@depup/got 15.1.0-depup.10 → 16.0.0-depup.1

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/got
 
 | Field | Value |
 |-------|-------|
-| Original | [got](https://www.npmjs.com/package/got) @ 15.1.0 |
-| Processed | 2026-07-21 |
+| Original | [got](https://www.npmjs.com/package/got) @ 16.0.0 |
+| Processed | 2026-09-17 |
 | Smoke test | passed |
 | Deps updated | 3 |
 
@@ -24,7 +24,7 @@ npm install @depup/got
 |------------|------|-----|
 | @sindresorhus/is | ^8.0.0 | ^8.1.0 |
 | cacheable-request | ^13.0.18 | ^13.0.19 |
-| type-fest | ^5.6.0 | ^5.8.0 |
+| type-fest | ^5.6.0 | ^5.10.0 |
 
 ---
 

package/changes.json

@@ -10,9 +10,9 @@
     },
     "type-fest": {
       "from": "^5.6.0",
-      "to": "^5.8.0"
+      "to": "^5.10.0"
     }
   },
-  "timestamp": "2026-07-21T16:15:47.761Z",
+  "timestamp": "2026-09-17T16:10:47.696Z",
   "totalUpdated": 3
 }

package/dist/source/as-promise/index.js

@@ -89,6 +89,16 @@ export default function asPromise(firstRequest) {
                                     && hasUrlOrPrefixUrlBoundaryChanged(options, currentUrl, previousBoundary)) {
                                     assertUrlHasSameOriginAsPrefixUrlIfNeeded(options, currentUrl);
                                 }
+                                if (!reusesRequestOptions
+                                    && updatedOptions.url === undefined
+                                    && previousUrl
+                                    && currentUrl instanceof URL
+                                    && !isSameOrigin(previousUrl, currentUrl)) {
+                                    options.stripSensitiveHeaders(previousUrl, currentUrl, updatedOptions);
+                                    if (!hasExplicitBody) {
+                                        options.clearBody();
+                                    }
+                                }
                                 if (updatedOptions.url !== undefined) {
                                     const nextUrl = reusesRequestOptions
                                         ? options.url
@@ -151,7 +161,7 @@ export default function asPromise(firstRequest) {
                 if (error instanceof HTTPError && !options.throwHttpErrors) {
                     const { response } = error;
                     request.destroy();
-                    resolve(request.options.resolveBodyOnly ? response.body : response);
+                    resolve(options.resolveBodyOnly ? response.body : response);
                     return;
                 }
                 reject(error);

package/dist/source/core/calculate-retry-delay.js

@@ -13,7 +13,7 @@ const calculateRetryDelay = ({ attemptCount, retryOptions, error, retryAfter, co
     }
     if (error.response) {
         if (retryAfter) {
-            // In this case `computedValue` is `options.request.timeout`
+            // In this case `computedValue` is `retryOptions.maxRetryAfter ?? options.timeout.request ?? Infinity`
             return retryAfter > computedValue ? 0 : retryAfter;
         }
         if (error.response.statusCode === 413) {

package/dist/source/core/index.d.ts

@@ -112,6 +112,7 @@ export default class Request extends Duplex implements RequestEvents<Request> {
     private _skipRequestEndInFinal;
     private _hasWrittenBody;
     private _hasWritableBody;
+    private _discardBodyWrites;
     private _incrementalDecode?;
     private readonly _requestId;
     private _requestInitialized;
@@ -127,6 +128,7 @@ export default class Request extends Duplex implements RequestEvents<Request> {
     }): T;
     unpipe<T extends NodeJS.WritableStream>(destination: T): this;
     private _attachAbortListener;
+    private _destroyInFlightAlpnSocket;
     private _shouldIncrementallyDecodeBody;
     private _checkContentLengthMismatch;
     private _finalizeBody;

