undici breaking changes

8.12.2

1 breaking change, first published October 15, 2026.

• Behavior changed
  Responses from a cross-origin redirect are now checked against their origin before caching, and redirect-hop cache-control policy is preserved. Code that relied on those responses being cached under the original URL may see cache misses. github.com

8.12.0

8 breaking changes, first published October 14, 2026.

• Behavior changed
  Error response bodies handled by interceptors are now capped in size, so code expecting larger error bodies will receive truncated content. github.com
• Behavior changed
  Zstd-compressed responses with a window size above 8 MB are no longer accepted, so such payloads will fail to decode. github.com
• Behavior changed
  Request bodies of FormData types that were previously accepted are now rejected, so callers must send a supported body type. github.com
• Behavior changed
  Responses with compress or x-compress content encoding are no longer inflated, so code relying on decoded bodies for those encodings receives the raw data. github.com
• Behavior changed
  Code running where WebAssembly is missing will now get an error instead of the previous fallback behavior. github.com
• Signature changed errors.ResponseError.constructor
  Was constructor (message: string, code: number, options: {headers?: IncomingHttpHeaders | string[] | null, body?: null | Record<string, any> | string}); now constructor (message: string, code: number, options: {headers?... npmjs.com
• Signature changed interceptors.ResponseErrorInterceptorOpts
  Was type ResponseErrorInterceptorOpts = {throwOnError: boolean}; now type ResponseErrorInterceptorOpts = {throwOnError?: boolean maxSize?: number}. npmjs.com
• Signature changed interceptors.ResponseErrorInterceptorOpts.throwOnError
  Was throwOnError: boolean; now throwOnError?: boolean. npmjs.com

7.29.1

4 breaking changes, first published September 4, 2026.

• Behavior changed
  Cache reads and writes are restricted to safe methods such as GET; responses to POST or DELETE are no longer stored or replayed. Invalidation by successful unsafe requests still applies. github.com
• Behavior changed
  Responses containing Set-Cookie are now excluded from shared caches, including existing entries and revalidation paths. Code that relied on caching such responses will now get fresh responses. github.com
• Default changed
  Every decompression stage is capped at 64 MiB unless configured otherwise via maxSize. Larger decoded responses will now fail, so users with large compressed responses must set maxSize. github.com
• Signature changed interceptors.DecompressInterceptorOpts
  Was type DecompressInterceptorOpts = {skipErrorResponses?: boolean skipStatusCodes?: number[]}; now type DecompressInterceptorOpts = {skipErrorResponses?: boolean skipStatusCodes?: number[] maxSize?: number}. npmjs.com

7.29.0

2 breaking changes, first published July 24, 2026.

• Behavior changed
  Partial responses whose Content-Length does not match Content-Range are now rejected instead of being resumed. Code that relied on such responses will see errors. github.com
• Behavior changed setCookie
  Values passed to setCookie() that were previously accepted may now be rejected. Check that domain, path and unparsed values are well-formed. github.com

6.29.1

1 breaking change, first published October 15, 2026.

• Behavior changed EventSource
  EventSource now limits retained parser state, so unusually large or long-running event streams may be cut off or fail where they previously worked. Check that your server's events stay within these limits. github.com

6.28.1

1 breaking change, first published September 4, 2026.

• Behavior changed
  The retry interceptor checks Content-Range against the original response framing before resuming, so resumed responses with inconsistent framing are no longer passed through. Code relying on such responses may now see a failure. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.