@whatwg-node/node-fetch

Minor Changes

• #3561 52a5bf6 Thanks @ardatan! - Drop support for Node.js 18 and 20. The minimum supported Node.js version is now 22.15.

Why

Node.js 18 and 20 are end-of-life and no longer receive security updates. Keeping them in our support matrix forced version-specific workarounds and slowed adoption of newer Node TLS APIs.

The floor is set to 22.15 (not just 22.0) so we can rely on tls.getCACertificates() (Node.js 22.15 / 23.10) and always-on zlib zstd helpers (createZstdCompress / createZstdDecompress, Node.js 22.15 / 23.8). That matches the oldest currently supported LTS line (22 Maintenance) while dropping only EOL majors.

SemVer

• 0.x packages: minor bump (breaking changes are allowed in minors while major is 0).

• 1.x packages (@whatwg-node/promise-helpers, @whatwg-node/server-plugin-cookies): major bump, since dropping supported Node versions is a breaking engines change for SemVer >=1.0.0 consumers.

What changed

• engines.node: all published packages now declare >=22.15.0 (including @whatwg-node/promise-helpers, which was still on >=16).

• @whatwg-node/events: removed. Native CustomEvent / Event / EventTarget are available on Node.js 22+, so the ponyfill is no longer maintained; use the platform globals.

• @whatwg-node/fetch: dropped the require("crypto").webcrypto fallback; crypto is always globalThis.crypto on supported runtimes.

• @whatwg-node/server: removed the Node 18 setHeaders workaround (isNode1x); ServerResponse#setHeaders is used whenever it exists.

• @whatwg-node/node-fetch: Runtime guards for zlib.createZstdCompress / createZstdDecompress are removed; zstd is always included in Accept-Encoding.

• CI / e2e: unit matrix is [22, 24, 26]; AWS Lambda runtime and Azure Function target moved from Node 20 to Node 22.

If you are still on Node 18 or 20, upgrade to Node.js 22.15+ (or 24 / 26) before installing this release.

• #3604 b726b83 Thanks @ardatan! - Drop the optional node-libcurl dependency.

  The ponyfill HTTP transport now always uses node:http / node:https. The fetchCurl code path and the globalThis.libcurl runtime check have been removed.

  HTTP/2 support that previously came from node-libcurl is no longer available in this release; a follow-up adds optional undici-based transport (including HTTP/2).

  If you were relying on node-libcurl being picked up automatically, the ponyfill will now use the built-in Node.js HTTP stack instead.

Patch Changes

• #3504 b4c83ab Thanks @ardatan! - Fix HTTPS verification for IPv6 address literals in the node-http ponyfill.

  Work around a Node.js regression (tls.checkServerIdentity + domainToASCII) that rejects valid IP Address SANs for hosts like ::1 on Node.js 22.23+ / 24.17+ (#64032).

  The override is installed lazily on the first HTTPS request, and only when a one-time probe shows the running Node build is affected; healthy Node versions keep the built-in verifier.

• #3612 f16ad4a Thanks @ardatan! - Avoid stream/promises.pipeline in ReadableStream.pipeTo / pipeThrough. The promise pipeline allocates and aborts an AbortController on teardown (expensive DOMException stack capture), which dominated cost for short TransformStream pipes such as request body size limiting. Use Node .pipe() with explicit error/finish handling instead, while still rejecting when the destination write fails.

• #3569 3f44041 Thanks @ardatan! - Make ReadableStream.cancel(reason) resolve successfully instead of rejecting when waiting for close after destroy.

• #3012 3e55abc Thanks @gmaclennan! - Destroy the Node response when the response body stream errors or is aborted, and propagate Readable.destroy(err) in the node-fetch stream ponyfill so piped sockets close with RST / ECONNRESET instead of hanging.

  Also make ponyfill ReadableStream.pipeTo() reject when the destination write fails (after aborting the writer), instead of resolving successfully.