chore(deps): update devdependencies (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@types/express (source)	^4.17.21 -> ^5.0.0
conventional-changelog-conventionalcommits (source)	^5.0.0 -> ^8.0.0
got	^11.8.6 -> ^14.4.5
node-fetch	^2.7.0 -> ^3.3.2
semantic-release	^19.0.5 -> ^24.2.1

---

Release Notes

conventional-changelog/conventional-changelog (conventional-changelog-conventionalcommits)

v8.0.0

Compare Source

⚠ BREAKING CHANGES

• Node >= 18 is required
• conventional-recommended-bump: new Bumper exported class (#​1218)
• cleanup presets interface (#​1215)
• conventional-changelog-writer: rewrite to TypeScript (#​1150)
• Now all packages, except gulp-conventional-changelog, are ESM-only.

Features

• cleanup presets interface (#​1215) (0e4f293)
• conventional-changelog-writer: rewrite to TypeScript (#​1150) (8af364f)
• conventional-recommended-bump: new Bumper exported class (#​1218) (0ddc8cd)
• drop node 16 support (#​1226) (ec69cfd)
• move from CommonJS to ESM (#​1144) (c5b859d)

Bug Fixes

• conventional-changelog-conventionalcommits: avoid double empty lines (#​1235) (3b4bfdf), closes #​1188

v7.0.2

Compare Source

Bug Fixes

• conventional-changelog-conventionalcommits: fix handling input params (#​1120) (e721cde)

v7.0.1

Compare Source

Bug Fixes

• conventional-changelog-conventionalcommits: include constants.js in package (#​1095) (a730b18), closes #​1093

v7.0.0

Compare Source

⚠ BREAKING CHANGES

• Node >= 16 is required
• Now all presets are exports preset config factory function. conventional-changelog-preset-loader now exports new loadPreset and createPresetLoader functions. If you are using presets indirectly, using preset name, no any changes in configuration needed, just upgrade packages to latest versions.

Features

• conventional-changelog-conventionalcommits: add support for alphanumeric issues (#​1080) (f9b1897)
• drop node 14 support (#​1085) (1bce036)
• git-raw-commits: ignore commits by regex (#​1063) (47033e6)
• types: allow combining provided types with defaults (#​1064) (7ec8a18)
• unified presets interface (#​1045) (8d0ffbe)

v6.1.0

Compare Source

Features

• conventional-changelog-conventionalcommits: sort groups based on config types (#​702) (#​1002) (0e59f0c)

v6.0.0

Compare Source

⚠ BREAKING CHANGES

• now all promises are native
• Node >= 14 is required

Code Refactoring

• drop lodash from dependencies where it possible (#​959) (a8b4e12)
• drop q from dependencies (#​974) (d0e5d59)

sindresorhus/got (got)

v14.4.5

Compare Source

• Fix a crash with Got accessing a non-existent request (#​2391) c079b93

v14.4.4

Compare Source

• Fix support for AbortSignal#timeout() (#​2388) 92b378e

v14.4.3

Compare Source

• Fix cache with HTTP2 (#​2380) f2f8cb2

v14.4.2

Compare Source

• Fix handling of invalid arguments (#​2367) f44ef43

v14.4.1

Compare Source

• Fix missing dependency dfc54d9

v14.4.0

Compare Source

• Improve TypeScript types with generic extend (#​2353) 15ca4a0

v14.3.0

Compare Source

• Update dependencies dbab6c3

v14.2.1

Compare Source

• Fix error handling when UTF-8 decoding fails (#​2336) c81a611

v14.2.0

Compare Source

• Add cause property with the original error to RequestError (#​2327) 4cbd01d

v14.1.0

Compare Source

• Allow typing the body of a RequestError response (#​2325) 5e4f6ff

v14.0.0

Compare Source

Breaking

• Require Node.js 20 (#​2313) a004263
  • Why not target the oldest active Node.js LTS, which is Node.js 18? I usually strictly follow this convention in my packages. However, this package is the exception because the HTTP part of Node.js is consistently buggy, and I don't have time to work around issues in older Node.js releases. I you need to still support Node.js 18, I suggest staying on Got v13, which is quite stable. Node.js 18 will be out of active LTS in 5 months.

Improvements

• Make followRedirect option accept a function (#​2306) 7c3f147

v13.0.0

Compare Source

As a reminder, Got continues to require ESM. For TypeScript users, this includes having "module": "node16", "moduleResolution": "node16" in your tsconfig.

