got 15.0.0 → 15.0.2

package/dist/source/as-promise/index.js

@@ -24,97 +24,105 @@ export default function asPromise(firstRequest) {
             request.retryCount = retryCount;
             request._noPipe = true;
             globalRequest = request;
-            request.once('response', async (response) => {
-                // Parse body
-                const contentEncoding = (response.headers['content-encoding'] ?? '').toLowerCase();
-                const isCompressed = compressedEncodings.has(contentEncoding);
-                const { options } = request;
-                if (isCompressed && !options.decompress) {
-                    response.body = response.rawBody;
-                }
-                else {
-                    try {
-                        response.body = parseBody(response, options.responseType, options.parseJson, options.encoding);
+            request.once('response', (response) => {
+                void (async () => {
+                    // Parse body
+                    const contentEncoding = (response.headers['content-encoding'] ?? '').toLowerCase();
+                    const isCompressed = compressedEncodings.has(contentEncoding);
+                    const { options } = request;
+                    if (isCompressed && !options.decompress) {
+                        response.body = response.rawBody;
                     }
-                    catch (error) {
-                        // Fall back to `utf8`
+                    else {
                         try {
-                            response.body = decodeUint8Array(response.rawBody);
+                            response.body = parseBody(response, options.responseType, options.parseJson, options.encoding);
                         }
                         catch (error) {
-                            request._beforeError(new ParseError(normalizeError(error), response));
-                            return;
-                        }
-                        if (isResponseOk(response)) {
-                            request._beforeError(normalizeError(error));
-                            return;
-                        }
-                    }
-                }
-                try {
-                    const hooks = options.hooks.afterResponse;
-                    for (const [index, hook] of hooks.entries()) {
-                        const previousUrl = options.url ? new URL(options.url) : undefined;
-                        const previousState = previousUrl ? snapshotCrossOriginState(options) : undefined;
-                        const requestOptions = response.request.options;
-                        const responseSnapshot = response;
-                        // @ts-expect-error TS doesn't notice that RequestPromise is a Promise
-                        // eslint-disable-next-line no-await-in-loop
-                        response = await requestOptions.trackStateMutations(async (changedState) => hook(responseSnapshot, async (updatedOptions) => {
-                            const preserveHooks = updatedOptions.preserveHooks ?? false;
-                            const reusesRequestOptions = updatedOptions === requestOptions;
-                            const hasExplicitBody = reusesRequestOptions
-                                ? changedState.has('body') || changedState.has('json') || changedState.has('form')
-                                : (Object.hasOwn(updatedOptions, 'body') && updatedOptions.body !== undefined)
-                                    || (Object.hasOwn(updatedOptions, 'json') && updatedOptions.json !== undefined)
-                                    || (Object.hasOwn(updatedOptions, 'form') && updatedOptions.form !== undefined);
-                            if (hasExplicitBody && !reusesRequestOptions) {
-                                options.clearBody();
+                            // Fall back to `utf8`
+                            try {
+                                response.body = decodeUint8Array(response.rawBody);
                             }
-                            if (!reusesRequestOptions) {
-                                options.merge(updatedOptions);
+                            catch (error) {
+                                request._beforeError(new ParseError(normalizeError(error), response));
+                                return;
                             }
-                            if (updatedOptions.url) {
-                                const nextUrl = reusesRequestOptions
-                                    ? options.url
-                                    : applyUrlOverride(options, updatedOptions.url, updatedOptions);
-                                if (previousUrl) {
-                                    if (reusesRequestOptions && !isSameOrigin(previousUrl, nextUrl)) {
-                                        options.stripUnchangedCrossOriginState(previousState, changedState, { clearBody: !hasExplicitBody });
-                                    }
-                                    else {
-                                        options.stripSensitiveHeaders(previousUrl, nextUrl, updatedOptions);