package/dist/source/core/index.js

@@ -37,10 +37,15 @@ const transientWriteErrorCodes = new Set(['EPIPE', 'ECONNRESET']);
 const omittedPipedHeaders = new Set([
     'host',
     'connection',
+    'authorization',
+    'cookie',
+    'cookie2',
     'keep-alive',
     'proxy-authenticate',
     'proxy-authorization',
     'proxy-connection',
+    'set-cookie',
+    'set-cookie2',
     'te',
     'trailer',
     'transfer-encoding',
@@ -56,6 +61,16 @@ const proxiedRequestEvents = [
     'upgrade',
 ];
 const noop = () => { };
+const createPreRequestErrorTimings = () => {
+    const now = Date.now();
+    return {
+        start: now,
+        error: now,
+        phases: {
+            total: 0,
+        },
+    };
+};
 const serializeNativeFormDataBody = (form) => {
     const response = new globalThis.Response(form);
     return {
@@ -66,7 +81,7 @@ const serializeNativeFormDataBody = (form) => {
 // A body is replayable only if iterating it again restarts from the beginning.
 // Node streams, Web `ReadableStream`s, generators, and self-iterating (one-shot) iterators all yield their data only once, so they cannot be replayed on a redirect.
 const isNonReplayableBody = (body) => is.nodeStream(body)
-    || (typeof ReadableStream !== 'undefined' && body instanceof ReadableStream)
+    || body instanceof ReadableStream
     || is.generator(body)
     || (is.asyncIterable(body) && body[Symbol.asyncIterator]() === body)
     || (is.iterable(body) && body[Symbol.iterator]() === body);
@@ -120,12 +135,13 @@ export const normalizeError = (error) => {
 const getSanitizedUrl = (options) => options?.url ? stripUrlAuth(options.url) : '';
 const makeProgress = (transferred, total) => {
     let percent = 0;
-    if (total) {
-        percent = transferred / total;
-    }
-    else if (total === transferred) {
+    if (total === transferred) {
+        // Known-size complete transfers (including 0/0) should report 100% rather than 0%.
         percent = 1;
     }
+    else if (total) {
+        percent = transferred / total;
+    }
     return { percent, transferred, total };
 };
 export default class Request extends Duplex {
@@ -159,6 +175,7 @@ export default class Request extends Duplex {
     _skipRequestEndInFinal = false;
     _hasWrittenBody = false;
     _hasWritableBody = false;
+    _discardBodyWrites = false;
     _incrementalDecode;
     _requestId = generateRequestId();
     // We need this because `this._request` if `undefined` when using cache
@@ -275,7 +292,10 @@ export default class Request extends Duplex {
         const { response, options } = this;
         const attemptCount = this.retryCount + (error.name === 'RetryError' ? 0 : 1);
         this._stopReading = true;
-        if (!(error instanceof RequestError)) {
+        if (error instanceof TimedOutTimeoutError) {
+            error = new TimeoutError(error, this.timings ?? createPreRequestErrorTimings(), this);
+        }
+        else if (!(error instanceof RequestError)) {
             error = new RequestError(error.message, error, this);
         }
         const typedError = error;
@@ -283,15 +303,17 @@ export default class Request extends Duplex {
             // Node.js parser is really weird.
             // It emits post-request Parse Errors on the same instance as previous request. WTF.
             // Therefore, we need to check if it has been destroyed as well.
-            //
-            // Furthermore, Node.js 16 `response.destroy()` doesn't immediately destroy the socket,
-            // but makes the response unreadable. So we additionally need to check `response.readable`.
             if (response?.readable && !response.rawBody && !this._request?.socket?.destroyed) {
                 // @types/node has incorrect typings. `setEncoding` accepts `null` as well.
                 response.setEncoding(this.readableEncoding);
-                const success = await this._setRawBody(response);
-                if (success) {
-                    response.body = decodeUint8Array(response.rawBody);
+                await this._setRawBody(response);
+            }
+            if (response?.rawBody && response.body === undefined) {
+                try {
+                    response.body = decodeUint8Array(response.rawBody, options.encoding);
+                }
+                catch {
+                    // Preserve the original request error when decoding its response body also fails.
                 }
             }
             if (this.listenerCount('retry') !== 0) {
@@ -302,13 +324,13 @@ export default class Request extends Duplex {
                         retryAfter = Number(response.headers['retry-after']);
                         if (Number.isNaN(retryAfter)) {
                             retryAfter = Date.parse(response.headers['retry-after']) - Date.now();
-                            if (retryAfter <= 0) {
-                                retryAfter = 1;
-                            }
                         }
                         else {
                             retryAfter *= 1000;
