@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/core/activity.js

@@ -285,6 +285,18 @@ const MANIFEST_ACTIVITY_HINTS = new Map([
   ],
 ]);
 const SENSITIVE_CONFIG_ACTIVITY_HINTS = [
+  {
+    matcher: (_lowerPath, baseName) =>
+      baseName === ".terraformrc" ||
+      baseName === "terraform.rc" ||
+      baseName === "credentials.tfrc.json",
+    metadata: {
+      classification: "credential",
+      ecosystem: "terraform",
+      label: "Terraform CLI configuration",
+      sensitive: true,
+    },
+  },
   {
     matcher: (lowerPath, _baseName) =>
       lowerPath.includes("/.cargo/config.toml") ||

package/lib/core/env.js

@@ -1,4 +1,4 @@
-import { join } from "node:path";
+import { join, win32 } from "node:path";
 
 import {
   buildReadCountSuffix,
@@ -111,19 +111,27 @@ export function shouldFetchLicense() {
   );
 }
 
+/**
+ * Determines whether registry provenance, such as publish times, publishers
+ * and trusted-publishing signals, is wanted. `--bom-audit` turns it on through
+ * CDXGEN_FETCH_PKG_METADATA. Local data cannot answer these questions, so a
+ * package whose licence and description are known locally is still looked up.
+ *
+ * @returns {boolean} True if CDXGEN_FETCH_PKG_METADATA is "true" or "1"
+ */
+export function shouldFetchRegistryProvenance() {
+  return ["true", "1"].includes(
+    readEnvironmentVariable("CDXGEN_FETCH_PKG_METADATA"),
+  );
+}
+
 /**
  * Determines whether remote package metadata should be fetched for enrichment.
  *
  * @returns {boolean} True when registry metadata enrichment is enabled.
  */
 export function shouldFetchPackageMetadata() {
-  return (
-    shouldFetchLicense() ||
-    (readEnvironmentVariable("CDXGEN_FETCH_PKG_METADATA") &&
-      ["true", "1"].includes(
-        readEnvironmentVariable("CDXGEN_FETCH_PKG_METADATA"),
-      ))
-  );
+  return shouldFetchLicense() || shouldFetchRegistryProvenance();
 }
 
 /**
@@ -293,6 +301,13 @@ export const SWIFT_CMD = readEnvironmentVariable("SWIFT_CMD") || "swift";
 /** Resolved Ruby executable command (RUBY_CMD env var, or "ruby"). */
 export const RUBY_CMD = readEnvironmentVariable("RUBY_CMD") || "ruby";
 
+/** Resolved PHP executable command (PHP_CMD env var, or "php"). */
+export const PHP_CMD = readEnvironmentVariable("PHP_CMD") || "php";
+
+/** Resolved Composer executable command (COMPOSER_CMD env var, or "composer"). */
+export const COMPOSER_CMD =
+  readEnvironmentVariable("COMPOSER_CMD") || "composer";
+
 /** Python package components that can be excluded from the generated BOM. */
 export const PYTHON_EXCLUDED_COMPONENTS = [
   "pip",
@@ -457,7 +472,7 @@ export const PROJECT_TYPE_ALIASES = {
   perl: ["perl", "cpan", "carton", "cpanfile"],
   spack: ["spack"],
   terraform: ["terraform", "opentofu", "tf"],
-  c: ["c", "cpp", "c++", "conan", "collider"],
+  c: ["c", "cpp", "c++", "conan", "collider", "cmake", "meson", "vcpkg"],
   clojure: ["clojure", "edn", "clj", "leiningen"],
   github: ["github", "actions"],
   hbom: ["hbom", "hardware"],
@@ -493,7 +508,7 @@ export const PROJECT_TYPE_ALIASES = {
   binary: ["binary", "blint"],
   oci: ["docker", "image", "oci", "container", "podman", "rootfs", "oci-dir"],
   cocoa: ["cocoa", "cocoapods", "objective-c", "swift", "ios"],
-  scala: ["scala", "scala3", "sbt", "mill"],
+  scala: ["scala", "scala3", "sbt", "mill", "scala-cli"],
   nix: ["nix", "nixos", "flake"],
   zig: ["zig", "zon"],
   gleam: ["gleam"],
@@ -699,23 +714,38 @@ export function hasAnyProjectType(projectTypes, options, defaultStatus = true) {
   return shouldInclude;
 }
 