Breaking

• Require Node.js 16 52a1063
• Change the enableUnixSockets option to be false by default 852c312
  • Most users don't need it.

Improvements

• Allow specifying undefined for options (#​2258) 1cefe8b

v12.6.1

Compare Source

• Fix get-stream import statement (#​2266) 67d5039

v12.6.0

Compare Source

• Update dependencies 88c88fb 979272e
• Loosen URL validation strictness (#​2200) 0ca0b7f

v12.5.3

Compare Source

• Fix abort event listeners not always being cleaned up (#​2162) 3cc40b5

v12.5.2

Compare Source

• Improve TypeScript 4.9 compatibility (#​2163) 39f83b6

v12.5.1

Compare Source

• Fix compatibility with TypeScript and ESM 3b3ea67
• Fix request body not being properly cached (#​2150) 3e9d3af

v12.5.0

Compare Source

• Disable method rewriting on 307 and 308 status codes (#​2145) e049e94
• Upgrade dependencies 8630815 f0ac0b3 4c3762a

v12.4.1

Compare Source

Fixes

• Fix options.context being not extensible b671480
• Don't emit uploadProgress after promise cancelation 693de21

v12.4.0

Compare Source

Improvements

• Support FormData without known length (#​2120) 850773c

Fixes

• Don't call beforeError hooks with HTTPError if the throwHttpErrors option is false (#​2104) 3927348

v12.3.1

Compare Source

• Don't freeze signal when freezing Options (#​2100) 43b1467

v12.3.0

Compare Source

• Add .off() method for events (#​2092) 88056be

v12.2.0

Compare Source

• Support AbortController (#​2020) 6a6d2a9
• Add enableUnixSockets option (#​2062) 461b3d4

v12.1.0

Compare Source

Improvements

• Add response.ok (#​2043) 22d58fb
  • This is only useful if you have {throwHttpErrors: false}

Fixes

• Do not redirect to UNIX sockets (#​2047) 861ccd9
  • CVE-2022-33987
  • Also back ported to v11

v12.0.4

Compare Source

• Remove stream lock - unreliable since Node 17.3.0 bb8eca9

v12.0.3

Compare Source

• Allow more types in the json option (#​2015) eb045bf

v12.0.2

Compare Source

• Fix encoding option with {responseType: 'json'} (#​1996) 0703318

v12.0.1

Compare Source

• Fix nock compatibility (#​1959) bf39d2c
• Fix missing export of Request TypeScript type (#​1940) 0f9f2b8

v12.0.0

Compare Source

Introducing Got v12.0.0 🎉

Long time no see! The latest Got version (v11.8.2) was released just in February ❄️
We have been working hard on squashing bugs and improving overall experience.

If you find Got useful, you might want to sponsor the Got maintainers.

This package is now pure ESM

Please read this. Also see https://github.com/sindresorhus/got/issues/1789.

• Please don't open issues about [ERR_REQUIRE_ESM] and Must use import to load ES Module errors. This is a problem with your setup, not Got.
• Please don't open issues about using Got with Jest. Jest does not fully support ESM.
• Pretty much any problem with loading this package is a problem with your bundler, test framework, etc, not Got.
• If you use TypeScript, you will want to stay on Got v11 until TypeScript 4.6 is out. Why.
• If you use a bundler, make sure it supports ESM and that you have correctly configured it for ESM.
• The Got issue tracker is not a support channel for your favorite build/bundler tool.

Required Node.js >=14

While working with streams, we encountered more Node.js bugs that needed workarounds.
In order to keep our code clean, we had to drop Node.js v12 as the code would get more messy.
We strongly recommend that you update Node.js to v14 LTS.

HTTP/2 support

Every Node.js release, the native http2 module gets more stable.
Unfortunately there are still some issues on the Node.js side, so we decided to keep HTTP/2 disabled for now.
We may enable it by default in Got v13. It is still possible to turn it on via the http2 option.

To run HTTP/2 requests, it is required to use Node.js v15.10 or above.

Bug fixes

Woah, we possibly couldn't make a release if we didn't fix some bugs!

