got 14.6.6 → 15.0.1

package/dist/source/core/index.js

@@ -1,31 +1,46 @@
 import process from 'node:process';
 import { Buffer } from 'node:buffer';
 import { Duplex } from 'node:stream';
+import { addAbortListener } from 'node:events';
 import http, { ServerResponse } from 'node:http';
 import { byteLength } from 'byte-counter';
+import { chunk } from 'chunk-data';
+import { concatUint8Arrays, stringToBase64, stringToUint8Array } from 'uint8array-extras';
 import CacheableRequest, { CacheError as CacheableCacheError, } from 'cacheable-request';
 import decompressResponse from 'decompress-response';
 import is, { isBuffer } from '@sindresorhus/is';
-import { FormDataEncoder, isFormData as isFormDataLike } from 'form-data-encoder';
 import timer from './utils/timer.js';
 import getBodySize from './utils/get-body-size.js';
-import isFormData from './utils/is-form-data.js';
 import proxyEvents from './utils/proxy-events.js';
 import timedOut, { TimeoutError as TimedOutTimeoutError } from './timed-out.js';
-import urlToOptions from './utils/url-to-options.js';
+import stripUrlAuth from './utils/strip-url-auth.js';
 import WeakableMap from './utils/weakable-map.js';
 import calculateRetryDelay from './calculate-retry-delay.js';
-import Options from './options.js';
-import { isResponseOk } from './response.js';
+import Options, { crossOriginStripHeaders, hasExplicitCredentialInUrlChange, isCrossOriginCredentialChanged, isBodyUnchanged, isSameOrigin, snapshotCrossOriginState, } from './options.js';
+import { cacheDecodedBody, decodeUint8Array, isResponseOk, isUtf8Encoding, } from './response.js';
 import isClientRequest from './utils/is-client-request.js';
-import isUnixSocketURL, { getUnixSocketPath } from './utils/is-unix-socket-url.js';
+import { getUnixSocketPath } from './utils/is-unix-socket-url.js';
 import { RequestError, ReadError, MaxRedirectsError, HTTPError, TimeoutError, UploadError, CacheError, AbortError, } from './errors.js';
 import { generateRequestId, publishRequestCreate, publishRequestStart, publishResponseStart, publishResponseEnd, publishRetry, publishError, publishRedirect, } from './diagnostics-channel.js';
 const supportsBrotli = is.string(process.versions.brotli);
 const supportsZstd = is.string(process.versions.zstd);
 const methodsWithoutBody = new Set(['GET', 'HEAD']);
 const cacheableStore = new WeakableMap();
-const redirectCodes = new Set([300, 301, 302, 303, 304, 307, 308]);
+const redirectCodes = new Set([301, 302, 303, 307, 308]);
+export { crossOriginStripHeaders } from './options.js';
+const transientWriteErrorCodes = new Set(['EPIPE', 'ECONNRESET']);
+const omittedPipedHeaders = new Set([
+    'host',
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'proxy-connection',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
 // Track errors that have been processed by beforeError hooks to preserve custom error types
 const errorsProcessedByHooks = new WeakSet();
 const proxiedRequestEvents = [
@@ -36,6 +51,64 @@ const proxiedRequestEvents = [
     'upgrade',
 ];
 const noop = () => { };
+const isTransientWriteError = (error) => {
+    const { code } = error;
+    return typeof code === 'string' && transientWriteErrorCodes.has(code);
+};
+const getConnectionListedHeaders = (headers) => {
+    const connectionListedHeaders = new Set();
+    for (const [header, connectionHeader] of Object.entries(headers)) {
+        const normalizedHeader = header.toLowerCase();
+        if (normalizedHeader !== 'connection' && normalizedHeader !== 'proxy-connection') {
+            continue;
+        }
+        const connectionHeaderValues = Array.isArray(connectionHeader) ? connectionHeader : [connectionHeader];
+        for (const value of connectionHeaderValues) {
+            if (typeof value !== 'string') {
+                continue;
+            }
+            for (const token of value.split(',')) {
+                const normalizedToken = token.trim().toLowerCase();
+                if (normalizedToken.length > 0) {
+                    connectionListedHeaders.add(normalizedToken);
+                }
+            }
+        }
+    }
+    return connectionListedHeaders;
+};
+export const normalizeError = (error) => {
+    if (error instanceof globalThis.Error) {
+        return error;
+    }
+    if (is.object(error)) {
+        const errorLike = error;
+        const message = typeof errorLike.message === 'string' ? errorLike.message : 'Non-error object thrown';
+        const normalizedError = new globalThis.Error(message, { cause: error });
+        if (typeof errorLike.stack === 'string') {
+            normalizedError.stack = errorLike.stack;
+        }
+        if (typeof errorLike.code === 'string') {
+            normalizedError.code = errorLike.code;
+        }
+        if (typeof errorLike.input === 'string') {
+            normalizedError.input = errorLike.input;
+        }
+        return normalizedError;
+    }
+    return new globalThis.Error(String(error));
+};
+const getSanitizedUrl = (options) => options?.url ? stripUrlAuth(options.url) : '';
+const makeProgress = (transferred, total) => {
+    let percent = 0;
+    if (total) {
+        percent = transferred / total;
+    }
+    else if (total === transferred) {
+        percent = 1;
+    }
+    return { percent, transferred, total };
+};
 export default class Request extends Duplex {
     // @ts-expect-error - Ignoring for now.
     ['constructor'];
@@ -47,24 +120,24 @@ export default class Request extends Duplex {
     redirectUrls = [];
     retryCount = 0;
     _stopReading = false;
-    _stopRetry = noop;
+    _stopRetry;
     _downloadedSize = 0;
     _uploadedSize = 0;
     _pipedServerResponses = new Set();
     _request;
     _responseSize;
     _bodySize;
-    _unproxyEvents = noop;
-    _isFromCache;
+    _unproxyEvents;
     _triggerRead = false;
     _jobs = [];
-    _cancelTimeouts = noop;
-    _removeListeners = noop;
-    _nativeResponse;
+    _cancelTimeouts;
+    _abortListenerDisposer;
     _flushed = false;
     _aborted = false;
     _expectedContentLength;
     _compressedBytesCount;
+    _skipRequestEndInFinal = false;
+    _incrementalDecode;
     _requestId = generateRequestId();
     // We need this because `this._request` if `undefined` when using cache
     _requestInitialized = false;
@@ -77,7 +150,17 @@ export default class Request extends Duplex {
         });
         this.on('pipe', (source) => {
             if (this.options.copyPipedHeaders && source?.headers) {
-                Object.assign(this.options.headers, source.headers);
+                const connectionListedHeaders = getConnectionListedHeaders(source.headers);
+                for (const [header, value] of Object.entries(source.headers)) {
+                    const normalizedHeader = header.toLowerCase();
+                    if (omittedPipedHeaders.has(normalizedHeader) || connectionListedHeaders.has(normalizedHeader)) {
+                        continue;
+                    }
+                    if (!this.options.shouldCopyPipedHeader(normalizedHeader)) {
+                        continue;
+                    }
+                    this.options.setPipedHeader(normalizedHeader, value);
+                }
             }
         });
         this.on('newListener', event => {
@@ -97,7 +180,7 @@ export default class Request extends Duplex {
             // Publish request creation event
             publishRequestCreate({
                 requestId: this._requestId,
-                url: this.options.url?.toString() ?? '',
+                url: getSanitizedUrl(this.options),
                 method: this.options.method,
             });
         }
@@ -112,11 +195,12 @@ export default class Request extends Duplex {
                 process.nextTick(() => {
                     // _beforeError requires options to access retry logic and hooks
                     if (this.options) {
-                        this._beforeError(error);
+                        this._beforeError(normalizeError(error));
                     }
                     else {
                         // Options is undefined, skip _beforeError and destroy directly
-                        const requestError = error instanceof RequestError ? error : new RequestError(error.message, error, this);
+                        const normalizedError = normalizeError(error);
+                        const requestError = normalizedError instanceof RequestError ? normalizedError : new RequestError(normalizedError.message, normalizedError, this);
                         this.destroy(requestError);
                     }
                 });
@@ -127,17 +211,7 @@ export default class Request extends Duplex {
         // The below is run only once.