+/**
+ * Extract the lowercase command name from an invoked command path, without
+ * directories or a trailing `.js`, `.cjs`, `.mjs` or `.exe` extension. Both
+ * `/` and `\\` separators are handled, so a Windows path is inspected the
+ * same way on any host.
+ *
+ * @param {string} [commandPath] Invoked command path or name
+ * @returns {string} Lowercase command name
+ */
+export function getCommandName(commandPath) {
+  return win32
+    .basename(`${commandPath || ""}`)
+    .toLowerCase()
+    .replace(/\.(?:[cm]?js|exe)$/u, "");
+}
+
 /**
  * Determine whether the predictive dependency audit should run for the current
  * CLI invocation.
  *
- * OBOM-focused runs (`obom` or explicit `-t os` / OS aliases only) should keep
- * the direct BOM audit findings but skip the predictive dependency audit.
+ * OBOM and HBOM runs (commands named `obom` or `hbom`, including `hbom-slim`)
+ * and explicit `-t os` / OS / hardware project types alone keep the direct BOM
+ * audit findings but skip the predictive dependency audit. Only the command
+ * name is tested, never the directories leading to it.
  *
  * @param {object} options CLI options
  * @param {string} [commandPath] Invoked command path or name
  * @returns {boolean} True when predictive dependency audit should run
  */
 export function shouldRunPredictiveBomAudit(options, commandPath) {
-  const normalizedCommandPath = `${commandPath || ""}`.toLowerCase();
-  if (normalizedCommandPath.includes("obom")) {
-    return false;
-  }
-  if (normalizedCommandPath.includes("hbom")) {
+  const commandName = getCommandName(commandPath);
+  if (commandName.startsWith("obom") || commandName.startsWith("hbom")) {
     return false;
   }
   const projectTypes = Array.isArray(options?.projectType)