• Do not throw on custom stack traces (#​1491) 49c16ee
• Remove automatic content-length on ReadStream (#​1510) 472b8ef
• Fix promise shortcuts in case of error status code (#​1543) ff918fb 1107cc6
• Invert the methodRewriting option 51d88a0
• Fix url not being reused on retry in rare case (#​1487) 462bc63
• Fix hanging promise on HTTP/2 timeout (#​1492) a59fac4
• Prevent uncaught ParseErrors on initial successful response (#​1527) 77df9c3
• Throw an error when retrying with consumed body (#​1507) 62305d7
• Fix a Node.js 16 bug that hangs Got streams 06a2d3d
• Fix default pagination handling for empty Link header (#​1768) 1e1e506
• Fix incorrect response.complete when using cache 9e15d88
• Fix Cannot call end error when request returns a Writable 226cc39
• Fix Request options not being reused on retry 3c23eea
• Fix types being not compatible with CommonJS 3c23eea
• Fix got.paginate does not call init hooks (#​1574) 3c23eea
• Generate a new object when passing options to the native https module (#​1567) 3c23eea
• Remove stream reuse check (#​1803) 9ecc5ee
• Fix merging searchParams (#​1814) 1018c20 732e9bd
• Fix unhandled exception when lookup returns invalid IP early (#​1737) 2453e5e
• Fix relative URLs when paginating 439fb82
• Require url to be an instance of URL when paginating (#​1818) eda69ff
• Fix username and password encoding in URL (#​1169 #​1317) d65d0ca
• Clone raw options 1c4cefc
• Fix invalid afterResponse return check cbc8902
• Fix https.alpnProtocols not having an effect e1099fb

Improvements

• Make the context option mergeable (#​1459) 2b8ed1f
• Add generic argument to AfterResponseHook TypeScript type (#​1589) 6fc04a9
• Add read timeout (#​1518) e943672 (blocked by https://github.com/nodejs/node/issues/35923)
• Improve the pagination API (#​1644) 2675046
• Change the stackAllItems option to be false by default (#​1645) 1120370
• Throw when afterResponse hook returns an invalid value 4f21eb3
• Add retry.backoffLimit option 41c4136
• Add noise retry option e830077
• Enable more HTTPS options 83575d5 fe723a0 (thanks @​Giotino)
• Define error.code f27e8d3
• Set options.url even if some options are invalid 8d6a680
• Improve memory usage when merging options 2db5ec5
• Support async generators as body 854430f 3df52f3
• Add missing once types for Stream API 3c23eea
• New error type: RetryError which always triggers a new retry when thrown 3c23eea
• error.options is now enumerable 3c23eea
• defaults.handlers don't need a default handler now 3c23eea
• Add a parser for the Link header 3c23eea
• General code improvements a5dd9aa

Breaking changes

Improved option normalization

• Got exports an Option class that is specifically designed to parse and validate Got options.
  It is made of setters and getters that provide fast normalization and more consistent behavior.

When passing an option does not exist, Got will throw an error. In order to retrieve the options before the error, use error.options.

import got from 'got';

try {
    await got('https://httpbin.org/anything', {
        thisOptionDoesNotExist: true
    });
} catch (error) {
    console.error(error);
    console.error(error.options.url.href);
    // Unexpected option: thisOptionDoesNotExist
    // https://httpbin.org/anything
}

• The init hook now accepts a second argument: self, which points to an Options instance.

In order to define your own options, you have to move them to options.context in an init hook or store them in options.context directly.

• The init hooks are ran only when passing an options object explicitly.

- await got('https://example.com'); // this will *not* trigger the init hooks
+ await got('https://example.com', {}); // this *will** trigger init hooks

• options.merge() replaced got.mergeOptions and Request.normalizeArguments

- got.defaults.options = got.mergeOptions(got.defaults.options, {…});
+ got.defaults.options.merge(…);

This fixes issues like #​1450

• Legacy Url instances are not supported anymore. You need to use WHATWG URL instead.

- await got(string, {port: 8443});
+ const url = new URL(string);
+ url.port = 8443;
+ await got(url);

• No implicit timeout declaration.

- await got('https://example.com', {timeout: 5000})
+ await got('https://example.com', {timeout: {request: 5000})

• No implicit retry declaration.

- await got('https://example.com', {retry: 5})
+ await got('https://example.com', {retry: {limit: 5})

• dnsLookupIpVersion is now a number (4 or 6) or undefined

- await got('https://example.com', {dnsLookupIpVersion: 'ipv4'})
+ await got('https://example.com', {dnsLookupIpVersion: 4})

• redirectUrls and requestUrl now give URL instances

- request.requestUrl
+ request.requestUrl.origin
+ request.requestUrl.href
+ request.requestUrl.toString()

- request.redirectUrls[0]
+ request.redirectUrls[0].origin
+ request.redirectUrls[0].href
+ request.redirectUrls[0].toString()

• Renamed request.aborted to request.isAborted

- request.aborted
+ request.isAborted

Reason: consistency with options.isStream.

