Update dev dependencies.

[davidlehn]

No description provided.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 96.72131% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.27%. Comparing base (4a92bb3) to head (8590f56).

Files with missing lines	Patch %	Lines
lib/httpClient.js	93.10%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #51      +/-   ##
==========================================
- Coverage   94.05%   88.27%   -5.79%     
==========================================
  Files           4        3       -1     
  Lines         303      290      -13     
==========================================
- Hits          285      256      -29     
- Misses         18       34      +16     

Files with missing lines	Coverage Δ
lib/agentCompatibility.js	81.74% <100.00%> (-11.54%)	⬇️
lib/index.js	100.00% <100.00%> (ø)
lib/httpClient.js	92.76% <93.10%> (-0.75%)	⬇️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4a92bb3...8590f56. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[applesnort]

Four comments, one blocking.

The blocker: query/options/trace were added to PROXY_METHODS, but ky@2 doesn't implement them, so all three throw. {method: 'options'} worked in v4, so this is a regression rather than only a new API that doesn't work, and trace can't work in any ky version because Fetch forbids the method.

Everything here was checked by running this branch (ky@2.0.2 / undici@7.29.0) and origin/main (ky@1.14.3 / undici@6.28.0) side by side on Node 26 against a local server; the before/after output is in the inline comments.

Two smaller things: an error.data contract change that's missing from the CHANGELOG's BREAKING list, and a fail-open in the undici compatibility guard when both version reads fail.

The rest of the approach holds up — the undici@7 compatibility table is a good call, and the Headers-based default headers don't break ky's "undefined removes a header" contract on either the instance or the per-request path (I tested both, since that was my first suspicion).

[applesnort]

query, options, and trace aren't on ky@2, so adding them here makes all three throw — and for two of them this is a regression on a path that worked in v4, not just a new API that doesn't.

ky@2.0.2 exposes only get, post, put, patch, head, delete. Reflect.ownKeys(ky) gives length, name, get, post, put, patch, head, delete, create, extend, stop, retry. So ky[method] is undefined for the three new entries and the generated wrapper dies on .apply:

httpClient.query()   -> TypeError: Cannot read properties of undefined (reading 'apply')
httpClient.options() -> TypeError: Cannot read properties of undefined (reading 'apply')
httpClient.trace()   -> TypeError: Cannot read properties of undefined (reading 'apply')

The regression is in the direct-call dispatch at lines 57-59. Because these names are now in PROXY_METHODS, httpClient(url, {method}) is diverted into the broken proxy branch instead of falling through to ky's generic path, where options previously worked:

v4  httpClient(url, {method: 'options'}) -> OK
v5  httpClient(url, {method: 'options'}) -> TypeError

v4  httpClient(url, {method: 'query'})   -> HTTPError 400 (request reached the server)
v5  httpClient(url, {method: 'query'})   -> TypeError

trace is a separate problem: it can't be supported by any ky version, because Fetch forbids the method. v4 already reports this, and the error comes from the platform, not from ky:

v4  httpClient(url, {method: 'trace'}) -> TypeError: 'trace' HTTP method is unsupported.

Nothing in the new tests/10-client-api.spec.js calls any of the three, which is why CI is green. The CHANGELOG lists them as a BREAKING addition ("Add query, options, and trace to align with ky@2"), so as it stands v5 ships three documented methods that throw on first call, and withdrawing them later costs another major.

Suggested fix: drop trace outright, and for query/options either remove them from PROXY_METHODS and the CHANGELOG entry, or keep them and route through ky(url, {...options, method}) rather than ky[method]. Either way options needs to keep working via {method: 'options'}, and a test per proxied method would stop the set drifting from ky's registry on the next bump — deriving it from the instance (typeof ky[m] === 'function') would make drift impossible.

Removing push is right regardless — it was never an HTTP method.

[applesnort]

error.data semantics changed and it isn't in the BREAKING list. Under v4 the error body was read only when the response content type included json; ky@2 buffers the error body regardless of content type, so .data is now populated for non-JSON error responses, as a string:

v4  text/plain 500 -> error.data = undefined
v5  text/plain 500 -> error.data = "boom-plaintext"

That matters because if(err.data) was a serviceable "the server sent a JSON error" test, and after v5 an HTML 502 from a reverse proxy makes it truthy — so consumer branches that assumed an object will now take the JSON path and read err.data.message off a string. Worth an explicit BREAKING entry describing the new .data contract (populated for any content type; object for JSON, string otherwise).

For the record, one thing that looks like a regression here isn't: await error.response.json() in a consumer's catch throws TypeError: Body is unusable on both v4 and v5, because v4's _handleError already consumed the body itself. No need to chase that one.

[applesnort]

The guard fails open when both version reads fail, which is the one case the comment above it promises is safe. parseInt returns NaN rather than throwing, so neither read reaches the catch, and [NaN].includes(NaN) is true under SameValueZero. Evaluating the block exactly as written:

both readable (normal)        compatible=[6,7,8]  -> platformFetchCompatible = true
versions.undici absent        compatible=[6,7,8]  -> platformFetchCompatible = false
undici pkg version absent     compatible=[NaN]    -> platformFetchCompatible = false
BOTH absent                   compatible=[NaN]    -> platformFetchCompatible = true   <-- fails open

Three of the four cases are right. In the fourth, COMPATIBLE_PLATFORM_MAJORS[NaN] is undefined, so ?? [installedMajor] yields [NaN], and the includes compares NaN to NaN and matches — so the dispatcher gets handed to a platform fetch that may reject it with "invalid onError method", instead of taking the always-safe installed-fetch path the comment describes ("Either way fall back to false").

Both reads failing at once is unlikely, so this is low severity — but the fix is small: require Number.isInteger(installedMajor) && Number.isInteger(platformMajor) before comparing, or return false early when either parse is NaN.

[applesnort]

Minor, and only about wording: this entry names kyOriginalPromise, but the symbol consumers actually imported was kyPromise (lib/index.js had export {kyOriginalPromise as kyPromise}). Anyone grepping the changelog for the name in their own import list won't find it — worth naming both.

FWIW I checked 15 DB repos that depend on this package: none reference either name, and none require() the package, so the CJS removal and this rename both look free in practice.

Separately, the new README Install section doesn't state the Node floor (>=22) or that CJS support is gone. Both are in the CHANGELOG, but the README is what people read first.