package/lib/core/fs.js

@@ -522,8 +522,13 @@ function isWindowsShellHijackRisk(command, options) {
   const absCwd = resolve(cwd);
   for (const candidate of candidates) {
     const candidatePath = path.join(absCwd, candidate);
-    if (existsSync(candidatePath)) {
-      return true;
+    // cmd.exe only runs files, so a directory named like the tool is harmless.
+    try {
+      if (statSync(candidatePath).isFile()) {
+        return true;
+      }
+    } catch (_err) {
+      // Not present.
     }
   }
   return false;
@@ -577,7 +582,7 @@ export function shellQuoteArgument(arg, forWindows = isWin) {
         backslashes++;
         quoted += ch;
       } else if (ch === '"') {
-        quoted += "\\".repeat(backslashes) + '\\"';
+        quoted += `${"\\".repeat(backslashes)}\\"`;
         backslashes = 0;
       } else {
         quoted += ch;
@@ -831,24 +836,28 @@ export function safeSpawnSync(command, args, options) {
       error: new Error("No execute permission"),
     };
   }
+  // cmd.exe looks in the working directory before PATH, so a scanned project
+  // could otherwise replace the tool cdxgen means to run. This holds outside
+  // secure mode too, since --no-install-deps scans still run version probes
+  // and read-only tools with the project as the working directory.
+  if (isWindowsShellHijackRisk(command, options)) {
+    const blockedReason = `${command} matches local file in cwd (Windows shell hijack risk)`;
+    console.warn(`\x1b[1;31mSecurity Alert: ${blockedReason}\x1b[0m`);
+    recordActivity({
+      kind: activityDescriptor.kind,
+      ...activityDescriptor.metadata,
+      reason: blockedReason,
+      status: "blocked",
+      target: activityDescriptor.target,
+    });
+    return {
+      status: 1,
+      stdout: undefined,
+      stderr: undefined,
+      error: new Error(blockedReason),
+    };
+  }
   if (isSecureMode) {
-    if (isWindowsShellHijackRisk(command, options)) {
-      const blockedReason = `${command} matches local file in cwd (Windows shell hijack risk)`;
-      console.warn(`\x1b[1;31mSecurity Alert: ${blockedReason}\x1b[0m`);
-      recordActivity({
-        kind: activityDescriptor.kind,
-        ...activityDescriptor.metadata,
-        reason: blockedReason,
-        status: "blocked",
-        target: activityDescriptor.target,
-      });
-      return {
-        status: 1,
-        stdout: undefined,
-        stderr: undefined,
-        error: new Error(blockedReason),
-      };
-    }
     if (options?.cwd && options.cwd !== resolve(options.cwd)) {
       if (DEBUG_MODE) {
         console.log(
@@ -1025,7 +1034,8 @@ export const MAX_BUFFER =
 export function getAllFiles(dirPath, pattern, options = {}) {
   let ignoreList = [];
   if (!options.noIgnore) {
-    ignoreList.push("**/.hg/**", "**/.git/**");
+    // .chen holds chen's AST cache, which atom writes into a C/C++ source tree
+    ignoreList.push("**/.hg/**", "**/.git/**", "**/.chen/**");
     // Only ignore node_modules if the caller is not looking for package.json
     if (!pattern.includes("package.json") && !options.includeNodeModulesDir) {
       ignoreList.push("**/node_modules/**");

package/lib/core/httpClient.js

@@ -1,13 +1,11 @@
 import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
 import process from "node:process";
 import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
 
-import {
-  Agent,
-  EnvHttpProxyAgent,
-  interceptors,
-  request as undiciRequest,
-} from "undici";
+import { Agent, EnvHttpProxyAgent, request as undiciRequest } from "undici";
+
+import { registerRunReset } from "./runState.js";
 
 // Environment variables here are read with raw `process.env` rather than
 // `readEnvironmentVariable`: that helper lives in activity.js, which imports
@@ -41,9 +39,8 @@ import {
  *   `Content-Encoding` header, matching `got`'s transparent decoding.
  * - Proxy support via the standard `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY`
  *   environment variables (through undici's `EnvHttpProxyAgent`).
- * - An in-memory GET response cache (enabled by default, disabled by setting
- *   the `CDXGEN_NO_CACHE` environment variable) that replaces the got + Keyv
- *   cache cdxgen previously relied on.
+ * - An in-memory GET response cache that replaces the got + Keyv cache cdxgen
+ *   previously relied on. A request opts out with `cache: false`.
  * - Response objects exposing `statusCode`, `headers`, `body`, `rawBody`,
  *   `url` and `request.options`.
  * - A lazily-resolved `.json()` method on the returned promise, mirroring
@@ -137,7 +134,12 @@ function mergeHeaders(base = {}, override = {}) {
  *   `beforeError` arrays.
  */
 function mergeHooks(base = {}, override = {}) {
-  const hookNames = ["beforeRequest", "afterResponse", "beforeError"];
+  const hookNames = [
+    "beforeRequest",
+    "beforeNetwork",
+    "afterResponse",
+    "beforeError",
+  ];
   const merged = {};
   for (const name of hookNames) {
     merged[name] = [...(base?.[name] || []), ...(override?.[name] || [])];
@@ -253,6 +255,11 @@ function decompressBody(rawBody, contentEncoding) {
  * Read and decode an undici response body according to the requested
  * `responseType`.
  *
+ * An error response often carries a body in another format than the one asked
+ * for, such as the HTML page a CDN sends with a 429. Its JSON body is decoded
+ * when it parses and kept as text otherwise, so the caller sees the status
+ * rather than a parse error.
+ *
  * @param {Object} undiciResponse Response returned by `undici.request`.
  * @param {string} [responseType] One of `"json"`, `"buffer"` or `"text"`.
  * @returns {Promise<{body: any, rawBody: Buffer}>} Decoded body and raw bytes.
@@ -272,7 +279,17 @@ async function readBody(undiciResponse, responseType) {
     body = rawBody;
   } else if (responseType === "json") {
     const text = rawBody.toString("utf-8");
-    body = text.length ? JSON.parse(text) : undefined;
+    if (!text.length) {
+      body = undefined;
+    } else if (undiciResponse.statusCode >= 400) {
+      try {
+        body = JSON.parse(text);
+      } catch (_err) {
+        body = text;
+      }
+    } else {
+      body = JSON.parse(text);
+    }
   } else {
     body = rawBody.toString("utf-8");
   }
@@ -304,20 +321,100 @@ function resolveRequestBody(options) {
 