                         }
+                        if (retryAfter <= 0) {
+                            retryAfter = 1;
+                        }
                     }
                     const retryOptions = options.retry;
                     const computedValue = calculateRetryDelay({
@@ -471,8 +493,12 @@ export default class Request extends Duplex {
         }
     }
     _write(chunk, encoding, callback) {
-        this._hasWrittenBody = true;
         const write = () => {
+            if (this._discardBodyWrites) {
+                callback();
+                return;
+            }
+            this._hasWrittenBody = true;
             this._writeRequest(chunk, encoding, callback);
         };
         if (this._requestInitialized) {
@@ -484,6 +510,11 @@ export default class Request extends Duplex {
     }
     _final(callback) {
         const endRequest = () => {
+            if (this._discardBodyWrites) {
+                this._hasWritableBody = false;
+                callback();
+                return;
+            }
             if (this._skipRequestEndInFinal) {
                 this._skipRequestEndInFinal = false;
                 callback();
@@ -503,11 +534,14 @@ export default class Request extends Duplex {
                 if (request?._writableState?.errored) {
                     return;
                 }
-                if (!error) {
-                    this._emitUploadComplete(request);
-                }
                 this._hasWritableBody = false;
-                callback(error);
+                if (error) {
+                    // `ClientRequest.end()` can report the same failure as the request's `error` event. Route it through Got's retry handling without completing `_final`, so this Duplex does not finish a failed upload.
+                    this._beforeError(error);
+                    return;
+                }
+                this._emitUploadComplete(request);
+                callback();
             });
         };
         if (this._requestInitialized) {
@@ -524,6 +558,7 @@ export default class Request extends Duplex {
         this._stopRetry?.();
         this._cancelTimeouts?.();
         this._abortListenerDisposer?.[Symbol.dispose]();
+        this._destroyInFlightAlpnSocket();
         if (this.options) {
             const { body } = this.options;
             if (is.nodeStream(body)) {
@@ -548,7 +583,7 @@ export default class Request extends Duplex {
         }
         // Preserve custom errors returned by beforeError hooks.
         // For other errors, wrap non-RequestError instances for consistency.
-        if (error !== null && !is.undefined(error)) {
+        if (error !== null) {
             const processedByHooks = error instanceof Error && errorsProcessedByHooks.has(error);
             if (!processedByHooks && !(error instanceof RequestError)) {
                 error = error instanceof Error
@@ -580,9 +615,10 @@ export default class Request extends Duplex {
             return;
         }
         const abort = () => {
+            this._destroyInFlightAlpnSocket();
             // See https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal/timeout_static#return_value
             if (signal.reason?.name === 'TimeoutError') {
-                this.destroy(new TimeoutError(signal.reason, this.timings, this));
+                this.destroy(new TimeoutError(signal.reason, this.timings ?? createPreRequestErrorTimings(), this));
             }
             else {
                 this.destroy(new AbortError(this));
@@ -595,12 +631,14 @@ export default class Request extends Duplex {
             this._abortListenerDisposer = addAbortListener(signal, abort);
         }
     }
+    _destroyInFlightAlpnSocket() {
+        this._requestOptions?._alpnSocket?.destroy();
+    }
     _shouldIncrementallyDecodeBody() {
         const { responseType, encoding } = this.options;
         return Boolean(this._noPipe)
             && (responseType === 'text' || responseType === 'json')
-            && isUtf8Encoding(encoding)
-            && typeof globalThis.TextDecoder === 'function';
+            && isUtf8Encoding(encoding);
     }
     _checkContentLengthMismatch() {
         if (this.options.strictContentLength && this._expectedContentLength !== undefined) {
@@ -734,16 +772,15 @@ export default class Request extends Duplex {
         // turn an irrelevant redirect body into a client-side failure or decompression DoS.
         const shouldFollowRedirect = isRedirect && (typeof options.followRedirect === 'function' ? options.followRedirect(typedResponse) : options.followRedirect);
         if (options.decompress && !hasNoBody && !shouldFollowRedirect) {
-            // When strictContentLength is enabled, track compressed bytes by listening to
-            // the native response's data events before decompression
-            if (options.strictContentLength) {
+            response = decompressResponse(response);
+            typedResponse = prepareResponse(response);
