Additional changes to review3 matched termsMatched wording:⚠ warning symboldeprecatedno longerThese matches may be harmless in context. Expand to see the excerpts.
- A warning symbol appears outside an explicit breaking section.
⚠️ Notable Changes
- The changelog mentions deprecation; it may still be compatible.
Deprecated replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy quirks may see different output bytes. ()
v1.16.0 — May 2, 2026
This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.
⚠️ Notable Changes
A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:
- Fetch adapter now enforces
maxBodyLengthandmaxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795) - Proxy requests now preserve user-supplied
Hostheaders. Previously, the proxy path could overwrite a customHost. Virtual-host-style routing through a proxy will now behave correctly. (#10822) - Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g.
https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)