 // In-memory cache of successful GET responses, mirroring the HTTP cache cdxgen
 // historically kept via got + Keyv. Repeated metadata/license lookups during a
-// scan are served from here instead of hitting the network again. Set the
-// CDXGEN_NO_CACHE environment variable to "true" or "1" to disable it.
+// scan are served from here instead of hitting the network again. It lasts for
+// one run; `CDXGEN_NO_CACHE` and `--no-cache` turn off only the on-disk caches,
+// because nothing gains from asking a registry the same question twice in one
+// scan.
+//
+// Entries expire after an hour and the cache is bounded in size, least
+// recently used first, so a long-running server neither serves stale registry
+// documents nor grows without limit.
 const responseCache = new Map();
+const RESPONSE_CACHE_TTL_MS = 60 * 60 * 1000;
+const RESPONSE_CACHE_MAX_BYTES = 512 * 1024 * 1024;
+let responseCacheLimits = {
+  ttlMs: RESPONSE_CACHE_TTL_MS,
+  maxBytes: RESPONSE_CACHE_MAX_BYTES,
+};
+let responseCacheBytes = 0;
+
+/**
+ * Approximate the memory a cached response holds. The raw bytes are kept,
+ * plus the decoded body for text and JSON responses.
+ *
+ * @param {Object} response Response object.
+ * @returns {number} Size in bytes.
+ */
+function cachedResponseBytes(response) {
+  const raw = response?.rawBody?.length || 0;
+  return response?.body === response?.rawBody ? raw : raw * 3;
+}
+
+/**
+ * Read a cached response, dropping it when it has expired and marking it as
+ * recently used otherwise.
+ *
+ * @param {string} key Cache key.
+ * @returns {Object|undefined} The cached response.
+ */
+function cacheGet(key) {
+  const entry = responseCache.get(key);
+  if (!entry) {
+    return undefined;
+  }
+  responseCache.delete(key);
+  if (entry.expiresAt <= Date.now()) {
+    responseCacheBytes -= entry.bytes;
+    return undefined;
+  }
+  responseCache.set(key, entry);
+  return entry.response;
+}
+
+/**
+ * Store a response, evicting the least recently used entries beyond the size
+ * bound.
+ *
+ * @param {string} key Cache key.
+ * @param {Object} response Response object.
+ * @returns {void}
+ */
+function cacheSet(key, response) {
+  const bytes = cachedResponseBytes(response);
+  if (bytes > responseCacheLimits.maxBytes) {
+    return;
+  }
+  const previous = responseCache.get(key);
+  if (previous) {
+    responseCache.delete(key);
+    responseCacheBytes -= previous.bytes;
+  }
+  responseCache.set(key, {
+    response,
+    bytes,
+    expiresAt: Date.now() + responseCacheLimits.ttlMs,
+  });
+  responseCacheBytes += bytes;
+  for (const [oldestKey, oldest] of responseCache) {
+    if (responseCacheBytes <= responseCacheLimits.maxBytes) {
+      break;
+    }
+    responseCache.delete(oldestKey);
+    responseCacheBytes -= oldest.bytes;
+  }
+}
 
