[MattCCC]

This pull request prepares the 4.3.0 release. It bumps the version in package.json and package-lock.json, rebuilds dist with everything merged since 4.2.0, and brings the README up to date, including the comparison with other libraries, which now covers TanStack Query.

🧩 Pull Requests Merged Into This One

• Let only admins publish releases to npm #122: the npm publishing workflow is now a Release job that only repository admins can run.
• Reduce the bundle size without changing behavior #121: 2–4% smaller bundles without changing behavior (merged into master, and from there into this branch).
• Keep direct assignments for custom fetcher responses to avoid a slowdown #123: undoes the one change of Reduce the bundle size without changing behavior #121 that made requests with interceptors 2.4% slower.

📖 README

• The logo is centered in its own <p align="center">, which GitHub and npm both honor.
• Closest competitors first in the comparison: TanStack Query, axios and swr come right after fetchff, followed by ofetch, wretch and native fetch(). The TanStack Query column is checked against the options and defaults of @tanstack/react-query 5.104.
• Added rows for what 4.3.0 brings: pausing polling in hidden tabs and offline, throttled revalidation on focus, the slow request callback, ETag revalidation, persistent cache, upload and download progress, typed endpoints from OpenAPI schemas, and no third-party dependencies. ETag revalidation and OpenAPI-typed endpoints are fetchff-only.
• Corrected cells that the current versions contradict:
  • axios has no built-in retries.
  • swr retries with exponential backoff, can decide on retries by the error (shouldRetryOnError), and can poll conditionally based on the latest data (refreshInterval as a function).
  • ofetch and wretch accept a custom fetch(), and ofetch errors can be customized with onResponseError.
• Merged duplicate rows: "Custom adapters (fetchers)", "Concurrent Request Deduplication" and "Revalidation on Tab Focus" repeated other rows.
• Measured all bundle sizes the same way (esbuild, minified and gzipped, with the versions listed under the table), and rated them by a stated rule: 🟢 under 10 KB, 🟡 10–13 KB and 🔴 over 13 KB. fetchff 4.3.0 is 🟢 at 8.9 KB, or 9.7 KB with its React hook, while TanStack Query (13.6 KB) and axios (19.5 KB) are 🔴. The "~5 KB" and "~4KB gzipped" claims are now "~9 KB", and the coverage badge shows 100% instead of 96.93%.

📋 What's in 4.3.0

✨ Features & Improvements

• Polling pauses in hidden tabs and while offline, with refreshWhenHidden and refreshWhenOffline (Pause polling in hidden tabs and while offline #108)
• onLoadingSlow interceptor and loadingTimeout for slow requests (Add onLoadingSlow interceptor for slow requests #109)
• Persistent cache through custom cache stores with cacheStore (Add persistent cache through custom cache stores #110)
• Upload progress with onUploadProgress (Add upload progress tracking with onUploadProgress #111)
• ETag revalidation: cached responses are revalidated with If-None-Match and reused on 304 Not Modified (Revalidate cached responses with their ETag #113)
• Retry jitter to spread retries out, and retry methods, which default to the idempotent ones (Add retry jitter, and retry only idempotent methods by default #114)
• Download progress with onDownloadProgress (Add onDownloadProgress to track the download progress of responses #115)
• responseType to read response bodies as JSON, text, Blob, ArrayBuffer, FormData or a stream (Add responseType to read response bodies in a particular way #116)
• focusThrottleInterval to throttle revalidations on focus (Add focusThrottleInterval to throttle revalidations on focus #117)
• initialData to use e.g. server-rendered data as the first response, which useFetcher() shows right away (Add initialData to use e.g. server-rendered data as the first response #118)
• Typed createApiFetcher() endpoints from OpenAPI schemas with OpenApiEndpoint, and {param} path placeholders (Type createApiFetcher() endpoints from OpenAPI schemas #119)
• Smaller bundles (Reduce the bundle size without changing behavior #121, Keep direct assignments for custom fetcher responses to avoid a slowdown #123) and an npm Release job that only admins can run (Let only admins publish releases to npm #122)

🐛 Bug Fixes

• Security hardening against credential leaks, SSRF bypasses and prototype pollution, plus fixes for config merging, caching, timeouts and createApiFetcher() (Security Hardening, Bug Fixes & 100% Test Coverage #106)
• The signal setting aborts requests and stops their retries and polling (Abort requests with the signal passed to them #112)
• Blobs, buffers, form data and streams are no longer replaced by defaultResponse (Add responseType to read response bodies in a particular way #116)

⚠️ Behavior Changes

• Browsers pause polling in hidden tabs and while offline; refreshWhenHidden: true and refreshWhenOffline: true keep it going (Pause polling in hidden tabs and while offline #108)
• Revalidations of cached responses with an ETag send an If-None-Match header, which cross-origin servers must allow in CORS; etag: false turns it off (Revalidate cached responses with their ETag #113)
• POST and PATCH requests are no longer retried on the retryOn statuses; add them to retry.methods or use shouldRetry to retry them (Add retry jitter, and retry only idempotent methods by default #114)
• Focus revalidations within 5 seconds after a request are skipped; focusThrottleInterval: 0 turns it off (Add focusThrottleInterval to throttle revalidations on focus #117)
• Aborted requests are no longer retried (Abort requests with the signal passed to them #112)
• Stricter URL checks, relative URLs joined to baseURL with a /, strategy: 'defaultResponse' returning defaultResponse, merged nested retry/headers defaults and masked credentials in logged errors (Security Hardening, Bug Fixes & 100% Test Coverage #106)

🧪 Tests

• All 895 tests pass on Node.js 18 and 22 with 100% coverage, as well as type checks, lint and the build.

📦 Bundle Size

Bundle (brotli)	4.2.0	4.3.0
browser/index.mjs	5.81 kB	7.98 kB
browser/index.global.js	5.99 kB	8.17 kB
node/index.js	5.90 kB	8.15 kB
react/index.mjs	9.02 kB	11.22 kB
react/index.js	9.84 kB	12.06 kB

All bundles are within the current size limits. The React sizes include the core and React itself, as size-limit counts all dependencies.

🏷️ After Merging

1. Publish a GitHub release with the tag v4.3.0 on master ("Generate release notes" lists the pull requests above).
2. The Release job publishes 4.3.0 to npm. If the npm environment requires a reviewer, approve it under "Review deployments" in the run.

[github-actions]

size-limit report 📦

Path	Size
dist/browser/index.mjs	7.79 KB (+0.13% 🔺)
dist/browser/index.global.js	7.98 KB (+0.1% 🔺)
dist/node/index.js	7.96 KB (+0.14% 🔺)
dist/react/index.mjs	10.96 KB (+0.56% 🔺)
dist/react/index.js	11.78 KB (+0.11% 🔺)