         const { body } = this.options;
         if (is.nodeStream(body)) {
-            body.once('error', error => {
-                if (this._flushed) {
-                    this._beforeError(new UploadError(error, this));
-                }
-                else {
-                    this.flush = async () => {
-                        this.flush = async () => { };
-                        this._beforeError(new UploadError(error, this));
-                    };
-                }
-            });
+            body.once('error', this._onBodyError);
         }
         if (this.options.signal) {
             const abort = () => {
@@ -153,10 +227,8 @@ export default class Request extends Duplex {
                 abort();
             }
             else {
-                this.options.signal.addEventListener('abort', abort);
-                this._removeListeners = () => {
-                    this.options.signal?.removeEventListener('abort', abort);
-                };
+                const abortListenerDisposer = addAbortListener(this.options.signal, abort);
+                this._abortListenerDisposer = abortListenerDisposer;
             }
         }
     }
@@ -184,7 +256,7 @@ export default class Request extends Duplex {
             this._requestInitialized = true;
         }
         catch (error) {
-            this._beforeError(error);
+            this._beforeError(normalizeError(error));
         }
     }
     _beforeError(error) {
@@ -210,7 +282,7 @@ export default class Request extends Duplex {
                 response.setEncoding(this.readableEncoding);
                 const success = await this._setRawBody(response);
                 if (success) {
-                    response.body = response.rawBody.toString();
+                    response.body = decodeUint8Array(response.rawBody);
                 }
             }
             if (this.listenerCount('retry') !== 0) {
@@ -240,7 +312,7 @@ export default class Request extends Duplex {
                     // When enforceRetryRules is true, respect the retry rules (limit, methods, statusCodes, errorCodes)
                     // before calling the user's calculateDelay function. If computedValue is 0 (meaning retry is not allowed
                     // based on these rules), skip calling calculateDelay entirely.
-                    // When false (default), always call calculateDelay, allowing it to override retry decisions.
+                    // When false, always call calculateDelay, allowing it to override retry decisions.
                     if (retryOptions.enforceRetryRules && computedValue === 0) {
                         backoff = 0;
                     }
@@ -255,7 +327,8 @@ export default class Request extends Duplex {
                     }
                 }
                 catch (error_) {
-                    void this._error(new RequestError(error_.message, error_, this));
+                    const normalizedError = normalizeError(error_);
+                    void this._error(new RequestError(normalizedError.message, normalizedError, this));
                     return;
                 }
                 if (backoff) {
@@ -279,7 +352,8 @@ export default class Request extends Duplex {
                         }
                     }
                     catch (error_) {
-                        void this._error(new RequestError(error_.message, error_, this));
+                        const normalizedError = normalizeError(error_);
+                        void this._error(new RequestError(normalizedError.message, normalizedError, this));
                         return;
                     }
                     // Something forced us to abort the retry
@@ -299,30 +373,35 @@ export default class Request extends Duplex {
                     // 2. If body was reassigned, we MUST destroy the OLD stream to prevent memory leaks
                     // 3. We must restore the body reference after destroy() for identity checks in promise wrapper
                     // 4. We cannot use the normal setter after destroy() because it validates stream readability
-                    if (bodyWasReassigned) {
-                        const oldBody = bodyBeforeHooks;
-                        // Temporarily clear body to prevent destroy() from destroying the new stream
-                        this.options.body = undefined;
-                        this.destroy();
-                        // Clean up the old stream resource if it's a stream and different from new body
-                        // (edge case: if old and new are same stream object, don't destroy it)
-                        if (is.nodeStream(oldBody) && oldBody !== bodyAfterHooks) {
-                            oldBody.destroy();
+                    try {
+                        if (bodyWasReassigned) {
+                            const oldBody = bodyBeforeHooks;
+                            // Temporarily clear body to prevent destroy() from destroying the new stream
+                            this.options.body = undefined;
+                            this.destroy();
+                            // Clean up the old stream resource if it's a stream and different from new body
+                            // (edge case: if old and new are same stream object, don't destroy it)
+                            if (is.nodeStream(oldBody) && oldBody !== bodyAfterHooks) {
+                                oldBody.destroy();
+                            }
+                            // Restore new body for promise wrapper's identity check
+                            if (is.nodeStream(bodyAfterHooks) && (bodyAfterHooks.readableEnded || bodyAfterHooks.destroyed)) {
+                                throw new TypeError('The reassigned stream body must be readable. Ensure you provide a fresh, readable stream in the beforeRetry hook.');
+                            }
+                            this.options.body = bodyAfterHooks;
                         }
-                        // Restore new body for promise wrapper's identity check
-                        // We bypass the setter because it validates stream.readable (which fails for destroyed request)
-                        // Type assertion is necessary here to access private _internals without exposing internal API
-                        if (is.nodeStream(bodyAfterHooks) && (bodyAfterHooks.readableEnded || bodyAfterHooks.destroyed)) {
-                            throw new TypeError('The reassigned stream body must be readable. Ensure you provide a fresh, readable stream in the beforeRetry hook.');
+                        else {
+                            // Body wasn't reassigned - use normal destroy flow which handles body cleanup
+                            this.destroy();
+                            // Note: We do NOT restore the body reference here. The stream was destroyed by _destroy()
+                            // and should not be accessed. The promise wrapper will see that body identity hasn't changed
+                            // and will detect it's a consumed stream, which is the correct behavior.
                         }
-                        this.options._internals.body = bodyAfterHooks;
                     }
-                    else {
-                        // Body wasn't reassigned - use normal destroy flow which handles body cleanup
-                        this.destroy();
-                        // Note: We do NOT restore the body reference here. The stream was destroyed by _destroy()
-                        // and should not be accessed. The promise wrapper will see that body identity hasn't changed
-                        // and will detect it's a consumed stream, which is the correct behavior.
+                    catch (error_) {
+                        const normalizedError = normalizeError(error_);
+                        void this._error(new RequestError(normalizedError.message, normalizedError, this));
+                        return;
                     }
                     // Publish retry event
                     publishRetry({
@@ -357,6 +436,17 @@ export default class Request extends Duplex {
             let data;
             while ((data = response.read()) !== null) {
                 this._downloadedSize += data.length; // eslint-disable-line @typescript-eslint/restrict-plus-operands
+                if (this._incrementalDecode) {
+                    try {
+                        const decodedChunk = typeof data === 'string' ? data : this._incrementalDecode.decoder.decode(data, { stream: true });
+                        if (decodedChunk.length > 0) {
+                            this._incrementalDecode.chunks.push(decodedChunk);
+                        }
+                    }
+                    catch {
+                        this._incrementalDecode = undefined;
+                    }
+                }
                 const progress = this.downloadProgress;
                 if (progress.percent < 1) {
                     this.emit('downloadProgress', progress);
@@ -378,22 +468,26 @@ export default class Request extends Duplex {
     }
     _final(callback) {
         const endRequest = () => {
+            if (this._skipRequestEndInFinal) {
+                this._skipRequestEndInFinal = false;
+                callback();
+                return;
+            }
+            const request = this._request;
             // We need to check if `this._request` is present,
             // because it isn't when we use cache.
-            if (!this._request || this._request.destroyed) {
+            if (!request || request.destroyed) {
                 callback();
                 return;
             }
-            this._request.end((error) => {
+            request.end((error) => {
                 // The request has been destroyed before `_final` finished.