-                                        if (!isSameOrigin(previousUrl, nextUrl) && !hasExplicitBody) {
-                                            options.clearBody();
+                            if (isResponseOk(response)) {
+                                request._beforeError(normalizeError(error));
+                                return;
+                            }
+                        }
+                    }
+                    try {
+                        const hooks = options.hooks.afterResponse;
+                        for (const [index, hook] of hooks.entries()) {
+                            const previousUrl = options.url ? new URL(options.url) : undefined;
+                            const previousState = previousUrl ? snapshotCrossOriginState(options) : undefined;
+                            const requestOptions = response.request.options;
+                            const responseSnapshot = response;
+                            // @ts-expect-error TS doesn't notice that RequestPromise is a Promise
+                            // eslint-disable-next-line no-await-in-loop
+                            response = await requestOptions.trackStateMutations(async (changedState) => hook(responseSnapshot, async (updatedOptions) => {
+                                const preserveHooks = updatedOptions.preserveHooks ?? false;
+                                const reusesRequestOptions = updatedOptions === requestOptions;
+                                const hasExplicitBody = reusesRequestOptions
+                                    ? changedState.has('body') || changedState.has('json') || changedState.has('form')
+                                    : (Object.hasOwn(updatedOptions, 'body') && updatedOptions.body !== undefined)
+                                        || (Object.hasOwn(updatedOptions, 'json') && updatedOptions.json !== undefined)
+                                        || (Object.hasOwn(updatedOptions, 'form') && updatedOptions.form !== undefined);
+                                const clearsCookieJar = Object.hasOwn(updatedOptions, 'cookieJar') && updatedOptions.cookieJar === undefined;
+                                if (hasExplicitBody && !reusesRequestOptions) {
+                                    options.clearBody();
+                                }
+                                if (!reusesRequestOptions && clearsCookieJar) {
+                                    options.cookieJar = undefined;
+                                }
+                                if (!reusesRequestOptions) {
+                                    options.merge(updatedOptions);
+                                    options.syncCookieHeaderAfterMerge(previousState, updatedOptions.headers);
+                                }
+                                options.clearUnchangedCookieHeader(previousState, reusesRequestOptions ? changedState : undefined);
+                                if (updatedOptions.url) {
+                                    const nextUrl = reusesRequestOptions
+                                        ? options.url
+                                        : applyUrlOverride(options, updatedOptions.url, updatedOptions);
+                                    if (previousUrl) {
+                                        if (reusesRequestOptions && !isSameOrigin(previousUrl, nextUrl)) {
+                                            options.stripUnchangedCrossOriginState(previousState, changedState, { clearBody: !hasExplicitBody });
+                                        }
+                                        else {
+                                            options.stripSensitiveHeaders(previousUrl, nextUrl, updatedOptions);
+                                            if (!isSameOrigin(previousUrl, nextUrl) && !hasExplicitBody) {
+                                                options.clearBody();
+                                            }
                                         }
                                     }
                                 }
+                                // Remove any further hooks for that request, because we'll call them anyway.
+                                // The loop continues. We don't want duplicates (asPromise recursion).
+                                // Unless preserveHooks is true, in which case we keep the remaining hooks.
+                                if (!preserveHooks) {
+                                    options.hooks.afterResponse = options.hooks.afterResponse.slice(0, index);
+                                }
+                                throw new RetryError(request);
+                            }));
+                            if (!(is.object(response) && is.number(response.statusCode) && 'body' in response)) {
+                                throw new TypeError('The `afterResponse` hook returned an invalid value');
                             }
-                            // Remove any further hooks for that request, because we'll call them anyway.
-                            // The loop continues. We don't want duplicates (asPromise recursion).
-                            // Unless preserveHooks is true, in which case we keep the remaining hooks.