 /**
- * Determine whether the in-memory HTTP response cache is disabled via the
- * CDXGEN_NO_CACHE environment variable. Evaluated per request so tests and
- * callers can toggle it at runtime.
+ * Override the response cache bounds. Returns the previous bounds so tests can
+ * restore them. Not part of the public API.
  *
- * @returns {boolean} True when caching should be skipped.
+ * @param {{ttlMs?: number, maxBytes?: number}} limits New bounds.
+ * @returns {{ttlMs: number, maxBytes: number}} Previous bounds.
  */
-export function isCacheDisabled() {
-  const value = process.env.CDXGEN_NO_CACHE;
-  return value === "true" || value === "1";
+export function _setHttpCacheLimits(limits) {
+  const previous = responseCacheLimits;
+  responseCacheLimits = { ...responseCacheLimits, ...limits };
+  return previous;
 }
 
 /**
@@ -327,8 +424,11 @@ export function isCacheDisabled() {
  */
 export function clearHttpCache() {
   responseCache.clear();
+  responseCacheBytes = 0;
 }
 
+registerRunReset("http:responses", clearHttpCache);
+
 // ---------------------------------------------------------------------------
 // Test cassette interceptor — the single network seam.
 //
@@ -397,34 +497,45 @@ export function clearHttpInterceptor() {
 }
 
 /**
- * Build the cache key for a request. Only the method and normalized URL are
- * used, matching got's default cache key behaviour.
+ * Build the cache key for a request.
+ *
+ * Besides the method and URL, the key carries the response type, which
+ * changes how the same bytes are decoded, and a digest of every request
+ * header. A response fetched with one credential is therefore never served to
+ * a request made with another credential or with none, and a JSON request
+ * never receives a text body. Header values only enter the key as a SHA-256
+ * digest, so no credential is held in it.
  *
  * @param {string} method Uppercased HTTP method.
  * @param {URL} url Request URL.
+ * @param {Object} [headers] Request headers as sent.
+ * @param {string} [responseType] Requested body decoding.
  * @returns {string} Cache key.
  */
-function cacheKeyFor(method, url) {
-  return `${method}:${url.toString()}`;
+function cacheKeyFor(method, url, headers = {}, responseType = undefined) {
+  const headerEntries = Object.entries(headers || {})
+    .filter(([, value]) => value !== undefined && value !== null)
+    .map(([name, value]) => [
+      name.toLowerCase(),
+      Array.isArray(value) ? value.join(", ") : String(value),
+    ])
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+  const headerDigest = headerEntries.length
+    ? createHash("sha256").update(JSON.stringify(headerEntries)).digest("hex")
+    : "";
+  return `${method}:${responseType || "text"}:${url.toString()}:${headerDigest}`;
 }
 
 // The maximum number of redirects to follow when `followRedirect` is enabled.
 const MAX_REDIRECTIONS = 10;
 
-// Bun ships its own bundled implementation of the `undici` module which, as of
-// Bun 1.2, does not expose the `Agent.prototype.compose` composition API nor the
-// `interceptors.redirect` interceptor that undici v7 uses for redirect handling
-// (see cdxgen issue #4245). Detect the Bun runtime so we can fall back to plain
-// dispatchers and follow redirects manually instead of crashing at module load.
+// Bun ships its own bundled implementation of the `undici` module, which lacks
+// `EnvHttpProxyAgent` (see cdxgen issue #4245).
 const isBun = typeof globalThis.Bun !== "undefined";
 