+            // When strictContentLength is enabled, track the compressed bytes emitted by the native response.
+            if (options.strictContentLength && response !== nativeResponse) {
                 this._compressedBytesCount = 0;
                 nativeResponse.on('data', (chunk) => {
                     this._compressedBytesCount += byteLength(chunk);
                 });
             }
-            response = decompressResponse(response);
-            typedResponse = prepareResponse(response);
         }
         // `decompressResponse` wraps the response stream when it decompresses,
         // so `response !== nativeResponse` indicates decompression happened.
@@ -825,12 +862,13 @@ export default class Request extends Duplex {
             // the outward stream until cookie handling has finished.
             response.once('end', handleResponseEnd);
         }
-        const noPipeCookieJarRawBodyPromise = this._noPipe
+        const rawCookies = response.headers['set-cookie'];
+        const responseRawBodyPromise = this._noPipe
             && is.object(options.cookieJar)
-            && !isRedirect
+            && rawCookies !== undefined
+            && !shouldFollowRedirect
             ? this._setRawBody(response)
             : undefined;
-        const rawCookies = response.headers['set-cookie'];
         if (is.object(options.cookieJar) && rawCookies) {
             let promises = rawCookies.map(async (rawCookie) => options.cookieJar.setCookie(rawCookie, url.toString()));
             if (options.ignoreInvalidCookies) {
@@ -845,6 +883,9 @@ export default class Request extends Duplex {
                 await Promise.all(promises);
             }
             catch (error) {
+                if (responseRawBodyPromise) {
+                    await responseRawBodyPromise;
+                }
                 this._beforeError(normalizeError(error));
                 return;
             }
@@ -902,14 +943,15 @@ export default class Request extends Duplex {
                 }
                 else if (isDifferentOrigin
                     && canRewrite
+                    && updatedOptions.method !== 'QUERY'
                     && this._hasBodyForRedirect(updatedOptions)) {
                     this._dropBody(updatedOptions);
                 }
                 if (isDifferentOrigin) {
                     // On cross-origin redirects, strip sensitive headers and any credentials
                     // embedded in the redirect URL itself to prevent a malicious server from
-                    // leaking them to a third party. The request body is preserved per RFC:
-                    // 307/308 keep the method and replayable bodies, even cross-origin.
+                    // leaking them to a third party. 307/308 redirects preserve the method and replayable body per RFC; QUERY does the same on 301/302.
+                    updatedOptions.h2session = undefined;
                     this._stripCrossOriginState(updatedOptions, redirectUrl);
                 }
                 else {
@@ -928,6 +970,7 @@ export default class Request extends Duplex {
                 this.redirectUrls.push(redirectUrl);
                 const boundaryBeforeRedirectHooks = getUrlPrefixBoundary(updatedOptions);
                 const bodyBeforeRedirectHooks = updatedOptions.body;
+                const h2sessionBeforeRedirectHooks = updatedOptions.h2session;
                 const preHookState = isDifferentOrigin
                     ? undefined
                     : {
@@ -946,7 +989,8 @@ export default class Request extends Duplex {
                 }
                 updatedOptions.clearUnchangedCookieHeader(preHookState, changedState);
                 const nativeFormDataBody = this._nativeFormDataBody;
-                if (statusCode === 307 || statusCode === 308) {
+                const mustReplayBodyOnRedirect = statusCode === 307 || statusCode === 308 || updatedOptions.method === 'QUERY';
+                if (mustReplayBodyOnRedirect) {
                     const bodyUnchangedByHooks = updatedOptions.body === bodyBeforeRedirectHooks;
                     const wasNonReplayable = isNonReplayableBody(bodyBeforeRedirectHooks);
                     if (!bodyUnchangedByHooks && wasNonReplayable) {
@@ -969,7 +1013,7 @@ export default class Request extends Duplex {
                     }
                     else if (bodyUnchangedByHooks
                         && (wasNonReplayable || (is.undefined(updatedOptions.body) && (this._hasWrittenBody || this._hasWritableBody)))) {
-                        // 307/308 redirects must replay the body, so follow the HTTP spec and other clients by failing for unchanged non-replayable bodies. Hooks may supply a fresh body.
+                        // Body-preserving redirects must replay the body, so follow the HTTP spec and other clients by failing for unchanged non-replayable bodies. Hooks may supply a fresh body.
                         this._dropBody(updatedOptions);
                         this._beforeError(new RequestError('Cannot follow redirect with a non-replayable body', {}, this));