• Renamed the lookup option to dnsLookup

- await got('https://example.com', {lookup: cacheable.lookup})
+ await got('https://example.com', {dnsLookup: cacheable.lookup})

• The beforeRetry hook now accepts only two arguments: error and retryCount

await got('https://example.com', {
    hooks: {
        beforeRetry: [
-            (options, error, retryCount) => {
-                console.log(options, error, retryCount);
-            }
+            (error, retryCount) => {
+                console.log(error.options, error, retryCount);
+            }
        ]
    }
})

The options argument has been removed, however it's still accessible via error.options. All modifications on error.options will be reflected in the next requests (no behavior change, same as with Got 11).

• The beforeRedirect hook's first argument (options) is now a cloned instance of the Request options.

This was done to make retrieving the original options possible: plainResponse.request.options.

await got('http://szmarczak.com', {
    hooks: {
        beforeRedirect: [
            (options, response) => {
-                console.log(options === response.request.options); //=> true [invalid! our original options were overriden]
+                console.log(options === response.request.options); //=> false [we can access the original options now]
            }
        ]
    }
})

• The redirect event now takes two arguments in this order: updatedOptions and plainResponse.

- stream.on('redirect', (response, options) => …)
+ stream.on('redirect', (options, response) => …)

Reason: consistency with the beforeRedirect hook.

• The socketPath option has been removed. Use the unix: protocol instead.

- got('/containers/json', {socketPath: '/var/run/docker.sock'})
+ got('unix:/var/run/docker.sock:/containers/json')
+ got('http://unix:/var/run/docker.sock:/containers/json')

• The retryWithMergedOptions function in an afterResponse hook no longer returns a Promise.

It now throws RetryError, so this should this should be the last function being executed.
This was done to allow beforeRetry hooks getting called.

• You can no longer set options.agent to false.
  To do so, you need to define all the options.agent properties: http, https and http2.

await got('https://example.com', {
-    agent: false
+    agent: {
+        http: false,
+        https: false,
+        http2: false
+    }
})

• When passing a url option when paginating, it now needs to be an absolute URL - the prefixUrl option is always reset from now on. The same when retrying in an afterResponse hook.

- return {url: '/location'};
+ return {url: new URL('/location', response.request.options.url)};

There was confusion around the prefixUrl option. It was counterintuitive if used with the Pagination API. For example, it worked fine if the server replied with a relative URL, but if it was an absolute URL then the prefixUrl would end up duplicated. In order to fix this, Got now requires an absolute URL - no prefixUrl will be applied.

• got.extend(…) will throw when passing some options that don't accept undefined - undefined no longer retains the old value, as setting undefined explicitly may reset the option

Documentation

We have redesigned the documentation so it's easier to navigate and find exactly what you are looking for. We hope you like it ❤️

node-fetch/node-fetch (node-fetch)

v3.3.2

Compare Source

Bug Fixes

• Remove the default connection close header. (#​1736) (8b3320d), closes #​1735 #​1473

v3.3.1

Compare Source

Bug Fixes

• release "Allow URL class object as an argument for fetch()" #​1696 (#​1716) (7b86e94)

v3.3.0

Compare Source

Features

• add static Response.json (#​1670) (55a4870)

v3.2.10

Compare Source

Bug Fixes

• ReDoS referrer (#​1611) (2880238)

v3.2.9

Compare Source

Bug Fixes

• Headers: don't forward secure headers on protocol change (#​1599) (e87b093)

v3.2.8

Compare Source

Bug Fixes

• possibly flaky test (#​1523) (11b7033)

v3.2.7

Compare Source

Bug Fixes

• always warn Request.data (#​1550) (4f43c9e)

v3.2.6

Compare Source

Bug Fixes

• undefined reference to response.body when aborted (#​1578) (1c5ed6b)

v3.2.5

Compare Source

Bug Fixes

• use space in accept-encoding values (#​1572) (a92b5d5), closes #​1571

v3.2.4

Compare Source

Bug Fixes

• don't uppercase unknown methods (#​1542) (004b3ac)

v3.2.3

Compare Source

Bug Fixes

• handle bom in text and json (#​1482) (6425e20)

