v0.8.4

crossorigin parameter support.

• Added experimental support for the upcoming crossorigin API parameter (added in Gerrit change I41200852ee for T322944). This may be reverted in a future release if the MediaWiki change is not merged after all.
• Updated dependencies.

v0.8.3

Mainly a fix for m3api-oauth2 after changes in MediaWiki.

• Updated the link to the User-Agent policy after it was moved from metawiki to foundationwiki.
• Optimized the internal encoding of POST requests; this also fixes m3api-oauth2 when targeting wikis running MediaWiki 1.43 or later.
• Updated dependencies.

v0.8.2

• Error responses with non-200 HTTP status codes are now supported, as long as the MediaWiki-API-Error response header is present to indicate that the response represents a regular error and not an internal error. (The status code is ignored; the response body is expected to contain a response with one or more regular errors.)
• Updated dependencies.

v0.8.1

• Updated undici, avoiding CVE-2023-45143. The potential impact of this security vulnerability should have been very low: when using the fetch-node backend and a cookie-based session type, an attacker with the ability to create an open redirect on the target API could potentially have obtained session cookies for the API. (I see no reason to expect an open redirect vulnerability to exist in the action API: I’m not aware of any API action that issues HTTP-level redirects at all.)
• Updated dependencies.

v0.8.0

More modern Node requirement, file upload support.

• BREAKING CHANGE: m3api now requires at least Node.js version 18.2.0, up from Node 12.22.0 or Node 14.17.0 previously. The internal breaking changes below are also related to this.
• Internal Breaking Change: The file add-performance-global.js has been removed, as it is no longer needed.
• Internal Breaking Change: The file axios.js has been removed, as axios is no longer used. Its role has been taken over by fetch-node.js.
• Internal Breaking Change: The file fetch.js is no longer suitable for use in Chrome-like browsers. The functionality of renaming the user-agent request header to api-user-agent has been moved to fetch-browser.js.
• m3api now uses fetch() on all supported platforms. The public interface, browser.js and node.js, can be used as before. The internal interface has been rearranged, with fetch.js now used for both backends, augmented by fetch-browser.js and fetch-node.js.
• m3api now supports Blob and File parameters in POST requests. This can be used to upload files.
• Improved README.md formatting for npmjs.com.
• Updated dependencies.

v0.7.3

Custom error handler support for m3api-oauth2.

• The new errorHandlers option can be used to customize error handling. It is only part of the internal interface, not of the stable, public interface. Using this options, extension packages or end users can register handlers for certain API error codes; the handlers can e.g. perform necessary cleanup actions and/or retry the request. The existing support for retrying after maxlag, readonly or badtoken errors is now also internally implemented in terms of this new option.
• Updated dependencies.

v0.7.2

• Internal Breaking Change: The signature of the internalGet() and internalPost() methods has changed; an apiUrl string has been addded as the first parameter, and the last parameter is now a headers object instead of a userAgent string. The apiUrl should always be used instead of this.apiUrl. In headers, the header names are always in all-lowercase, so you can safely get the userAgent value as headers['user-agent'].
• m3api now has a stable interface policy, see README.md § stability. Internal breaking changes, such as the one above, do not require bumping the major version number.
• The new authorization request option can be used to set an Authorization: request header. This will be used by the upcoming m3api-oauth2 package to support OAuth 2.0; you can also use it directly using the access token of an owner-only client.
• The apiUrl member of a Session is now public. This will be used by m3api-oauth2.
• A new protected method, getUserAgent(), can be used to get the user agent for a request. This will be used by m3api-oauth2.
• The dropTruncatedResultWarning didn’t work properly when using the default errorformat on current MediaWiki versions; this has been fixed. (It’s still a good idea to set a non-bc error format in general.)
• Exclude axios 1.2.0, which should not be used due to a bug.
• Updated other dependencies.

v0.7.1

Documentation-only release.

• Publish documentation on GitHub pages: latest version, v0.7.1.
• Add a @typedef for Options, the request options; this may help if you are using m3api with TypeScript or in an IDE.
• Updated dependencies.

v0.7.0

• BREAKING CHANGE: A new request option, maxRetriesSeconds, limits the total duration of retried requests, replacing the previous
  maxRetries option that limited the number of retried requests. It defaults to 65 seconds, which should be enough to cover a typical
  brief read-only period on Wikimedia wikis. Interactive applications may wish to use a lower value, to show an error to users earlier rather than waiting for a long time. The previous maxRetries option should no longer be used.
• m3api can now automatically add token parameters to requests, controlled by the two new request options tokenType and tokenName. The most common case, e.g. for action=edit, is to use tokenType: 'csrf' with the default tokenName ('token'). m3api will automatically fetch and cache the token (and this internal request can be automatically combined with other action=query requests), discarding stale tokens and retrying upon encountering a badtoken error. Tokens are cached in the public Session.tokens Map, which users and extension packages are encouraged to clear() after changing the session state (e.g. login), to avoid the overhead of a badtoken error. (Note that the m3api-botpassword extension package does this for you.)
• The public interface of m3api has been clarified. Most importantly, Session.defaultParams, Session.defaultOptions and DEFAULT_OPTIONS have been declared public, and extension packages are encouraged to use the latter two for their own options as well. Guidelines for extension packages have also been added to the README.
• Requests that produced maxlag or readonly errors are now automatically retried, even if the response did not include a Retry-After response header. (Currently, MediaWiki only sends this header for maxlag errors.) Two new request options, retryAfterMaxlagSeconds and retryAfterReadonlySeconds, control the default retry delay (in seconds) for these errors. The defaults of 5 and 30 seconds respectively are intended to be useful for Wikimedia wikis. If you increase these values, don’t forget to increase maxRetriesSeconds as well.
• The Node.js backend (specifically axios.js) now keeps the network connection alive (using Node’s default Keep-Alive settings), which can speed up consecutive API requests (e.g. to get and then use a token). Requests with technically different options can be combined in some more situations. Specifically, a request explicitly specifying a default option is compatible with one not specifying the option at all (both will use the default), and the dropTruncatedResultWarning option does not affect compatibility at all (the option is handled while combining requests, so that truncated result warnings are only sent to the correct requests).
• Updated dependencies.

v0.6.1

Add dropTruncatedResultWarning option for m3api-query.

• A new request option, dropTruncatedResultWarning, is available. Previously, this behavior was hard-coded in requestAndContinueReducingBatch(); now, it can be optionally enabled in request() and requestAndContinue(), or disabled in requestAndContinueReducingBatch(). By default, the option is enabled in the latter function and disbled in the former two, so there is no change in behavior unless you set the option with a request.
• Updated dependencies.