                         return;
@@ -989,7 +1033,11 @@ export default class Request extends Duplex {
                         this._dropBody(updatedOptions);
                     }
                     if (hookChangedOrigin) {
+                        if (updatedOptions.h2session === h2sessionBeforeRedirectHooks) {
+                            updatedOptions.h2session = undefined;
+                        }
                         if (canRewrite
+                            && updatedOptions.method !== 'QUERY'
                             && this._hasUnchangedBodyForRedirect(updatedOptions, state, changedState)) {
                             this._dropBody(updatedOptions);
                         }
@@ -1006,8 +1054,8 @@ export default class Request extends Duplex {
                 // Publish redirect event
                 publishRedirect({
                     requestId: this._requestId,
-                    fromUrl: url.toString(),
-                    toUrl: (updatedOptions.url).toString(),
+                    fromUrl: stripUrlAuth(url),
+                    toUrl: stripUrlAuth(updatedOptions.url),
                     statusCode,
                 });
                 this.emit('redirect', updatedOptions, typedResponse);
@@ -1020,8 +1068,6 @@ export default class Request extends Duplex {
             }
             return;
         }
-        canFinalizeResponse = true;
-        handleResponseEnd();
         // `HTTPError`s always have `error.response.body` defined.
         // Therefore, we cannot retry if `options.throwHttpErrors` is false.
         // On the last retry, if `options.throwHttpErrors` is false, we would need to return the body,
@@ -1056,11 +1102,16 @@ export default class Request extends Duplex {
             response.pause();
         });
         if (this._noPipe) {
-            const captureFromResponse = response.readableEnded || noPipeCookieJarRawBodyPromise !== undefined;
-            const success = noPipeCookieJarRawBodyPromise
-                ? await noPipeCookieJarRawBodyPromise
+            const captureFromResponse = response.readableEnded || responseRawBodyPromise !== undefined;
+            if (!captureFromResponse) {
+                canFinalizeResponse = true;
+                handleResponseEnd();
+            }
+            const success = responseRawBodyPromise
+                ? await responseRawBodyPromise
                 : await this._setRawBody(captureFromResponse ? response : this);
             if (captureFromResponse) {
+                canFinalizeResponse = true;
                 handleResponseEnd();
             }
             if (success) {
@@ -1089,6 +1140,11 @@ export default class Request extends Duplex {
             }
             destination.statusCode = statusCode;
         }
+        if (this._triggerRead) {
+            this._read();
+        }
+        canFinalizeResponse = true;
+        handleResponseEnd();
     }
     async _setRawBody(from = this) {
         try {
@@ -1146,19 +1202,13 @@ export default class Request extends Duplex {
             headers: options.headers,
         });
         timer(request);
-        this._cancelTimeouts = timedOut(request, timeout, url);
-        if (this.options.http2) {
-            // Unset stream timeout, as the `timeout` option was used only for connection timeout.
-            // We remove all 'timeout' listeners instead of calling setTimeout(0) because:
-            // 1. setTimeout(0) causes a memory leak (see https://github.com/sindresorhus/got/issues/690)
-            // 2. With HTTP/2 connection reuse, setTimeout(0) accumulates listeners on the socket
-            // 3. removeAllListeners('timeout') properly cleans up without the memory leak
-            request.removeAllListeners('timeout');
-            // For HTTP/2, wait for socket and remove timeout listeners from it
-            request.once('socket', (socket) => {
-                socket.removeAllListeners('timeout');
-            });
+        const { isGotHttp2Request } = request;
+        let timeoutDelays = timeout;
+        if (isGotHttp2Request) {
+            const { socket: _socket, ...http2TimeoutDelays } = timeout;
+            timeoutDelays = http2TimeoutDelays;
         }
+        this._cancelTimeouts = timedOut(request, timeoutDelays, url);
         let lastRequestError;
         const responseEventName = options.cache ? 'cacheableResponse' : 'response';
         request.once(responseEventName, (response) => {
@@ -1168,7 +1218,7 @@ export default class Request extends Duplex {
             this._aborted = true;
             // Force clean-up, because some packages (e.g. nock) don't do this.
             request.destroy();
-            const wrappedError = error instanceof TimedOutTimeoutError ? new TimeoutError(error, this.timings, this) : new RequestError(error.message, error, this);
+            const wrappedError = error instanceof TimedOutTimeoutError ? new TimeoutError(error, this.timings ?? createPreRequestErrorTimings(), this) : new RequestError(error.message, error, this);