                 // See https://github.com/nodejs/node/issues/39356
-                if (this._request?._writableState?.errored) {
+                if (request?._writableState?.errored) {
                     return;
                 }
                 if (!error) {
-                    this._bodySize = this._uploadedSize;
-                    this.emit('uploadProgress', this.uploadProgress);
-                    this._request?.emit('upload-complete');
+                    this._emitUploadComplete(request);
                 }
                 callback(error);
             });
@@ -409,9 +503,9 @@ export default class Request extends Duplex {
         this._stopReading = true;
         this.flush = async () => { };
         // Prevent further retries
-        this._stopRetry();
-        this._cancelTimeouts();
-        this._removeListeners();
+        this._stopRetry?.();
+        this._cancelTimeouts?.();
+        this._abortListenerDisposer?.[Symbol.dispose]();
         if (this.options) {
             const { body } = this.options;
             if (is.nodeStream(body)) {
@@ -459,6 +553,13 @@ export default class Request extends Duplex {
         super.unpipe(destination);
         return this;
     }
+    _shouldIncrementallyDecodeBody() {
+        const { responseType, encoding } = this.options;
+        return Boolean(this._noPipe)
+            && (responseType === 'text' || responseType === 'json')
+            && isUtf8Encoding(encoding)
+            && typeof globalThis.TextDecoder === 'function';
+    }
     _checkContentLengthMismatch() {
         if (this.options.strictContentLength && this._expectedContentLength !== undefined) {
             // Use compressed bytes count when available (for compressed responses),
@@ -477,7 +578,7 @@ export default class Request extends Duplex {
     }
     async _finalizeBody() {
         const { options } = this;
-        const { headers } = options;
+        const headers = options.getInternalHeaders();
         const isForm = !is.undefined(options.form);
         // eslint-disable-next-line @typescript-eslint/naming-convention
         const isJSON = !is.undefined(options.json);
@@ -490,20 +591,16 @@ export default class Request extends Duplex {
             // Serialize body
             const noContentType = !is.string(headers['content-type']);
             if (isBody) {
-                // Body is spec-compliant FormData
-                if (isFormDataLike(options.body)) {
-                    const encoder = new FormDataEncoder(options.body);
+                // Native FormData
+                if (options.body instanceof FormData) {
+                    const response = new Response(options.body);
                     if (noContentType) {
-                        headers['content-type'] = encoder.headers['Content-Type'];
+                        headers['content-type'] = response.headers.get('content-type') ?? 'multipart/form-data';
                     }
-                    if ('Content-Length' in encoder.headers) {
-                        headers['content-length'] = encoder.headers['Content-Length'];
-                    }
-                    options.body = encoder.encode();
+                    options.body = response.body;
                 }
-                // Special case for https://github.com/form-data/form-data
-                if (isFormData(options.body) && noContentType) {
-                    headers['content-type'] = `multipart/form-data; boundary=${options.body.getBoundary()}`;
+                else if (Object.prototype.toString.call(options.body) === '[object FormData]') {
+                    throw new TypeError('Non-native FormData is not supported. Use globalThis.FormData instead.');
                 }
             }
             else if (isForm) {
@@ -522,7 +619,7 @@ export default class Request extends Duplex {
                 options.json = undefined;
                 options.body = options.stringifyJson(json);
             }
-            const uploadBodySize = await getBodySize(options.body, options.headers);
+            const uploadBodySize = getBodySize(options.body, headers);
             // See https://tools.ietf.org/html/rfc7230#section-3.3.2
             // A user agent SHOULD send a Content-Length in a request message when
             // no Transfer-Encoding is sent and the request method defines a meaning
@@ -536,8 +633,8 @@ export default class Request extends Duplex {
                 headers['content-length'] = String(uploadBodySize);
             }
         }
-        if (options.responseType === 'json' && !('accept' in options.headers)) {
-            options.headers.accept = 'application/json';
+        if (options.responseType === 'json' && !('accept' in headers)) {
+            headers.accept = 'application/json';
         }
         this._bodySize = Number(headers['content-length']) || undefined;
     }
@@ -548,9 +645,12 @@ export default class Request extends Duplex {
         }
         const { options } = this;
         const { url } = options;
-        this._nativeResponse = response;
+        const nativeResponse = response;
         const statusCode = response.statusCode;
         const { method } = options;
+        const redirectLocationHeader = response.headers.location;
+        const redirectLocation = Array.isArray(redirectLocationHeader) ? redirectLocationHeader[0] : redirectLocationHeader;
+        const isRedirect = Boolean(redirectLocation && redirectCodes.has(statusCode));
         // Skip decompression for responses that must not have bodies per RFC 9110:
         // - HEAD responses (any status code)
         // - 1xx (Informational): 100, 101, 102, 103, etc.
@@ -562,30 +662,46 @@ export default class Request extends Duplex {
             || statusCode === 204
             || statusCode === 205
             || statusCode === 304;
-        if (options.decompress && !hasNoBody) {
+        const prepareResponse = (response) => {
+            if (!Object.hasOwn(response, 'headers')) {
+                Object.defineProperty(response, 'headers', {
+                    value: response.headers,
+                    enumerable: true,
+                    writable: true,
+                    configurable: true,
+                });
+            }
+            response.statusMessage ||= http.STATUS_CODES[statusCode]; // eslint-disable-line @typescript-eslint/prefer-nullish-coalescing -- The status message can be empty.
+            response.url = stripUrlAuth(options.url);
+            response.requestUrl = this.requestUrl;
+            response.redirectUrls = this.redirectUrls;
+            response.request = this;
+            response.isFromCache = nativeResponse.fromCache ?? false;
+            response.ip = this.ip;
+            response.retryCount = this.retryCount;
+            response.ok = isResponseOk(response);
+            return response;
+        };
+        let typedResponse = prepareResponse(response);
+        // Redirect responses that will be followed are drained raw. Decompressing them can
+        // turn an irrelevant redirect body into a client-side failure or decompression DoS.
+        const shouldFollowRedirect = isRedirect && (typeof options.followRedirect === 'function' ? options.followRedirect(typedResponse) : options.followRedirect);
+        if (options.decompress && !hasNoBody && !shouldFollowRedirect) {
             // When strictContentLength is enabled, track compressed bytes by listening to
             // the native response's data events before decompression
             if (options.strictContentLength) {
                 this._compressedBytesCount = 0;
-                this._nativeResponse.on('data', (chunk) => {
+                nativeResponse.on('data', (chunk) => {
                     this._compressedBytesCount += byteLength(chunk);
                 });
             }
             response = decompressResponse(response);
+            typedResponse = prepareResponse(response);
         }
-        const typedResponse = response;
-        typedResponse.statusMessage = typedResponse.statusMessage || http.STATUS_CODES[statusCode]; // eslint-disable-line @typescript-eslint/prefer-nullish-coalescing -- The status message can be empty.
-        typedResponse.url = options.url.toString();
-        typedResponse.requestUrl = this.requestUrl;
-        typedResponse.redirectUrls = this.redirectUrls;
-        typedResponse.request = this;
-        typedResponse.isFromCache = this._nativeResponse.fromCache ?? false;
-        typedResponse.ip = this.ip;
-        typedResponse.retryCount = this.retryCount;
-        typedResponse.ok = isResponseOk(typedResponse);
-        this._isFromCache = typedResponse.isFromCache;
         this._responseSize = Number(response.headers['content-length']) || undefined;
         this.response = typedResponse;
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        this._incrementalDecode = this._shouldIncrementallyDecodeBody() ? { decoder: new globalThis.TextDecoder('utf8', { ignoreBOM: true }), chunks: [] } : undefined;
         // Publish response start event
         publishResponseStart({
             requestId: this._requestId,
@@ -596,9 +712,6 @@ export default class Request extends Duplex {
         });
         response.once('error', (error) => {
             this._aborted = true;
-            // Force clean-up, because some packages don't do this.