-// Reusable pooled dispatchers. On Node.js, undici composes redirect handling as
-// an interceptor (there is no per-request `maxRedirections` option in undici v7),
-// so we pre-build the small set of dispatcher variants we need instead of
-// allocating a fresh Agent per request (which would defeat connection pooling).
-// On Bun, `compose`/`interceptors.redirect` are unavailable, so the redirect
-// dispatchers are just the plain agents and redirects are handled in
-// `requestWithRedirects` below.
+// Reusable pooled dispatchers, one per TLS verification setting, so requests
+// share connections instead of allocating a fresh Agent each time. Redirects
+// are followed in `requestWithRedirects` below on every runtime.
 // Whether standard proxy environment variables are set. When they are, requests
 // must be routed through the proxy. Because this client always passes an
 // explicit per-request `dispatcher`, it overrides Node's global (potentially
@@ -461,51 +572,72 @@ const defaultAgent = createBaseAgent();
 const insecureAgent = createBaseAgent({
   connect: { rejectUnauthorized: false },
 });
-const redirectDispatcher = isBun
-  ? defaultAgent
-  : defaultAgent.compose(
-      interceptors.redirect({ maxRedirections: MAX_REDIRECTIONS }),
-    );
-const insecureRedirectDispatcher = isBun
-  ? insecureAgent
-  : insecureAgent.compose(
-      interceptors.redirect({ maxRedirections: MAX_REDIRECTIONS }),
-    );
 
 /**
- * Pick the undici dispatcher matching the request's redirect and TLS
- * verification preferences.
+ * Pick the undici dispatcher matching the request's TLS verification
+ * preference. Redirects are followed by `requestWithRedirects`, not by the
+ * dispatcher.
  *
- * @param {boolean} followRedirect Whether HTTP redirects should be followed.
  * @param {boolean} insecure Whether TLS certificate verification is disabled.
  * @returns {import("undici").Dispatcher} The dispatcher to use for the request.
  */
-function selectDispatcher(followRedirect, insecure) {
-  if (insecure) {
-    return followRedirect ? insecureRedirectDispatcher : insecureAgent;
-  }
-  return followRedirect ? redirectDispatcher : defaultAgent;
+function selectDispatcher(insecure) {
+  return insecure ? insecureAgent : defaultAgent;
 }
 
 // HTTP status codes that represent a redirect with a `location` header.
 const REDIRECT_STATUS_CODES = new Set([301, 302, 303, 307, 308]);
 
+// Request headers that may follow a redirect to a different origin. Everything
+// else, such as Authorization, cookies and registry API keys like X-Api-Key or
+// PRIVATE-TOKEN, stays with the origin the caller addressed.
+const CROSS_ORIGIN_REDIRECT_HEADERS = new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "user-agent",
+]);
+
 /**
- * Issue an undici request, following redirects manually when running under Bun.
+ * Keep only the request headers that may be sent to a different origin.
  *
- * On Node.js the redirect-following interceptor baked into the dispatcher does
- * the work, so this simply forwards to `undiciRequest`. On Bun (where the
- * interceptor API is unavailable) we loop on 3xx responses, draining each
- * intermediate body and resolving relative `location` headers, up to
+ * @param {Object} headers Request headers.
+ * @returns {Object} Headers safe to send cross-origin.
+ */
+function crossOriginRedirectHeaders(headers = {}) {
+  const kept = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (CROSS_ORIGIN_REDIRECT_HEADERS.has(name.toLowerCase())) {
+      kept[name] = value;
+    }
+  }
+  return kept;
+}
+
+/**
+ * Issue an undici request and follow redirects one hop at a time.
+ *
+ * Redirects are followed here rather than by undici's redirect interceptor so
+ * that every hop goes through `beforeRedirect`, which runs the same host
+ * allowlist, protocol and dry-run checks as the first request, and so that
+ * credentials are not forwarded to another origin. Each intermediate body is
+ * drained and relative `location` headers are resolved, up to
  * `MAX_REDIRECTIONS` hops.
  *
  * @param {URL} url Request URL.
  * @param {Object} requestOptions Options passed to `undiciRequest`.
  * @param {boolean} followRedirect Whether redirects should be followed.
+ * @param {function(URL): Promise<void>} beforeRedirect Called with the next URL
+ *   before each hop; throws to stop the request.
  * @returns {Promise<Object>} The final undici response.
  */
-async function requestWithRedirects(url, requestOptions, followRedirect) {
-  if (!isBun || !followRedirect) {
+async function requestWithRedirects(
+  url,
+  requestOptions,
+  followRedirect,
+  beforeRedirect,
+) {
+  if (!followRedirect) {
     return await undiciRequest(url, requestOptions);
   }
   let currentUrl = url;
@@ -526,7 +658,14 @@ async function requestWithRedirects(url, requestOptions, followRedirect) {
     } catch {
       // Ignore drain failures; the socket will be discarded.
     }
-    currentUrl = new URL(location, currentUrl);
+    const nextUrl = new URL(location, currentUrl);
+    await beforeRedirect(nextUrl);
+    if (nextUrl.origin !== currentUrl.origin) {
+      requestOptions.headers = crossOriginRedirectHeaders(
+        requestOptions.headers,
+      );
+    }
+    currentUrl = nextUrl;
     redirections += 1;
     // 303, and 301/302 for anything other than GET/HEAD, must switch to GET
     // without a body, matching how undici's redirect interceptor behaves.
@@ -587,11 +726,23 @@ async function doRequest(mergedOptions) {
   const { body, headers } = resolveRequestBody(options);
   const method = (options.method || "GET").toUpperCase();
 