v3.2.2

Compare Source

Bug Fixes

• add missing formdata export to types (#​1518) (a4ea5f9), closes #​1517

v3.2.1

Compare Source

Bug Fixes

• cancel request example import (#​1513) (61b3b5a)

v3.2.0

Compare Source

Features

• export Blob, File and FormData + utilities (#​1463) (81b1378)

v3.1.1

Compare Source

Security patch release

Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred

What's Changed

• core: update fetch-blob by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1371
• docs: Fix typo around sending a file by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1381
• core: (http.request): Cast URL to string before sending it to NodeJS core by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1378
• core: handle errors from the request body stream by @​mdmitry01 in https://github.com/node-fetch/node-fetch/pull/1392
• core: Better handle wrong redirect header in a response by @​tasinet in https://github.com/node-fetch/node-fetch/pull/1387
• core: Don't use buffer to make a blob by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1402
• docs: update readme for TS @​types/node-fetch by @​adamellsworth in https://github.com/node-fetch/node-fetch/pull/1405
• core: Fix logical operator priority to disallow GET/HEAD with non-empty body by @​maxshirshin in https://github.com/node-fetch/node-fetch/pull/1369
• core: Don't use global buffer by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1422
• ci: fix main branch by @​dnalborczyk in https://github.com/node-fetch/node-fetch/pull/1429
• core: use more node: protocol imports by @​dnalborczyk in https://github.com/node-fetch/node-fetch/pull/1428
• core: Warn when using data by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1421
• docs: Create SECURITY.md by @​JamieSlome in https://github.com/node-fetch/node-fetch/pull/1445
• core: don't forward secure headers to 3th party by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1449

New Contributors

• @​mdmitry01 made their first contribution in https://github.com/node-fetch/node-fetch/pull/1392
• @​tasinet made their first contribution in https://github.com/node-fetch/node-fetch/pull/1387
• @​adamellsworth made their first contribution in https://github.com/node-fetch/node-fetch/pull/1405
• @​maxshirshin made their first contribution in https://github.com/node-fetch/node-fetch/pull/1369
• @​JamieSlome made their first contribution in https://github.com/node-fetch/node-fetch/pull/1445

Full Changelog: node-fetch/node-fetch@v3.1.0...v3.1.1

v3.1.0

Compare Source

What's Changed

• fix(Body): Discourage form-data and buffer() by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1212
• fix: Pass url string to http.request by @​serverwentdown in https://github.com/node-fetch/node-fetch/pull/1268
• Fix octocat image link by @​lakuapik in https://github.com/node-fetch/node-fetch/pull/1281
• fix(Body.body): Normalize Body.body into a node:stream by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/924
• docs(Headers): Add default Host request header to README.md file by @​robertoaceves in https://github.com/node-fetch/node-fetch/pull/1316
• Update CHANGELOG.md by @​jimmywarting in https://github.com/node-fetch/node-fetch/pull/1292
• Add highWaterMark to cloned properties by @​davesidious in https://github.com/node-fetch/node-fetch/pull/1162
• Update README.md to fix HTTPResponseError by @​thedanfernandez in https://github.com/node-fetch/node-fetch/pull/1135
• docs: switch url to URL by @​dhritzkiv in https://github.com/node-fetch/node-fetch/pull/1318
• fix(types): declare buffer() deprecated by @​dnalborczyk in https://github.com/node-fetch/node-fetch/pull/1345
• chore: fix lint by @​dnalborczyk in https://github.com/node-fetch/node-fetch/pull/1348
• refactor: use node: prefix for imports by @​dnalborczyk in https://github.com/node-fetch/node-fetch/pull/1346
• Bump data-uri-to-buffer from 3.0.1 to 4.0.0 by @​dependabot in https://github.com/node-fetch/node-fetch/pull/1319
• Bump mocha from 8.4.0 to 9.1.3 by @​dependabot in https://github.com/node-fetch/node-fetch/pull/1339
• Referrer and Referrer Policy by @​tekwiz in https://github.com/node-fetch/node-fetch/pull/1057
• Add typing for Response.redirect(url, status) by @​c-w in [https://github.com/Add typing for Response.redirect(url, status) node-fetch/node-fetch#1169](https://redi

---

Configuration

📅 Schedule: Branch creation - "* 0-3 * * 1" in timezone UTC, Automerge - "after 8:00 before 23:00 every weekday except on Friday" in timezone UTC.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.