-                            if (!preserveHooks) {
-                                options.hooks.afterResponse = options.hooks.afterResponse.slice(0, index);
-                            }
-                            throw new RetryError(request);
-                        }));
-                        if (!(is.object(response) && is.number(response.statusCode) && 'body' in response)) {
-                            throw new TypeError('The `afterResponse` hook returned an invalid value');
                         }
                     }
-                }
-                catch (error) {
-                    request._beforeError(normalizeError(error));
-                    return;
-                }
-                globalResponse = response;
-                if (!isResponseOk(response)) {
-                    request._beforeError(new HTTPError(response));
-                    return;
-                }
-                request.destroy();
-                promiseSettled = true;
-                resolve(request.options.resolveBodyOnly ? response.body : response);
+                    catch (error) {
+                        request._beforeError(normalizeError(error));
+                        return;
+                    }
+                    globalResponse = response;
+                    if (!isResponseOk(response)) {
+                        request._beforeError(new HTTPError(response));
+                        return;
+                    }
+                    request.destroy();
+                    promiseSettled = true;
+                    resolve(request.options.resolveBodyOnly ? response.body : response);
+                })();
             });
             let handledFinalError = false;
             const onError = (error) => {
@@ -191,7 +199,7 @@ export default function asPromise(firstRequest) {
             const { options } = globalResponse.request;
             if (responseType === 'text') {
                 const text = decodeUint8Array(globalResponse.rawBody, options.encoding);
-                return (isUtf8Encoding(options.encoding) ? text.replace(/^\uFEFF/u, '') : text);
+                return (isUtf8Encoding(options.encoding) ? text.replace(/^\u{FEFF}/v, '') : text);
             }
             return parseBody(globalResponse, responseType, options.parseJson, options.encoding);
         })();

package/dist/source/core/errors.js

@@ -41,13 +41,13 @@ export class RequestError extends Error {
         // Recover the original stacktrace
         if (is.string(error.stack) && is.string(this.stack)) {
             const indexOfMessage = this.stack.indexOf(this.message) + this.message.length;
-            const thisStackTrace = this.stack.slice(indexOfMessage).split('\n').reverse();
-            const errorStackTrace = error.stack.slice(error.stack.indexOf(error.message) + error.message.length).split('\n').reverse();
+            const thisStackTrace = this.stack.slice(indexOfMessage).split('\n').toReversed();
+            const errorStackTrace = error.stack.slice(error.stack.indexOf(error.message) + error.message.length).split('\n').toReversed();
             // Remove duplicated traces
             while (errorStackTrace.length > 0 && errorStackTrace[0] === thisStackTrace[0]) {
                 thisStackTrace.shift();
             }
-            this.stack = `${this.stack.slice(0, indexOfMessage)}${thisStackTrace.reverse().join('\n')}${errorStackTrace.reverse().join('\n')}`;
+            this.stack = `${this.stack.slice(0, indexOfMessage)}${thisStackTrace.toReversed().join('\n')}${errorStackTrace.toReversed().join('\n')}`;
         }
     }
 }

package/dist/source/core/index.js

@@ -725,6 +725,40 @@ export default class Request extends Duplex {
                 }, this));
             }
         });
+        let canFinalizeResponse = false;
+        const handleResponseEnd = () => {
+            if (!canFinalizeResponse
+                || !response.readableEnded) {
+                return;
+            }
+            canFinalizeResponse = false;
+            if (this._stopReading) {
+                return;
+            }
+            // Validate content-length if it was provided
+            // Per RFC 9112: "If the sender closes the connection before the indicated number
+            // of octets are received, the recipient MUST consider the message to be incomplete"
+            if (this._checkContentLengthMismatch()) {
+                return;
+            }
+            this._responseSize = this._downloadedSize;
+            this.emit('downloadProgress', this.downloadProgress);
+            // Publish response end event
+            publishResponseEnd({
+                requestId: this._requestId,
+                url: typedResponse.url,
+                statusCode,
+                bodySize: this._downloadedSize,
+                timings: this.timings,
+            });
+            this.push(null);
+        };
+        if (!shouldFollowRedirect) {
+            // `set-cookie` handling below awaits the cookie jar. A fast response can fully
+            // end during that await, so we need to observe `end` early without completing
+            // the outward stream until cookie handling has finished.
+            response.once('end', handleResponseEnd);
+        }
         const noPipeCookieJarRawBodyPromise = this._noPipe
             && is.object(options.cookieJar)
             && !isRedirect
@@ -828,6 +862,7 @@ export default class Request extends Duplex {
                     }
                     return changedState;
                 });
+                updatedOptions.clearUnchangedCookieHeader(preHookState, changedState);
                 // If a beforeRedirect hook changed the URL to a different origin,
                 // strip sensitive headers that were preserved for the original origin.
                 // When isDifferentOrigin was already true, headers were already stripped above.
@@ -836,15 +871,7 @@ export default class Request extends Duplex {
                     const hookUrl = updatedOptions.url;
                     if (!isSameOrigin(state.url, hookUrl)) {
                         this._stripUnchangedCrossOriginState(updatedOptions, hookUrl, shouldDropBody, {
-                            headers: state.headers,
-                            username: state.username,
-                            password: state.password,
-                            body: state.body,
-                            json: state.json,
-                            form: state.form,
-                            bodySnapshot: state.bodySnapshot,
-                            jsonSnapshot: state.jsonSnapshot,
-                            formSnapshot: state.formSnapshot,
+                            ...state,
                             changedState,
                             preserveUsername: hasExplicitCredentialInUrlChange(changedState, hookUrl, 'username')
                                 || isCrossOriginCredentialChanged(state.url, hookUrl, 'username'),
@@ -870,6 +897,8 @@ export default class Request extends Duplex {
             }
             return;
         }
+        canFinalizeResponse = true;
+        handleResponseEnd();
         // `HTTPError`s always have `error.response.body` defined.
