v0.8.2

• Error responses with non-200 HTTP status codes are now supported, as long as the MediaWiki-API-Error response header is present to indicate that the response represents a regular error and not an internal error. (The status code is ignored; the response body is expected to contain a response with one or more regular errors.)
• Updated dependencies.

v0.8.1

• Updated undici, avoiding CVE-2023-45143. The potential impact of this security vulnerability should have been very low: when using the fetch-node backend and a cookie-based session type, an attacker with the ability to create an open redirect on the target API could potentially have obtained session cookies for the API. (I see no reason to expect an open redirect vulnerability to exist in the action API: I’m not aware of any API action that issues HTTP-level redirects at all.)
• Updated dependencies.

v0.8.0

More modern Node requirement, file upload support.

• BREAKING CHANGE: m3api now requires at least Node.js version 18.2.0, up from Node 12.22.0 or Node 14.17.0 previously. The internal breaking changes below are also related to this.
• Internal Breaking Change: The file add-performance-global.js has been removed, as it is no longer needed.
• Internal Breaking Change: The file axios.js has been removed, as axios is no longer used. Its role has been taken over by fetch-node.js.
• Internal Breaking Change: The file fetch.js is no longer suitable for use in Chrome-like browsers. The functionality of renaming the user-agent request header to api-user-agent has been moved to fetch-browser.js.
• m3api now uses fetch() on all supported platforms. The public interface, browser.js and node.js, can be used as before. The internal interface has been rearranged, with fetch.js now used for both backends, augmented by fetch-browser.js and fetch-node.js.
• m3api now supports Blob and File parameters in POST requests. This can be used to upload files.
• Improved README.md formatting for npmjs.com.
• Updated dependencies.

v0.7.3

Custom error handler support for m3api-oauth2.

• The new errorHandlers option can be used to customize error handling. It is only part of the internal interface, not of the stable, public interface. Using this options, extension packages or end users can register handlers for certain API error codes; the handlers can e.g. perform necessary cleanup actions and/or retry the request. The existing support for retrying after maxlag, readonly or badtoken errors is now also internally implemented in terms of this new option.
• Updated dependencies.

v0.7.2

• Internal Breaking Change: The signature of the internalGet() and internalPost() methods has changed; an apiUrl string has been addded as the first parameter, and the last parameter is now a headers object instead of a userAgent string. The apiUrl should always be used instead of this.apiUrl. In headers, the header names are always in all-lowercase, so you can safely get the userAgent value as headers['user-agent'].
• m3api now has a stable interface policy, see README.md § stability. Internal breaking changes, such as the one above, do not require bumping the major version number.
• The new authorization request option can be used to set an Authorization: request header. This will be used by the upcoming m3api-oauth2 package to support OAuth 2.0; you can also use it directly using the access token of an owner-only client.
• The apiUrl member of a Session is now public. This will be used by m3api-oauth2.
• A new protected method, getUserAgent(), can be used to get the user agent for a request. This will be used by m3api-oauth2.
• The dropTruncatedResultWarning didn’t work properly when using the default errorformat on current MediaWiki versions; this has been fixed. (It’s still a good idea to set a non-bc error format in general.)
• Exclude axios 1.2.0, which should not be used due to a bug.
• Updated other dependencies.

v0.7.1

Documentation-only release.

• Publish documentation on GitHub pages: latest version, v0.7.1.
• Add a @typedef for Options, the request options; this may help if you are using m3api with TypeScript or in an IDE.
• Updated dependencies.