-            // TODO: Fix decompress-response
-            response.destroy();
             this._beforeError(new ReadError(error, this));
         });
         response.once('aborted', () => {
@@ -612,11 +725,15 @@ export default class Request extends Duplex {
                 }, this));
             }
         });
+        const noPipeCookieJarRawBodyPromise = this._noPipe
+            && is.object(options.cookieJar)
+            && !isRedirect
+            ? this._setRawBody(response)
+            : undefined;
         const rawCookies = response.headers['set-cookie'];
         if (is.object(options.cookieJar) && rawCookies) {
             let promises = rawCookies.map(async (rawCookie) => options.cookieJar.setCookie(rawCookie, url.toString()));
             if (options.ignoreInvalidCookies) {
-                // eslint-disable-next-line @typescript-eslint/no-floating-promises
                 promises = promises.map(async (promise) => {
                     try {
                         await promise;
@@ -628,7 +745,7 @@ export default class Request extends Duplex {
                 await Promise.all(promises);
             }
             catch (error) {
-                this._beforeError(error);
+                this._beforeError(normalizeError(error));
                 return;
             }
         }
@@ -636,88 +753,122 @@ export default class Request extends Duplex {
         if (this.isAborted) {
             return;
         }
-        if (response.headers.location && redirectCodes.has(statusCode)) {
+        if (shouldFollowRedirect) {
             // We're being redirected, we don't care about the response.
             // It'd be best to abort the request, but we can't because
             // we would have to sacrifice the TCP connection. We don't want that.
-            const shouldFollow = typeof options.followRedirect === 'function' ? options.followRedirect(typedResponse) : options.followRedirect;
-            if (shouldFollow) {
-                response.resume();
-                this._cancelTimeouts();
-                this._unproxyEvents();
-                if (this.redirectUrls.length >= options.maxRedirects) {
-                    this._beforeError(new MaxRedirectsError(this));
+            response.resume();
+            this._cancelTimeouts?.();
+            this._unproxyEvents?.();
+            if (this.redirectUrls.length >= options.maxRedirects) {
+                this._beforeError(new MaxRedirectsError(this));
+                return;
+            }
+            this._request = undefined;
+            // Reset progress for the new request.
+            this._downloadedSize = 0;
+            this._uploadedSize = 0;
+            const updatedOptions = new Options(undefined, undefined, this.options);
+            try {
+                // We need this in order to support UTF-8
+                const redirectBuffer = Buffer.from(redirectLocation, 'binary').toString();
+                const redirectUrl = new URL(redirectBuffer, url);
+                const currentUnixSocketPath = getUnixSocketPath(url);
+                const redirectUnixSocketPath = getUnixSocketPath(redirectUrl);
+                if (redirectUrl.protocol === 'unix:' && redirectUnixSocketPath === undefined) {
+                    this._beforeError(new RequestError('Cannot redirect to UNIX socket', {}, this));
+                    return;
+                }
+                // Relative redirects on the same socket are fine, but a redirect must not switch to a different local socket.
+                if (redirectUnixSocketPath !== undefined && currentUnixSocketPath !== redirectUnixSocketPath) {
+                    this._beforeError(new RequestError('Cannot redirect to UNIX socket', {}, this));
                     return;
                 }
-                this._request = undefined;
-                // Reset download progress for the new request
-                this._downloadedSize = 0;
-                const updatedOptions = new Options(undefined, undefined, this.options);
+                // Redirecting to a different site, clear sensitive data.
+                // For UNIX sockets, different socket paths are also different origins.
+                const isDifferentOrigin = redirectUrl.origin !== url.origin
+                    || currentUnixSocketPath !== redirectUnixSocketPath;
                 const serverRequestedGet = statusCode === 303 && updatedOptions.method !== 'GET' && updatedOptions.method !== 'HEAD';
+                // Avoid forwarding a POST body to a different origin on historical 301/302 redirects.
+                const crossOriginRequestedGet = isDifferentOrigin
+                    && (statusCode === 301 || statusCode === 302)
+                    && updatedOptions.method === 'POST';
                 const canRewrite = statusCode !== 307 && statusCode !== 308;
                 const userRequestedGet = updatedOptions.methodRewriting && canRewrite;
-                if (serverRequestedGet || userRequestedGet) {
+                const shouldDropBody = serverRequestedGet || crossOriginRequestedGet || userRequestedGet;
+                if (shouldDropBody) {
                     updatedOptions.method = 'GET';
-                    updatedOptions.body = undefined;
-                    updatedOptions.json = undefined;
-                    updatedOptions.form = undefined;
-                    delete updatedOptions.headers['content-length'];
+                    this._dropBody(updatedOptions);
                 }
-                try {
-                    // We need this in order to support UTF-8
-                    const redirectBuffer = Buffer.from(response.headers.location, 'binary').toString();
-                    const redirectUrl = new URL(redirectBuffer, url);
-                    if (!isUnixSocketURL(url) && isUnixSocketURL(redirectUrl)) {
-                        this._beforeError(new RequestError('Cannot redirect to UNIX socket', {}, this));
-                        return;
-                    }
-                    // Redirecting to a different site, clear sensitive data.
-                    // For UNIX sockets, different socket paths are also different origins.
-                    const isDifferentOrigin = redirectUrl.hostname !== url.hostname
-                        || redirectUrl.port !== url.port
-                        || getUnixSocketPath(url) !== getUnixSocketPath(redirectUrl);
-                    if (isDifferentOrigin) {
-                        if ('host' in updatedOptions.headers) {
-                            delete updatedOptions.headers.host;
-                        }
-                        if ('cookie' in updatedOptions.headers) {
-                            delete updatedOptions.headers.cookie;
-                        }
-                        if ('authorization' in updatedOptions.headers) {
-                            delete updatedOptions.headers.authorization;
-                        }
-                        if (updatedOptions.username || updatedOptions.password) {
-                            updatedOptions.username = '';
-                            updatedOptions.password = '';
-                        }
-                    }
-                    else {
-                        redirectUrl.username = updatedOptions.username;
-                        redirectUrl.password = updatedOptions.password;
-                    }
-                    this.redirectUrls.push(redirectUrl);
-                    updatedOptions.url = redirectUrl;
+                if (isDifferentOrigin) {
+                    // Also strip body on cross-origin redirects to prevent data leakage.
+                    // 301/302 POST already drops the body (converted to GET above).
+                    // 307/308 preserve the method per RFC, but the body must not be
+                    // forwarded to a different origin.
+                    // Strip credentials embedded in the redirect URL itself
+                    // to prevent a malicious server from injecting auth to third parties.
+                    this._stripCrossOriginState(updatedOptions, redirectUrl, shouldDropBody);
+                }
+                else {
+                    redirectUrl.username = updatedOptions.username;
+                    redirectUrl.password = updatedOptions.password;
+                }
+                updatedOptions.url = redirectUrl;
+                this.redirectUrls.push(redirectUrl);
+                const preHookState = isDifferentOrigin
+                    ? undefined
+                    : {
+                        ...snapshotCrossOriginState(updatedOptions),
+                        url: new URL(updatedOptions.url),
+                    };
+                const changedState = await updatedOptions.trackStateMutations(async (changedState) => {
                     for (const hook of updatedOptions.hooks.beforeRedirect) {
                         // eslint-disable-next-line no-await-in-loop
                         await hook(updatedOptions, typedResponse);
                     }
-                    // Publish redirect event
-                    publishRedirect({
-                        requestId: this._requestId,
-                        fromUrl: url.toString(),
-                        toUrl: redirectUrl.toString(),
-                        statusCode,
-                    });
-                    this.emit('redirect', updatedOptions, typedResponse);
-                    this.options = updatedOptions;
-                    await this._makeRequest();
-                }
-                catch (error) {
-                    this._beforeError(error);
-                    return;
+                    return changedState;
+                });
+                // If a beforeRedirect hook changed the URL to a different origin,
+                // strip sensitive headers that were preserved for the original origin.
+                // When isDifferentOrigin was already true, headers were already stripped above.