-  // Serve cacheable GET requests from the in-memory cache when enabled.
-  const cacheable = method === "GET" && !isCacheDisabled();
-  const cacheKey = cacheable ? cacheKeyFor(method, url) : undefined;
-  if (cacheable && responseCache.has(cacheKey)) {
-    return responseCache.get(cacheKey);
+  // Serve cacheable GET requests from the in-memory cache when enabled. A
+  // request opts out with `cache: false`, as token exchanges do.
+  const cacheable = method === "GET" && options.cache !== false;
+  const cacheKey = cacheable
+    ? cacheKeyFor(method, url, headers, options.responseType)
+    : undefined;
+  if (cacheable) {
+    const cached = cacheGet(cacheKey);
+    if (cached) {
+      return cached;
+    }
+  }
+
+  // Runs only when the request is about to reach the network, so a caller
+  // that rate-limits a host does not wait for a response already cached.
+  for (const hook of options.hooks?.beforeNetwork || []) {
+    await hook(options);
   }
 
   const timeoutMs = resolveTimeout(options.timeout);
@@ -603,9 +754,21 @@ async function doRequest(mergedOptions) {
     method,
     headers,
     body: method === "GET" || method === "HEAD" ? undefined : body,
-    dispatcher: selectDispatcher(followRedirect, insecure),
+    dispatcher: selectDispatcher(insecure),
     signal,
   };
+  // A redirect target must pass the same beforeRequest checks, such as the
+  // host allowlist, as the URL the caller asked for.
+  const beforeRedirect = async (nextUrl) => {
+    const hopOptions = {
+      ...options,
+      url: nextUrl,
+      context: { ...options.context },
+    };
+    for (const hook of options.hooks?.beforeRequest || []) {
+      await hook(hopOptions);
+    }
+  };
 
   let undiciResponse;
   try {
@@ -613,6 +776,7 @@ async function doRequest(mergedOptions) {
       url,
       requestOptions,
       followRedirect,
+      beforeRedirect,
     );
   } catch (err) {
     const requestError = new RequestError(err, options);
@@ -652,7 +816,7 @@ async function doRequest(mergedOptions) {
 
   // Only successful responses are cached, matching HTTP cache semantics.
   if (cacheable && finalResponse.statusCode < 400) {
-    responseCache.set(cacheKey, finalResponse);
+    cacheSet(cacheKey, finalResponse);
   }
   return finalResponse;
 }