount to beforeRequest hook context 91cdc48
• Improve HTTPError message to include method and URL 6dd7574
• Add support for typed arrays as request body ecf5633
• Add Node.js diagnostic channel support 3e2a781
• Allow custom Error classes in beforeError hook 1c71194
• Add zstd (Zstandard) compression support 449833a
• Improve validation error messages by including option names f5c54a3
• Add strictContentLength option 4206f0e
• Add support for https.secureOptions option 7ec1714
• Add copyPipedHeaders option to control automatic header copying from piped streams d83dadd
• Add stream.isReadonly property to detect read-only streams 030dfbb

Fixes

• Fix HTTP/2 timings NaN issue 398c11a
• Fix shortcut methods ignoring handler errors f004564
• Fix body reassignment in beforeRetry hooks bf84d36
• Fix beforeError hook not being called for ERR_UNSUPPORTED_PROTOCOL error fb86418
• FIx preserving prefixUrl in hooks 9725fbd
• Fix race condition causing retry after promise settles 1e49781
• Fix stream validation errors causing unhandled rejections 2527bf6
• Fix incorrect content-length when piping decompressed responses 30b3b79
• Fix EPIPE errors bypassing retry logic in Promise API 6ae3e7f
• Fix silent hang when returning cached response with FormData body from beforeRequest hook e09a9bd
• Fix hook type definitions to reflect normalized runtime state 6a544a3
• Fix afterResponse hook validation to allow null body values 60a4419
• Fix DNS timing being non-zero when connecting to IP addresses 3d66aec
• Fix timings.end being undefined when stream is destroyed before completion 4e75679
• Fix properly treating different UNIX socket paths as different origins e5659d4

Meta

I managed to get it almost down to zero issues! 🎉

---

v14.5.0

Compare Source

• Add retry.enforceRetryRules option to fix statusCodes/limit bypassing 7c0aee6
• Add support for serverName HTTPS option cdaab63
• Add preserveHooks option for retryWithMergedOptions 1abeba4
• Support Iterable and AsyncIterable as request body b65b0e1
• Fix hang on revalidated cached responses 2ab94fd
• Fix handling of FormData getLength errors a2812de
• Fix downloadProgress firing for redirect responses 9ec6ff0
• Fix TypeScript type definition for retry event's createRetryStream parameter e899c07
• Fix validation to accept false as agent value 6961284
• Fix HTTP/2 memory leak from timeout listeners with connection reuse d1d4ed2
• Fix QuickLRU v7+ compatibility 23d0b6b
• Fix it not using HTTP/2 connection reuse by default 724d592
• Fix hang with stream requests without body for methods like OPTIONS dc4f1e3

---

v14.4.9

Compare Source

• Fix hang with responses containing content-encoding headers but no body cc434bc

---

v14.4.8

Compare Source

• Fix infinite loop when retrying with request.options in afterResponse hook dad6a91

---

v14.4.7

Compare Source

• Fix: Gracefully handle undefined request (#​2404) 06029e0

---

v14.4.6

Compare Source

• Fix timeout error firing even though it's cancelled (#​2399) 7a92064

v14.4.5

Compare Source

• Fix a crash with Got accessing a non-existent request (#​2391) c079b93

v14.4.4

Compare Source

• Fix support for AbortSignal#timeout() (#​2388) 92b378e

v14.4.3

Compare Source

• Fix cache with HTTP2 (#​2380) f2f8cb2

v14.4.2

Compare Source

• Fix handling of invalid arguments (#​2367) f44ef43

v14.4.1

Compare Source

• Fix missing dependency dfc54d9

v14.4.0

Compare Source

• Improve TypeScript types with generic extend (#​2353) 15ca4a0

v14.3.0

Compare Source

• Update dependencies dbab6c3

v14.2.1

Compare Source

• Fix error handling when UTF-8 decoding fails (#​2336) c81a611

v14.2.0

Compare Source

• Add cause property with the original error to RequestError (#​2327) 4cbd01d

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm error code EBADENGINE
npm error engine Unsupported engine
npm error engine Not compatible with your version of node/npm: got@16.0.0
npm error notsup Not compatible with your version of node/npm: got@16.0.0
npm error notsup Required: {"node":">=22"}
npm error notsup Actual:   {"npm":"10.8.2","node":"v20.20.2"}
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-14T02_29_09_553Z-debug-0.log