+                if (!isDifferentOrigin) {
+                    const state = preHookState;
+                    const hookUrl = updatedOptions.url;
+                    if (!isSameOrigin(state.url, hookUrl)) {
+                        this._stripUnchangedCrossOriginState(updatedOptions, hookUrl, shouldDropBody, {
+                            headers: state.headers,
+                            username: state.username,
+                            password: state.password,
+                            body: state.body,
+                            json: state.json,
+                            form: state.form,
+                            bodySnapshot: state.bodySnapshot,
+                            jsonSnapshot: state.jsonSnapshot,
+                            formSnapshot: state.formSnapshot,
+                            changedState,
+                            preserveUsername: hasExplicitCredentialInUrlChange(changedState, hookUrl, 'username')
+                                || isCrossOriginCredentialChanged(state.url, hookUrl, 'username'),
+                            preservePassword: hasExplicitCredentialInUrlChange(changedState, hookUrl, 'password')
+                                || isCrossOriginCredentialChanged(state.url, hookUrl, 'password'),
+                        });
+                    }
                 }
+                // Publish redirect event
+                publishRedirect({
+                    requestId: this._requestId,
+                    fromUrl: url.toString(),
+                    toUrl: (updatedOptions.url).toString(),
+                    statusCode,
+                });
+                this.emit('redirect', updatedOptions, typedResponse);
+                this.options = updatedOptions;
+                await this._makeRequest();
+            }
+            catch (error) {
+                this._beforeError(normalizeError(error));
                 return;
             }
+            return;
         }
         // `HTTPError`s always have `error.response.body` defined.
         // Therefore, we cannot retry if `options.throwHttpErrors` is false.
@@ -727,13 +878,15 @@ export default class Request extends Duplex {
             this._beforeError(new HTTPError(typedResponse));
             return;
         }
+        // `decompressResponse` wraps the response stream when it decompresses,
+        // so `response !== nativeResponse` indicates decompression happened.
+        const wasDecompressed = response !== nativeResponse;
         // Store the expected content-length from the native response for validation.
         // This is the content-length before decompression, which is what actually gets transferred.
         // Skip storing for responses that shouldn't have bodies per RFC 9110.
         // When decompression occurs, only store if strictContentLength is enabled.
-        const wasDecompressed = response !== this._nativeResponse;
         if (!hasNoBody && (!wasDecompressed || options.strictContentLength)) {
-            const contentLengthHeader = this._nativeResponse.headers['content-length'];
+            const contentLengthHeader = nativeResponse.headers['content-length'];
             if (contentLengthHeader !== undefined) {
                 const expectedLength = Number(contentLengthHeader);
                 if (!Number.isNaN(expectedLength) && expectedLength >= 0) {
@@ -742,7 +895,12 @@ export default class Request extends Duplex {
             }
         }
         // Set up end listener AFTER redirect check to avoid emitting progress for redirect responses
-        response.once('end', () => {
+        let responseEndHandled = false;
+        const handleResponseEnd = () => {
+            if (responseEndHandled) {
+                return;
+            }
+            responseEndHandled = true;
             // Validate content-length if it was provided
             // Per RFC 9112: "If the sender closes the connection before the indicated number
             // of octets are received, the recipient MUST consider the message to be incomplete"
@@ -760,7 +918,8 @@ export default class Request extends Duplex {
                 timings: this.timings,
             });
             this.push(null);
-        });
+        };
+        response.once('end', handleResponseEnd);
         this.emit('downloadProgress', this.downloadProgress);
         response.on('readable', () => {
             if (this._triggerRead) {
@@ -774,7 +933,13 @@ export default class Request extends Duplex {
             response.pause();
         });
         if (this._noPipe) {
-            const success = await this._setRawBody();
+            const captureFromResponse = response.readableEnded || noPipeCookieJarRawBodyPromise !== undefined;
+            const success = noPipeCookieJarRawBodyPromise
+                ? await noPipeCookieJarRawBodyPromise
+                : await this._setRawBody(captureFromResponse ? response : this);
+            if (captureFromResponse) {
+                handleResponseEnd();
+            }
             if (success) {
                 this.emit('response', response);
             }
@@ -785,10 +950,6 @@ export default class Request extends Duplex {
             if (destination.headersSent) {
                 continue;
             }
-            // Check if decompression actually occurred by comparing stream objects.
-            // decompressResponse wraps the response stream when it decompresses,
-            // so response !== this._nativeResponse indicates decompression happened.
-            const wasDecompressed = response !== this._nativeResponse;
             for (const key in response.headers) {
                 if (Object.hasOwn(response.headers, key)) {
                     const value = response.headers[key];
@@ -807,21 +968,39 @@ export default class Request extends Duplex {
         }
     }
     async _setRawBody(from = this) {
-        if (from.readableEnded) {
-            return false;
-        }
         try {
             // Errors are emitted via the `error` event
             const fromArray = await from.toArray();
-            const rawBody = isBuffer(fromArray.at(0)) ? Buffer.concat(fromArray) : Buffer.from(fromArray.join(''));
+            const hasNonStringChunk = fromArray.some(chunk => typeof chunk !== 'string');
+            const rawBody = hasNonStringChunk
+                ? concatUint8Arrays(fromArray.map(chunk => typeof chunk === 'string' ? stringToUint8Array(chunk) : chunk))
+                : stringToUint8Array(fromArray.join(''));
+            const shouldUseIncrementalDecodedBody = from === this && this._incrementalDecode !== undefined;
             // On retry Request is destroyed with no error, therefore the above will successfully resolve.
-            // So in order to check if this was really successfull, we need to check if it has been properly ended.
-            if (!this.isAborted) {
+            // So in order to check if this was really successful, we need to check if it has been properly ended.
+            if (!this.isAborted && this.response) {
                 this.response.rawBody = rawBody;
+                if (from !== this) {
+                    this._downloadedSize = rawBody.byteLength;
+                }
+                if (shouldUseIncrementalDecodedBody) {
+                    try {
+                        const { decoder, chunks } = this._incrementalDecode;
+                        const finalDecodedChunk = decoder.decode();
+                        if (finalDecodedChunk.length > 0) {
+                            chunks.push(finalDecodedChunk);
+                        }
+                        cacheDecodedBody(this.response, chunks.join(''));
+                    }
+                    catch { }
+                }
                 return true;
             }
         }
         catch { }
+        finally {
+            this._incrementalDecode = undefined;
+        }
         return false;
     }
     async _onResponse(response) {
@@ -830,7 +1009,7 @@ export default class Request extends Duplex {
         }
         catch (error) {
             /* istanbul ignore next: better safe than sorry */
-            this._beforeError(error);
+            this._beforeError(normalizeError(error));
         }
     }
     _onRequest(request) {
@@ -839,7 +1018,7 @@ export default class Request extends Duplex {
         // Publish request start event
         publishRequestStart({
             requestId: this._requestId,
-            url: url?.toString() ?? '',
+            url: getSanitizedUrl(this.options),
             method: options.method,
             headers: options.headers,
         });
@@ -857,32 +1036,80 @@ export default class Request extends Duplex {
                 socket.removeAllListeners('timeout');
             });
         }
+        let lastRequestError;
         const responseEventName = options.cache ? 'cacheableResponse' : 'response';
         request.once(responseEventName, (response) => {
             void this._onResponse(response);
         });
-        request.once('error', (error) => {
+        const emitRequestError = (error) => {
             this._aborted = true;
             // Force clean-up, because some packages (e.g. nock) don't do this.
             request.destroy();
-            error = error instanceof TimedOutTimeoutError ? new TimeoutError(error, this.timings, this) : new RequestError(error.message, error, this);
-            this._beforeError(error);
+            const wrappedError = error instanceof TimedOutTimeoutError ? new TimeoutError(error, this.timings, this) : new RequestError(error.message, error, this);
+            this._beforeError(wrappedError);
+        };
+        request.once('error', (error) => {
+            lastRequestError = error;
+            // Ignore errors from requests superseded by a redirect.
+            if (this._request !== request) {
+                return;
+            }
+            /*
+            Transient write errors (EPIPE, ECONNRESET) often fire during redirects when the
+            server closes the connection after sending the redirect response. Defer by one
+            microtask to let the response event make the request stale.