v0.7.0

• BREAKING CHANGE: A new request option, maxRetriesSeconds, limits the total duration of retried requests, replacing the previous
  maxRetries option that limited the number of retried requests. It defaults to 65 seconds, which should be enough to cover a typical
  brief read-only period on Wikimedia wikis. Interactive applications may wish to use a lower value, to show an error to users earlier rather than waiting for a long time. The previous maxRetries option should no longer be used.
• m3api can now automatically add token parameters to requests, controlled by the two new request options tokenType and tokenName. The most common case, e.g. for action=edit, is to use tokenType: 'csrf' with the default tokenName ('token'). m3api will automatically fetch and cache the token (and this internal request can be automatically combined with other action=query requests), discarding stale tokens and retrying upon encountering a badtoken error. Tokens are cached in the public Session.tokens Map, which users and extension packages are encouraged to clear() after changing the session state (e.g. login), to avoid the overhead of a badtoken error. (Note that the m3api-botpassword extension package does this for you.)
• The public interface of m3api has been clarified. Most importantly, Session.defaultParams, Session.defaultOptions and DEFAULT_OPTIONS have been declared public, and extension packages are encouraged to use the latter two for their own options as well. Guidelines for extension packages have also been added to the README.
• Requests that produced maxlag or readonly errors are now automatically retried, even if the response did not include a Retry-After response header. (Currently, MediaWiki only sends this header for maxlag errors.) Two new request options, retryAfterMaxlagSeconds and retryAfterReadonlySeconds, control the default retry delay (in seconds) for these errors. The defaults of 5 and 30 seconds respectively are intended to be useful for Wikimedia wikis. If you increase these values, don’t forget to increase maxRetriesSeconds as well.
• The Node.js backend (specifically axios.js) now keeps the network connection alive (using Node’s default Keep-Alive settings), which can speed up consecutive API requests (e.g. to get and then use a token). Requests with technically different options can be combined in some more situations. Specifically, a request explicitly specifying a default option is compatible with one not specifying the option at all (both will use the default), and the dropTruncatedResultWarning option does not affect compatibility at all (the option is handled while combining requests, so that truncated result warnings are only sent to the correct requests).
• Updated dependencies.

v0.6.1

Add dropTruncatedResultWarning option for m3api-query.

• A new request option, dropTruncatedResultWarning, is available. Previously, this behavior was hard-coded in requestAndContinueReducingBatch(); now, it can be optionally enabled in request() and requestAndContinue(), or disabled in requestAndContinueReducingBatch(). By default, the option is enabled in the latter function and disbled in the former two, so there is no change in behavior unless you set the option with a request.
• Updated dependencies.

v0.6.0

• BREAKING CHANGE: Warnings are now always logged to the console by default. Previously, the Node.js backend only did this if NODE_ENV = “development” was set. If you use m3api for an interactive CLI application on Node.js, you may want to configure a custom warn handler (using the second constructor argument, next to the userAgent option), so that warnings are not shown to end users. You should make sure that the warnings still reach the developers, though.
• BREAKING CHANGE: It is no longer possible to modify continuation by modifying the contents of a response’s continue member; continuation now always proceeds according to the original continue contents. The fact that this previously worked was not intended, and if any code actually behaves differently due to this change, it is assumed that the previous behavior was a bug rather than intended. If you really want to modify continuation, implement it yourself instead of using requestAndContinue.
• A new function, requestAndContinueReducingBatch, is available to work with continuation. It is useful in cases where data for a batch
  of pages is spread across multiple responses, i.e. in cases where not every response is marked batchcomplete. (An example is
  generator=search with prop=revisions: the generator can yield up to 500 results per response, but revisions are limited to 50, so ten
  requests are required to get the revisions of the whole batch, after which the next batch of 500 search results can commence.) It is
  expected to be mainly used in libraries, such as the upcoming m3api-query.
• The Node.js backend (specifically axios.js) now requests gzip compression of the response from the server, which should reduce
  network traffic somewhat.
• Fixed a bug in handling warnings for combined requests.
• The “modern” requirements of m3api, i.e. compatibility with different platforms, are documented in the README now.
• Updated dependencies.

v0.5.0

Abbreviate api.php URL as domain, warn on requests without user agent.

• BREAKING CHANGE (internal): The Session constructor now requires the default request options to include warn, which must be a function. The fetch.js and axios.js backends already add a default for this option, so this is only relevant for you if you wrote a custom network implementation; if you just import browser.js or node.js, it doesn’t matter.

• The first constructor argument can now be a domain name instead of a full api.php URL, e.g. en.wikipedia.org instead of
  https://en.wikipedia.org/w/api.php.

• Requests that do not specify a user agent will now trigger a warning, limited to once per session. If you see this warning, you should add a
  user agent to your requests – see the User-Agent policy. Usually you would add it to the default options at construction time:

  const session = new Session( 'en.wikipedia.org', {
      formatversion: 2,
      // other default params...
  }, {
      userAgent: 'my-cool-tool',
      // other default options...
  } );

  But it can also be specified for an individual request:

  const response = await session.request( {
      action: 'query',
      // other params...
  }, {
      userAgent: 'my-cool-tool',
      // other options...
  } );

  Recall that the default warning handler is console.warn in the browser, and also in Node.js if NODE_ENV = “development” is set, but otherwise the Node.js backend ignores warnings.