[dependabot]

Bumps got from 11.8.6 to 16.1.0.

Release notes

Sourced from got's releases.

v16.1.0

This release is the result of a large bug hunt. Many of the fixes make Got match its documented behavior, so you may notice some of them:

• Invalid options now throw: an empty method, a negative or fractional maxRedirects or retry.limit, a prefixUrl with a query string or fragment, and a handlers entry that is not a function.
• A stream with a body, json, or form option now rejects writes, as documented.
• The promise response event now only fires for the final response, not for every retry attempt.
• got.extend({body}) (and json, form) no longer sends the payload with every request of the instance. Payloads are never merged with defaults.
• instance.extend() now inherits the parent's mutableDefaults, like got.extend(instance).
• A HEAD request is no longer changed to GET on a 301, 302, or 303 redirect.
• response.body no longer keeps a leading UTF-8 byte order mark, and JSON with a byte order mark now parses.

Improvements

• Accept number values in headers 6fffc9e
• Export the Timings, DnsCacheLookup, and DnsCacheOptions types d012d1d eccaaca
• Retry FormData bodies by re-serializing them instead of failing 90c6ec1
• Support the x-gzip content coding and stacked content codings 5550a79

Fixes

• Fix many HTTP/2 edge cases, including requests that could hang forever when the response or request was destroyed d3c549c 78bf394 6bbc7f4 602b179 687b5c8 4ea02b8 b6522f3 9348ad6 c686386 3bbc37b 91dc486 11621cd
• Fix timeout.request restarting on each redirect, and several timeout phase edge cases 9cd2ee6 df33cdb 4e4c583 795234f 0f1263d
• Fix redirects: keep the URL fragment, evaluate followRedirect once per response, and keep Content-Length correct when a hook replaces the body 1febf3c a2b3d90 1d64f7c 60b48af
• Fix Infinity timeouts firing at once or throwing 724ebc2
• Fix retry delay edge cases, including invalid Retry-After values and calculateDelay for afterResponse retries fe58b8c 0193605
• Fix retries with replaced or non-replayable bodies ae5521f 7c1cda3 8bbc79f 1a56d36 d012d1d
• Fix the default paginate on real-world Link headers, and several pagination option and limit edge cases bd2dee0 1e61807 602b179 f98d0e1 c8419e4 526a988 557e61f 4712e5b a4a50ad b65e533
• Fix afterResponse, beforeRequest, and beforeCache hook edge cases 45c201c c1cf0f8 850e49b a4a50ad 863cf30 494279b
• Fix response body decoding and parsing edge cases c36ad51 c409a84 3c6eaf1 f658d3e dbd83df
• Fix stream edge cases: respect backpressure, stop forwarding after unpipe, and do not copy hop-by-hop headers to a piped ServerResponse 348e114 dc929bd dc56e4b c930cd9 a9a754f
• Fix uploads: DataView byte ranges, upload error classification, progress total for Content-Length: 0, and cancelling Web ReadableStream bodies 2a66686 d1cb051 0238069 b57120c 200bc85
• Fix option normalization, cloning, and immutable defaults 8f44d81 687eb7d 30023f7 5548b00 bec5da6 bcc0b01 9348ad6 a9a754f 7b13369 3bd0486 d272656 0e537c7 60b62a0 129d88d
• Fix error stacks reporting RequestError instead of the real error class, and other error cause edge cases c8419e4 9d61a37 5ccac58 71f4e0e
• Fix custom DNS cache lookups and DNS records without a valid TTL b3dc5c6 4ea02b8 d012d1d
• Fix cookie edge cases with retries, redirects, and async cookie jars 784bbd2 d5cd5e4
• Fix diagnostics channel coverage across retries and terminal errors cfce7b6
• Fix TypeScript types to match the runtime values 7c833b8 c59692b 88eeb13 0c17a8b c788ac9 a4176b6

---

sindresorhus/got@v16.0.0...v16.1.0

v16.0.0

Breaking changes

• Rewrite HTTP/2 support and drop the http2-wrapper dependency (#2464) 1e157c4
  • Got now has a built-in HTTP/2 client: ALPN negotiation, a pooled session cache with multiplexing, GOAWAY retirement, request and response trailers, informational (1xx) responses, abort signals, response caching, IPv6 authorities, and h2c through h2session.
  • agent.http2 is no longer an agent slot. It is only an opt-out flag now: pass false to skip session pooling. Passing an agent instance throws.
  • Response headers no longer contain HTTP/2 pseudo-headers. Use response.statusCode instead of response.headers[':status'].
  • A custom agent.https combined with http2: true makes Got use the native HTTP/1.1 path, because the built-in session pool does not support custom HTTPS agents.

... (truncated)

Commits

• 05b4476 16.1.0
• 50c4ac6 Simplify
• 03d541e Remove the companies section from the readme
• eac0aa1 Document that a payload does not belong in got.extend()
• 11621cd Settle an HTTP/2 request when the user destroys the response
• 33b3ab4 Sync the option doc comments with the documentation
• 5ccac58 Keep the cause frames intact when its message is not in its stack
• 91dc486 Keep an HTTP/2 response complete once END_STREAM arrived
• 3bbc37b Settle a destroyed in-progress http2 request
• 494279b Name null in the beforeError return validation
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
got	[>= 12.a, < 13]
got	[>= 13.a, < 14]
got	[>= 14.a, < 15]
got	[>= 15.a, < 16]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tom	Ready	Preview	Oct 16, 2026 6:37am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6282ac8c-b41a-4caf-99b5-fda4524cebe7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.