+            */
+            if (isTransientWriteError(error)) {
+                queueMicrotask(() => {
+                    if (this._isRequestStale(request)) {
+                        return;
+                    }
+                    emitRequestError(error);
+                });
+                return;
+            }
+            emitRequestError(error);
         });
+        if (!options.cache) {
+            request.once('close', () => {
+                if (this._request !== request || Boolean(request.res) || this._stopReading) {
+                    return;
+                }
+                this._beforeError(lastRequestError ?? new ReadError({
+                    name: 'Error',
+                    message: 'The server aborted pending request',
+                    code: 'ECONNRESET',
+                }, this));
+            });
+        }
         this._unproxyEvents = proxyEvents(request, this, proxiedRequestEvents);
         this._request = request;
         this.emit('uploadProgress', this.uploadProgress);
         this._sendBody();
         this.emit('request', request);
     }
-    async _asyncWrite(chunk) {
+    _isRequestStale(request) {
+        return this._request !== request || Boolean(request.res) || request.destroyed || request.writableEnded;
+    }
+    async _asyncWrite(chunk, request = this) {
         return new Promise((resolve, reject) => {
-            super.write(chunk, error => {
+            if (request === this) {
+                super.write(chunk, error => {
+                    if (error) {
+                        reject(error);
+                        return;
+                    }
+                    resolve();
+                });
+                return;
+            }
+            this._writeRequest(chunk, undefined, error => {
                 if (error) {
                     reject(error);
                     return;
                 }
                 resolve();
-            });
+            }, request);
         });
     }
     _sendBody() {
@@ -894,27 +1121,41 @@ export default class Request extends Duplex {
         }
         else if (is.buffer(body)) {
             // Buffer should be sent directly without conversion
-            this._writeRequest(body, undefined, () => { });
-            currentRequest.end();
+            this._writeBodyInChunks(body, currentRequest);
         }
         else if (is.typedArray(body)) {
             // Typed arrays should be treated like buffers, not iterated over
             // Create a Uint8Array view over the data (Node.js streams accept Uint8Array)
             const typedArray = body;
             const uint8View = new Uint8Array(typedArray.buffer, typedArray.byteOffset, typedArray.byteLength);
-            this._writeRequest(uint8View, undefined, () => { });
-            currentRequest.end();
+            this._writeBodyInChunks(uint8View, currentRequest);
         }
         else if (is.asyncIterable(body) || (is.iterable(body) && !is.string(body) && !isBuffer(body))) {
             (async () => {
+                const isInitialRequest = currentRequest === this;
                 try {
                     for await (const chunk of body) {
-                        await this._asyncWrite(chunk);
+                        if (this.options.body !== body) {
+                            return;
+                        }
+                        await this._asyncWrite(chunk, currentRequest);
+                        if (this.options.body !== body) {
+                            return;
+                        }
+                    }
+                    if (this.options.body === body) {
+                        if (isInitialRequest) {
+                            super.end();
+                            return;
+                        }
+                        await this._endWritableRequest(currentRequest);
                     }
-                    super.end();
                 }
                 catch (error) {
-                    this._beforeError(error);
+                    if (this.options.body !== body) {
+                        return;
+                    }
+                    this._beforeError(normalizeError(error));
                 }
             })();
         }
@@ -926,8 +1167,205 @@ export default class Request extends Duplex {
             }
         }
         else {
-            this._writeRequest(body, undefined, () => { });
-            currentRequest.end();
+            // Handles string bodies (from json/form options).
+            this._writeBodyInChunks(stringToUint8Array(body), currentRequest);
+        }
+    }
+    /*
+    Write a body buffer in chunks to enable granular `uploadProgress` events.
+
+    Without chunking, string/Uint8Array/TypedArray bodies are written in a single call, causing `uploadProgress` to only emit 0% and 100% with nothing in between.
+
+    The 64 KB chunk size matches Node.js fs stream defaults.
+    */
+    _writeBodyInChunks(buffer, currentRequest) {
+        const isInitialRequest = currentRequest === this;
+        (async () => {
+            let request;
+            try {
+                request = isInitialRequest ? this._request : currentRequest;
+                const activeRequest = request;
+                if (!activeRequest) {
+                    if (isInitialRequest) {
+                        super.end();
+                    }
+                    return;
+                }
+                if (activeRequest.destroyed) {
+                    return;
+                }
+                await this._writeChunksToRequest(buffer, activeRequest);
+                if (this._isRequestStale(activeRequest)) {
+                    this._finalizeStaleChunkedWrite(activeRequest, isInitialRequest);
+                    return;
+                }
+                if (isInitialRequest) {
+                    super.end();
+                    return;
+                }
+                await this._endWritableRequest(activeRequest);
+            }
+            catch (error) {
+                const normalizedError = normalizeError(error);
+                // Transient write errors (EPIPE, ECONNRESET) are handled by the request-level
+                // error and close handlers. For initial redirected writes, still finalize
+                // writable state once the stale transition becomes observable.
+                if (isTransientWriteError(normalizedError)) {
+                    if (isInitialRequest && request) {
+                        const initialRequest = request;
+                        let didFinalize = false;
+                        const finalizeIfStale = () => {
+                            if (didFinalize || !this._isRequestStale(initialRequest)) {
+                                return;
+                            }
+                            didFinalize = true;
+                            this._finalizeStaleChunkedWrite(initialRequest, true);
+                        };
+                        finalizeIfStale();
+                        if (!didFinalize) {
+                            initialRequest.once('response', finalizeIfStale);
+                            queueMicrotask(finalizeIfStale);
+                        }
+                    }
+                    return;
+                }
+                if (!isInitialRequest && this._isRequestStale(currentRequest)) {
+                    return;
+                }
+                this._beforeError(normalizedError);
+            }
+        })();
+    }
+    _finalizeStaleChunkedWrite(request, isInitialRequest) {
+        if (!request.destroyed && !request.writableEnded) {
+            request.destroy();
+        }
+        if (isInitialRequest) {
+            // Finalize writable state without ending the active redirected request.
+            this._skipRequestEndInFinal = true;
+            super.end();
+        }
+    }
+    _emitUploadComplete(request) {
+        this._bodySize = this._uploadedSize;
+        this.emit('uploadProgress', this.uploadProgress);
+        request.emit('upload-complete');
+    }
+    async _endWritableRequest(request) {
+        await new Promise((resolve, reject) => {
+            request.end((error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                if (this._request === request && !request.destroyed) {
+                    this._emitUploadComplete(request);
+                }
+                resolve();
+            });
+        });
+    }
+    _stripCrossOriginState(options, urlToClear, bodyAlreadyDropped) {
+        for (const header of crossOriginStripHeaders) {
+            options.deleteInternalHeader(header);
+        }
+        options.username = '';
+        options.password = '';
+        urlToClear.username = '';
+        urlToClear.password = '';
+        if (!bodyAlreadyDropped) {
+            this._dropBody(options);
+        }
+    }
+    _stripUnchangedCrossOriginState(options, urlToClear, bodyAlreadyDropped, state) {
+        const headers = options.getInternalHeaders();
+        for (const header of crossOriginStripHeaders) {
+            if (!state.changedState.has(header) && headers[header] === state.headers[header]) {
+                options.deleteInternalHeader(header);
+            }
+        }
+        if (!state.preserveUsername) {
+            options.username = '';
+            urlToClear.username = '';
+        }
+        if (!state.preservePassword) {
+            options.password = '';
+            urlToClear.password = '';
+        }
+        if (!bodyAlreadyDropped
+            && !state.changedState.has('body')
+            && !state.changedState.has('json')
+            && !state.changedState.has('form')
+            && isBodyUnchanged(options, state)) {
+            this._dropBody(options);
+        }
+    }
+    _dropBody(updatedOptions) {
+        const { body } = this.options;
+        const hadOptionBody = !is.undefined(body) || !is.undefined(this.options.json) || !is.undefined(this.options.form);
+        this.options.clearBody();
+        if (is.nodeStream(body)) {
+            body.off('error', this._onBodyError);
+            body.unpipe();
+            body.on('error', noop);
+            body.destroy();
+        }
+        else if (is.asyncIterable(body) || (is.iterable(body) && !is.string(body) && !isBuffer(body))) {
+            const iterableBody = body;
+            // Signal the iterator to clean up, but don't await it:
+            // the for-await loop in _sendBody exits via the options.body sentinel,
+            // and awaiting return() would deadlock when next() is pending.