             this._beforeError(wrappedError);
         };
         request.once('error', (error) => {
@@ -1238,7 +1288,7 @@ export default class Request extends Duplex {
     _sendBody() {
         // Send body
         const { body } = this.options;
-        const currentRequest = this.redirectUrls.length === 0 ? this : this._request ?? this;
+        const currentRequest = this.redirectUrls.length === 0 && !this._discardBodyWrites ? this : this._request ?? this;
         if (is.nodeStream(body)) {
             body.pipe(currentRequest);
         }
@@ -1577,7 +1627,7 @@ export default class Request extends Duplex {
             const result = requestOptions._request(requestOptions, wrappedHandler);
             // TODO: remove this when `cacheable-request` supports async request functions.
             if (is.promise(result)) {
-                // We only need to implement the error handler in order to support HTTP2 caching.
+                // We only need to implement the error handler in order to support HTTP/2 caching.
                 // The result will be a promise anyway.
                 // @ts-expect-error ignore
                 result.once = (event, handler) => {
@@ -1604,7 +1654,7 @@ export default class Request extends Duplex {
                     }
                     else {
                         /* istanbul ignore next: safety check */
-                        throw new Error(`Unknown HTTP2 promise event: ${event}`);
+                        throw new Error(`Unknown HTTP/2 promise event: ${event}`);
                     }
                     return result;
                 };
@@ -1618,7 +1668,7 @@ export default class Request extends Duplex {
             Object.assign(options, {
                 protocol: url.protocol,
                 hostname: is.string(url.hostname) && url.hostname.startsWith('[') ? url.hostname.slice(1, -1) : url.hostname,
-                host: url.host,
+                host: is.string(url.hostname) && url.hostname.startsWith('[') ? url.hostname.slice(1, -1) : url.hostname,
                 hash: url.hash === '' ? '' : (url.hash ?? null),
                 search: url.search === '' ? '' : (url.search ?? null),
                 pathname: url.pathname,
@@ -1748,6 +1798,8 @@ export default class Request extends Duplex {
         let shouldOmitRequestUrlCredentials = false;
         const urlBeforeRequestHooks = options.url instanceof URL ? new URL(options.url) : undefined;
         const boundaryBeforeRequestHooks = getUrlPrefixBoundary(options);
+        const stateBeforeRequestHooks = urlBeforeRequestHooks ? snapshotCrossOriginState(options) : undefined;
+        const crossOriginHookStrippedHeaders = new Set();
         const changedState = await options.trackStateMutations(async (changedState) => {
             for (const hook of options.hooks.beforeRequest) {
                 // eslint-disable-next-line no-await-in-loop
@@ -1765,13 +1817,53 @@ export default class Request extends Duplex {
             && hasUrlOrPrefixUrlBoundaryChanged(options, options.url, boundaryBeforeRequestHooks)) {
             assertUrlHasSameOriginAsPrefixUrlIfNeeded(options, options.url);
         }
+        if (urlBeforeRequestHooks
+            && options.url instanceof URL
+            && !isSameOrigin(urlBeforeRequestHooks, options.url)) {
+            const hookChangedState = new Set(changedState);
+            const currentHeaders = options.getInternalHeaders();
+            const changedHeaders = {};
+            for (const header of crossOriginStripHeaders) {
+                if (hookChangedState.has(header)) {
+                    changedHeaders[header] = currentHeaders[header];
+                }
+                else {
+                    options.deleteInternalHeader(header);
+                    crossOriginHookStrippedHeaders.add(header);
+                }
+            }
+            const changedOptions = { headers: changedHeaders };
+            if (hookChangedState.has('url')) {
+                changedOptions.url = options.url;
+            }
+            if (hookChangedState.has('prefixUrl')) {
+                changedOptions.prefixUrl = options.prefixUrl;
+            }
+            if (hookChangedState.has('username')) {
+                changedOptions.username = options.username;
+            }
+            if (hookChangedState.has('password')) {
+                changedOptions.password = options.password;
+            }
+            options.stripSensitiveHeaders(urlBeforeRequestHooks, options.url, changedOptions);
+            this._discardBodyWrites = true;
+            this._hasWrittenBody = false;
+            this._hasWritableBody = false;
+            if (!hookChangedState.has('body')
+                && !hookChangedState.has('json')
+                && !hookChangedState.has('form')
+                && isBodyUnchanged(options, stateBeforeRequestHooks)) {
+                options.clearBody();
+                this._bodySize = undefined;
+            }
+        }
         if (request === undefined) {
