Release v3.0.0: wreq rc.29 and transport APIs

[StopMakingThatBigFace]

Summary

This major release updates the native transport to the latest published upstream prerelease (wreq 6.0.0-rc.29 / wreq-util 3.0.0-rc.14), refreshes all browser profiles, bridges the new upstream capabilities that have useful Node.js semantics, and modernizes linting, formatting, hooks, and CI.

The release is intentionally v3.0.0, not a minor: upstream removed the custom unknown HTTP/2 settings API and the default fingerprint changes from Chrome 137 to Chrome 149.

Release notes

Browser emulation

• Added the newest profiles through chrome_149, edge_148, firefox_151, opera_131, and safari_26_4.
• Added fixed profile/platform selection: browser: { profile, platform }.
• Added upstream random and market-share-weighted selection: browser: { mode: 'random' | 'weighted-random' }.
• Added browser.http2 and browser.headers component switches from the upstream emulation builder.
• Custom tlsOptions, http1Options, and http2Options now overlay the selected browser profile instead of replacing all unspecified profile defaults.
• Added explicit ordered TLS keyShares; keySharesLimit now truncates the selected profile's own key-share list.

Native clients, pooling, and TLS sessions

• createClient() now owns and reuses native wreq::Client instances, HTTP keep-alive pools, and TLS sessions instead of rebuilding the native client for every request.
• Added poolIdleTimeout, poolMaxIdlePerHost, poolMaxSize, and tlsSessionCacheCapacity for HTTP and WebSocket clients.
• Builder-affecting overrides (browser, proxy, DNS, TLS, bind, and protocol settings) use isolated cached client variants, preventing incompatible pool reuse.
• Added connectionGroup to partition a client's pool explicitly.
• Added static forbidConnectionReuse and dynamic response.wreq.forbidConnectionReuse() connection recycling control.
• Added idempotent client.close() plus GC cleanup for native pooled resources.

Multipart and WebSocket

• FormData now uses WebKit-style multipart boundaries matching the rc.29 generator, with optional explicit multipartBoundary values.
• File parts are encoded through native wreq::multipart::Form and streamed from Blob.stream() through a bounded N-API channel with backpressure; the complete multipart body is no longer buffered before network dispatch.
• Multipart uploads retain exact Content-Length, browser-style field escaping and CRLF normalization.
• Multipart streams are recreated for retries, request clones, and 307/308 redirects; aborts cancel active JS readers and native stream handles.
• Added WebSocket httpVersion: '1.1' | '2'; legacy forceHttp2 remains supported but is deprecated.

Upstream transport changes

• Updated wreq from 6.0.0-rc.28 to 6.0.0-rc.29 and wreq-util from 3.0.0-rc.11 to 3.0.0-rc.14.
• Adapted frame-based response streaming, TLS identity/trust/keylog APIs, the new btls key-share types, and renamed WebSocket version selection.
• The dependency bump also carries upstream HTTP/1, HTTP/2, TCP, decoder, cookie, and performance fixes.

Breaking changes

• Non-empty http2Options.experimentalSettings is unsupported because upstream removed custom unknown HTTP/2 settings. It remains deprecated and fails with an explicit error; upstream provides no replacement.
• The default HTTP and WebSocket profile changes from chrome_137 to chrome_149. Set browser explicitly when a stable fingerprint is required.
• tlsOptions.keySharesLimit must be greater than zero.

CI and developer tooling

• Updated GitHub Actions to current major versions.
• Expanded OXLint correctness, security, TypeScript, import, and Unicorn rules without copying project-specific custom plugins.
• Aligned OXFormat with the shared configuration where applicable to this repository.
• Added lint-staged to the existing pre-commit hook: OXLint fix + OXFormat for JS/TS and rustfmt for Rust.

Deliberately not exposed

The remaining rc.29 additions are Rust-specific integration surfaces rather than Node APIs:

• Tower request Extensions / custom middleware layers;
• raw upgraded stream access via WebSocket::into_inner;
• the optional Compio Rust runtime;
• arbitrary user-defined Rust TLS session-cache implementations (the built-in LRU capacity is exposed instead).

Upgrade guide

1. Remove non-empty http2Options.experimentalSettings.
2. Set browser explicitly if the previous Chrome 137 fingerprint matters.
3. Replace keySharesLimit: 0 with a positive value or omit it.
4. Prefer WebSocket httpVersion: '2' over forceHttp2: true.
5. Call client.close() when a long-lived application is done with a client; GC cleanup remains a fallback.

Validation

• npm test — 89 tests passed
• Rust unit tests — 3 passed
• multipart streaming coverage: no Blob.arrayBuffer(), retry, 307 redirect, abort, and source failure propagation
• npm run lint
• npm run lint:rust
• npm run format:check
• npm run format:rust:check
• real pre-commit lint-staged flow
• npm pack --dry-run
• npm audit --omit=dev — 0 vulnerabilities