+            if (typeof iterableBody.return === 'function') {
+                try {
+                    const result = iterableBody.return();
+                    if (result instanceof Promise) {
+                        // eslint-disable-next-line promise/prefer-await-to-then
+                        result.catch(noop);
+                    }
+                }
+                catch { }
+            }
+        }
+        else if (!hadOptionBody && !this.writableEnded) {
+            this._skipRequestEndInFinal = true;
+            super.end();
+        }
+        updatedOptions.clearBody();
+        this._bodySize = undefined;
+    }
+    _onBodyError = (error) => {
+        if (this._flushed) {
+            this._beforeError(new UploadError(error, this));
+        }
+        else {
+            this.flush = async () => {
+                this.flush = async () => { };
+                this._beforeError(new UploadError(error, this));
+            };
+        }
+    };
+    async _writeChunksToRequest(buffer, request) {
+        const chunkSize = 65_536; // 64 KB
+        const isStale = () => this._isRequestStale(request);
+        for (const part of chunk(buffer, chunkSize)) {
+            if (isStale()) {
+                return;
+            }
+            // eslint-disable-next-line no-await-in-loop
+            await new Promise((resolve, reject) => {
+                this._writeRequest(part, undefined, error => {
+                    if (isStale()) {
+                        resolve();
+                        return;
+                    }
+                    if (error) {
+                        reject(error);
+                    }
+                    else {
+                        setImmediate(resolve);
+                    }
+                }, request);
+            });
         }
     }
     _prepareCache(cache) {
@@ -945,59 +1383,62 @@ export default class Request extends Duplex {
             Hooks use direct mutation - they can modify response.headers, response.statusCode, etc.
             Mutations take effect immediately and determine what gets cached.
             */
-            const wrappedHandler = handler ? (response) => {
-                const { beforeCacheHooks, gotRequest } = requestOptions;
-                // Early return if no hooks - cache the original response
-                if (!beforeCacheHooks || beforeCacheHooks.length === 0) {
-                    handler(response);
-                    return;
-                }
-                try {
-                    // Call each beforeCache hook with the response
-                    // Hooks can directly mutate the response - mutations take effect immediately
-                    for (const hook of beforeCacheHooks) {
-                        const result = hook(response);
-                        if (result === false) {
-                            // Prevent caching by adding no-cache headers
-                            // Mutate the response directly to add headers
-                            response.headers['cache-control'] = 'no-cache, no-store, must-revalidate';
-                            response.headers.pragma = 'no-cache';
-                            response.headers.expires = '0';
-                            handler(response);
-                            // Don't call remaining hooks - we've decided not to cache
-                            return;
-                        }
-                        if (is.promise(result)) {
-                            // BeforeCache hooks must be synchronous because cacheable-request's handler is synchronous
-                            throw new TypeError('beforeCache hooks must be synchronous. The hook returned a Promise, but this hook must return synchronously. If you need async logic, use beforeRequest hook instead.');
-                        }
-                        if (result !== undefined) {
-                            // Hooks should return false or undefined only
-                            // Mutations work directly - no need to return the response
-                            throw new TypeError('beforeCache hook must return false or undefined. To modify the response, mutate it directly.');
+            const wrappedHandler = handler
+                ? (response) => {
+                    const { beforeCacheHooks, gotRequest } = requestOptions;
+                    // Early return if no hooks - cache the original response
+                    if (!beforeCacheHooks || beforeCacheHooks.length === 0) {
+                        handler(response);
+                        return;
+                    }
+                    try {
+                        // Call each beforeCache hook with the response
+                        // Hooks can directly mutate the response - mutations take effect immediately
+                        for (const hook of beforeCacheHooks) {
+                            const result = hook(response);
+                            if (result === false) {
+                                // Prevent caching by adding no-cache headers
+                                // Mutate the response directly to add headers
+                                response.headers['cache-control'] = 'no-cache, no-store, must-revalidate';
+                                response.headers.pragma = 'no-cache';
+                                response.headers.expires = '0';
+                                handler(response);
+                                // Don't call remaining hooks - we've decided not to cache
+                                return;
+                            }
+                            if (is.promise(result)) {
+                                // BeforeCache hooks must be synchronous because cacheable-request's handler is synchronous
+                                throw new TypeError('beforeCache hooks must be synchronous. The hook returned a Promise, but this hook must return synchronously. If you need async logic, use beforeRequest hook instead.');
+                            }
+                            if (result !== undefined) {
+                                // Hooks should return false or undefined only
+                                // Mutations work directly - no need to return the response
+                                throw new TypeError('beforeCache hook must return false or undefined. To modify the response, mutate it directly.');
+                            }
+                            // Else: void/undefined = continue
                         }
-                        // Else: void/undefined = continue
                     }
-                }
-                catch (error) {
-                    // Convert hook errors to RequestError and propagate
-                    // This is consistent with how other hooks handle errors
-                    if (gotRequest) {
-                        gotRequest._beforeError(error instanceof RequestError ? error : new RequestError(error.message, error, gotRequest));
-                        // Don't call handler when error was propagated successfully
+                    catch (error) {
+                        const normalizedError = normalizeError(error);
+                        // Convert hook errors to RequestError and propagate
+                        // This is consistent with how other hooks handle errors
+                        if (gotRequest) {
+                            gotRequest._beforeError(normalizedError instanceof RequestError ? normalizedError : new RequestError(normalizedError.message, normalizedError, gotRequest));
+                            // Don't call handler when error was propagated successfully
+                            return;
+                        }
+                        // If gotRequest is missing, log the error to aid debugging
+                        // We still call the handler to prevent the request from hanging
+                        console.error('Got: beforeCache hook error (request context unavailable):', normalizedError);
+                        // Call handler with response (potentially partially modified)
+                        handler(response);
                         return;
                     }
-                    // If gotRequest is missing, log the error to aid debugging
-                    // We still call the handler to prevent the request from hanging
-                    console.error('Got: beforeCache hook error (request context unavailable):', error);
-                    // Call handler with response (potentially partially modified)
+                    // All hooks ran successfully
+                    // Cache the response with any mutations applied
                     handler(response);
-                    return;
                 }
-                // All hooks ran successfully
-                // Cache the response with any mutations applied
-                handler(response);
-            } : handler;
+                : handler;
             const result = requestOptions._request(requestOptions, wrappedHandler);
             // TODO: remove this when `cacheable-request` supports async request functions.
             if (is.promise(result)) {
@@ -1039,32 +1480,44 @@ export default class Request extends Duplex {
     }
     async _createCacheableRequest(url, options) {
         return new Promise((resolve, reject) => {
-            // TODO: Remove `utils/url-to-options.ts` when `cacheable-request` is fixed
-            Object.assign(options, urlToOptions(url));
+            Object.assign(options, {
+                protocol: url.protocol,
+                hostname: is.string(url.hostname) && url.hostname.startsWith('[') ? url.hostname.slice(1, -1) : url.hostname,
+                host: url.host,
+                hash: url.hash === '' ? '' : (url.hash ?? null),
+                search: url.search === '' ? '' : (url.search ?? null),
+                pathname: url.pathname,
+                href: url.href,
+                path: `${url.pathname || ''}${url.search || ''}`,
+                ...(is.string(url.port) && url.port.length > 0 ? { port: Number(url.port) } : {}),
+                ...(url.username || url.password ? { auth: `${url.username || ''}:${url.password || ''}` } : {}),
+            });
             let request;
             // TODO: Fix `cacheable-response`. This is ugly.
-            const cacheRequest = cacheableStore.get(options.cache)(options, async (response) => {
-                response._readableState.autoDestroy = false;
-                if (request) {
-                    const fix = () => {
-                        // For ResponseLike objects from cache, set complete to true if not already set.
-                        // For real HTTP responses, copy from the underlying response.