             const currentHeaders = options.getInternalHeaders();
             // `headers.authorization = undefined` / `headers.cookie = undefined` is an
             // explicit opt-out. Respect that instead of regenerating values from URL
             // credentials or the cookie jar later in request setup.
             const isHeaderExplicitlyOmitted = (header) => options.isHeaderExplicitlySet(header)
-                && Object.hasOwn(currentHeaders, header)
+                && (Object.hasOwn(currentHeaders, header) || changedState.has(header))
                 && is.undefined(currentHeaders[header]);
             const currentAuthorizationHeader = currentHeaders.authorization;
             const currentCookieHeader = currentHeaders.cookie;
@@ -1782,7 +1874,9 @@ export default class Request extends Duplex {
             // - Otherwise, if the request did not start with explicit Authorization, Got may
             //   generate Basic auth from the current username/password.
             const authorizationWasExplicitlyOmitted = isHeaderExplicitlyOmitted('authorization')
-                || (authorizationWasInitiallyExplicit && is.undefined(currentAuthorizationHeader));
+                || (authorizationWasInitiallyExplicit
+                    && !crossOriginHookStrippedHeaders.has('authorization')
+                    && is.undefined(currentAuthorizationHeader));
             const cookieWasExplicitlyOmitted = is.undefined(currentCookieHeader)
                 && (cookieWasInitiallyOmitted || isHeaderExplicitlyOmitted('cookie'));
             sanitizeHeaders();
@@ -1806,7 +1900,7 @@ export default class Request extends Duplex {
                 // A beforeRequest hook intentionally set the outgoing Authorization header.
             }
             else {
-                const restorableAuthorizationHeader = changedState.has('authorization') && is.undefined(currentAuthorizationHeader)
+                const restorableAuthorizationHeader = crossOriginHookStrippedHeaders.has('authorization') || (changedState.has('authorization') && is.undefined(currentAuthorizationHeader))
                     ? undefined
                     : explicitAuthorizationHeader;
                 syncGeneratedHeader('authorization', {
@@ -1829,9 +1923,12 @@ export default class Request extends Duplex {
                 const cookieHeader = !cookieWasInitiallyOmitted && !cookieWasExplicitlyOmitted
                     ? await getCookieHeader(cookieJar)
                     : undefined;
+                const restorableCookieHeader = crossOriginHookStrippedHeaders.has('cookie')
+                    ? undefined
+                    : explicitCookieHeader;
                 syncGeneratedHeader('cookie', {
                     currentHeader: currentCookieHeader,
-                    explicitHeader: explicitCookieHeader,
+                    explicitHeader: restorableCookieHeader,
                     nextHeader: cookieHeader,
                     staleGeneratedHeader: generatedCookieHeader,
                 });
@@ -1863,21 +1960,36 @@ export default class Request extends Duplex {
         try {
             // We can't do `await fn(...)`,
             // because stream `error` event can be emitted before `Promise.resolve()`.
+            const requestFunctionStartedAt = Date.now();
+            const originalRequestTimeout = options.timeout.request;
+            let shouldRestoreRequestTimeout = false;
             let requestOrResponse = function_(url, this._requestOptions);
             if (is.promise(requestOrResponse)) {
                 requestOrResponse = await requestOrResponse;
+                if (options.timeout.request !== undefined) {
+                    const remainingRequestTimeout = options.timeout.request - (Date.now() - requestFunctionStartedAt);
+                    options.timeout.request = Math.max(0, remainingRequestTimeout);
+                    shouldRestoreRequestTimeout = true;
+                }
             }
-            if (isClientRequest(requestOrResponse)) {
-                this._onRequest(requestOrResponse);
-            }
-            else if (this.writableEnded) {
-                void this._onResponse(requestOrResponse);
-            }
-            else {
-                this.once('finish', () => {
+            try {
+                if (isClientRequest(requestOrResponse)) {
+                    this._onRequest(requestOrResponse);
+                }
+                else if (this.writableEnded) {
                     void this._onResponse(requestOrResponse);
-                });
-                this._sendBody();
+                }
+                else {
+                    this.once('finish', () => {
+                        void this._onResponse(requestOrResponse);
+                    });
+                    this._sendBody();
+                }
+            }
+            finally {
+                if (shouldRestoreRequestTimeout) {
+                    options.timeout.request = originalRequestTimeout;
+                }
             }
         }
         catch (error) {