v0.33.0
Added 1
- Add Node.js 26 to the v0.x CI and release/publish matrices
Changed 2
- Adopt npm staged publishing for v0.x releases
- Disable npm caching in CI to make installs and publish jobs more deterministic
Security 4
- Use own-property reads for nested request options affecting auth, params, proxy, and data handling
- Add bounded form serialisation depth checks
- Normalise nullish Basic Auth credentials
- Treat 0.0.0.0 as local for proxy bypass
v0.33.0 — June 13, 2026
This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.
🔒 Security Fixes
- Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats
0.0.0.0as local for proxy bypass. (#11001)
🚀 New Features
- Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#10937)
🔧 Maintenance & Chores
- Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#10936, #10943)
- Changelog: Backfills missing v0.x changelog entries for prior releases. (#10842)
- Release Metadata: Bumps package and internal version metadata for v0.33.0. (#11002)