-                        if (response.req) {
-                            response.complete = response.req.res.complete;
-                        }
-                        else if (response.complete === undefined) {
-                            // ResponseLike from cache should have complete = true
-                            response.complete = true;
-                        }
-                    };
-                    response.prependOnceListener('end', fix);
-                    fix();
-                    (await request).emit('cacheableResponse', response);
-                }
-                resolve(response);
+            const cacheRequest = cacheableStore.get(options.cache)(options, (response) => {
+                void (async () => {
+                    response._readableState.autoDestroy = false;
+                    if (request) {
+                        const fix = () => {
+                            // For ResponseLike objects from cache, set complete to true if not already set.
+                            // For real HTTP responses, copy from the underlying response.
+                            if (response.req) {
+                                response.complete = response.req.res.complete;
+                            }
+                            else if (response.complete === undefined) {
+                                // ResponseLike from cache should have complete = true
+                                response.complete = true;
+                            }
+                        };
+                        response.prependOnceListener('end', fix);
+                        fix();
+                        (await request).emit('cacheableResponse', response);
+                    }
+                    resolve(response);
+                })();
             });
             cacheRequest.once('error', reject);
-            cacheRequest.once('request', async (requestOrPromise) => {
+            cacheRequest.once('request', (requestOrPromise) => {
                 request = requestOrPromise;
                 resolve(request);
             });
@@ -1072,12 +1525,12 @@ export default class Request extends Duplex {
     }
     async _makeRequest() {
         const { options } = this;
-        const { headers, username, password } = options;
+        const headers = options.getInternalHeaders();
+        const { username, password } = options;
         const cookieJar = options.cookieJar;
         for (const key in headers) {
             if (is.undefined(headers[key])) {
-                // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
-                delete headers[key];
+                options.deleteInternalHeader(key);
             }
             else if (is.null(headers[key])) {
                 throw new TypeError(`Use \`undefined\` instead of \`null\` to delete the \`${key}\` header`);
@@ -1091,17 +1544,17 @@ export default class Request extends Duplex {
             if (supportsZstd) {
                 encodings.push('zstd');
             }
-            headers['accept-encoding'] = encodings.join(', ');
+            options.setInternalHeader('accept-encoding', encodings.join(', '));
         }
         if (username || password) {
-            const credentials = Buffer.from(`${username}:${password}`).toString('base64');
-            headers.authorization = `Basic ${credentials}`;
+            const credentials = stringToBase64(`${username}:${password}`);
+            options.setInternalHeader('authorization', `Basic ${credentials}`);
         }
         // Set cookies
         if (cookieJar) {
             const cookieString = await cookieJar.getCookieString(options.url.toString());
             if (is.nonEmptyString(cookieString)) {
-                headers.cookie = cookieString;
+                options.setInternalHeader('cookie', cookieString);
             }
         }
         let request;
@@ -1114,7 +1567,11 @@ export default class Request extends Duplex {
                 break;
             }
         }
-        request ||= options.getRequestFunction();
+        if (!is.undefined(headers['transfer-encoding']) && !is.undefined(headers['content-length'])) {
+            // TODO: Throw instead of silently dropping `content-length` in the next major version.
+            options.deleteInternalHeader('content-length');
+        }
+        request ??= options.getRequestFunction();
         const url = options.url;
         this._requestOptions = options.createNativeRequestOptions();
         if (options.cache) {
@@ -1127,7 +1584,7 @@ export default class Request extends Duplex {
                 this._prepareCache(options.cache);
             }
             catch (error) {
-                throw new CacheError(error, this);
+                throw new CacheError(normalizeError(error), this);
             }
         }
         // Cache support
@@ -1139,13 +1596,6 @@ export default class Request extends Duplex {
             if (is.promise(requestOrResponse)) {
                 requestOrResponse = await requestOrResponse;
             }
-            // Fallback
-            if (is.undefined(requestOrResponse)) {
-                requestOrResponse = options.getFallbackRequestFunction()(url, this._requestOptions);
-                if (is.promise(requestOrResponse)) {
-                    requestOrResponse = await requestOrResponse;
-                }
-            }
             if (isClientRequest(requestOrResponse)) {
                 this._onRequest(requestOrResponse);
             }
@@ -1168,12 +1618,9 @@ export default class Request extends Duplex {
     }
     async _error(error) {
         try {
-            if (this.options && error instanceof HTTPError && !this.options.throwHttpErrors) {
-                // This branch can be reached only when using the Promise API
-                // Skip calling the hooks on purpose.
-                // See https://github.com/sindresorhus/got/issues/2103
-            }
-            else if (this.options) {
+            // Skip calling hooks for HTTP errors when throwHttpErrors is false (Promise API only).
+            // See https://github.com/sindresorhus/got/issues/2103
+            if (this.options && (!(error instanceof HTTPError) || this.options.throwHttpErrors)) {
                 const hooks = this.options.hooks.beforeError;
                 if (hooks.length > 0) {
                     for (const hook of hooks) {
@@ -1194,12 +1641,13 @@ export default class Request extends Duplex {
             }
         }
         catch (error_) {
-            error = new RequestError(error_.message, error_, this);
+            const normalizedError = normalizeError(error_);
+            error = new RequestError(normalizedError.message, normalizedError, this);
         }
         // Publish error event
         publishError({
             requestId: this._requestId,
-            url: this.options?.url?.toString() ?? '',
+            url: getSanitizedUrl(this.options),
             error,
             timings: this.timings,
         });
@@ -1215,16 +1663,17 @@ export default class Request extends Duplex {
             });
         }
     }
-    _writeRequest(chunk, encoding, callback) {
-        if (!this._request || this._request.destroyed) {
+    _writeRequest(chunk, encoding, callback, request = this._request) {
+        if (!request || request.destroyed) {
             // When there's no request (e.g., using cached response from beforeRequest hook),
             // we still need to call the callback to allow the stream to finish properly.
             callback();
             return;
         }
-        this._request.write(chunk, encoding, (error) => {
-            // The `!destroyed` check is required to prevent `uploadProgress` being emitted after the stream was destroyed
-            if (!error && !this._request.destroyed) {
+        request.write(chunk, encoding, (error) => {
+            // The `!destroyed` check is required to prevent `uploadProgress` being emitted after the stream was destroyed.
+            // The `this._request === request` check prevents stale write callbacks from a pre-redirect request from incrementing `_uploadedSize` after it's been reset.
+            if (!error && !request.destroyed && this._request === request) {
                 // For strings, encode them first to measure the actual bytes that will be sent
                 const bytes = typeof chunk === 'string' ? Buffer.from(chunk, encoding) : chunk;
                 this._uploadedSize += byteLength(bytes);
@@ -1255,41 +1704,13 @@ export default class Request extends Duplex {
     Progress event for downloading (receiving a response).
     */
     get downloadProgress() {
-        let percent;
-        if (this._responseSize) {
-            percent = this._downloadedSize / this._responseSize;
-        }
-        else if (this._responseSize === this._downloadedSize) {
-            percent = 1;
-        }
-        else {
-            percent = 0;
-        }
-        return {
-            percent,
-            transferred: this._downloadedSize,
-            total: this._responseSize,
-        };
+        return makeProgress(this._downloadedSize, this._responseSize);
     }
     /**
     Progress event for uploading (sending a request).
     */
     get uploadProgress() {
-        let percent;
-        if (this._bodySize) {
-            percent = this._uploadedSize / this._bodySize;
-        }
-        else if (this._bodySize === this._uploadedSize) {
-            percent = 1;
-        }
-        else {
-            percent = 0;
-        }
-        return {
-            percent,
-            transferred: this._uploadedSize,
-            total: this._bodySize,
-        };
+        return makeProgress(this._uploadedSize, this._bodySize);
     }
     /**
     The object contains the following properties:
@@ -1325,7 +1746,7 @@ export default class Request extends Duplex {
     Whether the response was retrieved from the cache.
     */
     get isFromCache() {
-        return this._isFromCache;
+        return this.response?.isFromCache;
     }
     get reusedSocket() {
         return this._request?.reusedSocket;