Migrate Got to Ky; run [*****]

[LitoMore]

Closes #11072

Ky uses the Node.js built-in Fetch, and it has a similar development experience to Got. Both Got's and Ky's READMEs mentioned their differences and recommended Ky.

I used AI (gpt-5.6-sol ultra) to initialize this PR. Please let me know your thoughts.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ky@​2.0.2
	nock@​13.5.6 ⏵ 14.0.16	-12			+4
	undici@​6.26.0 ⏵ 8.7.0		+19	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @mswjs/interceptors is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/nock@14.0.16 → npm/@mswjs/interceptors@0.41.9 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mswjs/interceptors@0.41.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm nock is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/nock@14.0.16 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/nock@14.0.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

	Warnings
⚠️	This PR modified service code for bundlejs but not its test code. That's okay so long as it's refactoring existing code.
⚠️	This PR modified service code for dynamic but not its test code. That's okay so long as it's refactoring existing code.
⚠️	This PR modified service code for opm but not its test code. That's okay so long as it's refactoring existing code.
⚠️	This PR modified service code for poeditor but not its test code. That's okay so long as it's refactoring existing code.
⚠️	This PR modified service code for stackexchange but not its test code. That's okay so long as it's refactoring existing code.
⚠️	This PR modified service code for steam but not its test code. That's okay so long as it's refactoring existing code.
⚠️	📚 Remember to ensure any changes to config.private in services/github/auth/acceptor.js are reflected in the server secrets documentation.

	Messages
📖	✨ Thanks for your contribution to Shields, @LitoMore!
📖	Thanks for contributing to our documentation. We ❤️ our documentarians!

Generated by 🚫 dangerJS against d43f701

[github-actions]

🚀 Updated review app: https://pr-11996-badges-shields.fly.dev

[PyvesB]

This looks promising! Could you take a peak at the test failures? Some are expected due to missing credentials on your fork and some already fail in the daily tests, but I'm not sure about the Error: ESOCKETTIMEDOUT or AssertionError: label mismatch: expected 'counter' to equal 'async handle repo:badges/puppets ones for example.

[LitoMore]

Thanks for flagging these — I dug into both examples.

The ESOCKETTIMEDOUT failures were a real test-infrastructure regression. Ky uses native Fetch, which required upgrading to Nock 14. IcedFrisby was enabling Nock even for live tests, and Nock’s passthrough MockHttpSocket imposed its own ~5-second socket timeout, despite those tests specifying 10- or 15-second timeouts.

I’ve changed the runner so live tests bypass Nock, while tests with explicit interceptors reactivate it. I also added regression tests covering both cases.

The GitHub Search label mismatch was a secondary symptom of an upstream request failure rather than a label-rendering regression. That run logged a 429 from api.github.com immediately before the assertion. The resulting error badge used the service’s default label, counter, while the live test expected the query-specific label, async handle repo:badges/puppets counter.

I reran the targeted GitHub Search tests successfully, and neither the /github.json failure, the label mismatch, nor ESOCKETTIMEDOUT appears in the latest Services log.

The Services check is still red from the remaining live-suite noise: Libraries.io/Pypistats rate limiting and a few transient Cookbook/GitLab requests. I reran the latter paths locally and they all passed. All non-Service checks are now green.

The response above is generated by gpt-5.6-col ultra.

[PyvesB]

I'm still a little nervous about this many service test failures. I would not have expected the Gist or GreasyFork ones to fail for example. We could possibly try running all service tests on another forked PR, to compare side by side in a more precise manner.

[LitoMore]

I could try to create a branch from our badges/shields repository instead of from my fork to solve the missing credentials problem.

[LitoMore]

I'm closing this one in favor of #12060.