feat!: replace got with node fetch

[Churro]

Removes the got dependency from both packages in favour of the built-in fetch.

• Closes Replace got with node fetch #1771

// @viceice

[codecov-commenter]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 97.15%. Comparing base (e89ba04) to head (dd5d8a2).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
packages/osv-offline/src/lib/download.ts	83.33%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1817      +/-   ##
==========================================
- Coverage   97.70%   97.15%   -0.55%     
==========================================
  Files           5        5              
  Lines         174      176       +2     
  Branches       30       32       +2     
==========================================
+ Hits          170      171       +1     
- Misses          4        5       +1     

Flag	Coverage Δ
node22-Linux	97.15% <83.33%> (-0.55%)	⬇️
node24-Linux	97.15% <83.33%> (-0.55%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[viceice]

do you know I'd global agent is still working when configuring http proxy on renovate?

using feat to get a release. refactor won't create a release

[Churro]

do you know I'd global agent is still working when configuring http proxy on renovate?

globalThis.fetch doesn't go through http.globalAgent, so this change breaks support for Renovate users who rely on HTTP_PROXY/HTTPS_PROXY.

I guess a workaround could be to add the following in lib/proxy.ts to have undici read proxy env vars:

import { EnvHttpProxyAgent, setGlobalDispatcher } from 'undici';
setGlobalDispatcher(new EnvHttpProxyAgent());

[viceice]

thanks, marking this as breaking change, so it doesn't silently get merged to renovate

[viceice]

wonder if we need to abstract the Fetcher type a little more, so renovate could use got as fetcher 🤔

[Churro]

wonder if we need to abstract the Fetcher type a little more, so renovate could use got as fetcher 🤔

Wouldn't abstracting further, e.g., to (url: string) => Promise<{ ok: boolean; body: ReadableStream | null }> reinvent a worse version of the fetch API?

renovate could still use got as a Fetcher if wrapped:
const gotFetcher: Fetcher = (url) => got(url).then(r => new Response(r.body, { status: r.statusCode }))