         // Therefore, we cannot retry if `options.throwHttpErrors` is false.
         // On the last retry, if `options.throwHttpErrors` is false, we would need to return the body,
@@ -894,32 +923,6 @@ export default class Request extends Duplex {
                 }
             }
         }
-        // Set up end listener AFTER redirect check to avoid emitting progress for redirect responses
-        let responseEndHandled = false;
-        const handleResponseEnd = () => {
-            if (responseEndHandled) {
-                return;
-            }
-            responseEndHandled = true;
-            // Validate content-length if it was provided
-            // Per RFC 9112: "If the sender closes the connection before the indicated number
-            // of octets are received, the recipient MUST consider the message to be incomplete"
-            if (this._checkContentLengthMismatch()) {
-                return;
-            }
-            this._responseSize = this._downloadedSize;
-            this.emit('downloadProgress', this.downloadProgress);
-            // Publish response end event
-            publishResponseEnd({
-                requestId: this._requestId,
-                url: typedResponse.url,
-                statusCode,
-                bodySize: this._downloadedSize,
-                timings: this.timings,
-            });
-            this.push(null);
-        };
-        response.once('end', handleResponseEnd);
         this.emit('downloadProgress', this.downloadProgress);
         response.on('readable', () => {
             if (this._triggerRead) {
@@ -1319,7 +1322,8 @@ export default class Request extends Duplex {
                 try {
                     const result = iterableBody.return();
                     if (result instanceof Promise) {
-                        result.catch(noop); // eslint-disable-line promise/prefer-await-to-then
+                        // eslint-disable-next-line promise/prefer-await-to-then
+                        result.catch(noop);
                     }
                 }
                 catch { }
@@ -1493,28 +1497,30 @@ export default class Request extends Duplex {
             });
             let request;
             // TODO: Fix `cacheable-response`. This is ugly.
-            const cacheRequest = cacheableStore.get(options.cache)(options, async (response) => {
-                response._readableState.autoDestroy = false;
-                if (request) {
-                    const fix = () => {
-                        // For ResponseLike objects from cache, set complete to true if not already set.
-                        // For real HTTP responses, copy from the underlying response.
-                        if (response.req) {
-                            response.complete = response.req.res.complete;
-                        }
-                        else if (response.complete === undefined) {
-                            // ResponseLike from cache should have complete = true
-                            response.complete = true;
-                        }
-                    };
-                    response.prependOnceListener('end', fix);
-                    fix();
-                    (await request).emit('cacheableResponse', response);
-                }
-                resolve(response);
+            const cacheRequest = cacheableStore.get(options.cache)(options, (response) => {
+                void (async () => {
+                    response._readableState.autoDestroy = false;
+                    if (request) {
+                        const fix = () => {
+                            // For ResponseLike objects from cache, set complete to true if not already set.
+                            // For real HTTP responses, copy from the underlying response.
+                            if (response.req) {
+                                response.complete = response.req.res.complete;
+                            }
+                            else if (response.complete === undefined) {
+                                // ResponseLike from cache should have complete = true
+                                response.complete = true;
+                            }
+                        };
+                        response.prependOnceListener('end', fix);
+                        fix();
+                        (await request).emit('cacheableResponse', response);
+                    }
+                    resolve(response);
+                })();
             });
             cacheRequest.once('error', reject);
-            cacheRequest.once('request', async (requestOrPromise) => {
+            cacheRequest.once('request', (requestOrPromise) => {
                 request = requestOrPromise;
                 resolve(request);
             });
@@ -1522,17 +1528,46 @@ export default class Request extends Duplex {
     }
     async _makeRequest() {
         const { options } = this;
-        const headers = options.getInternalHeaders();
-        const { username, password } = options;
-        const cookieJar = options.cookieJar;
-        for (const key in headers) {
-            if (is.undefined(headers[key])) {
-                options.deleteInternalHeader(key);
+        const initialHeaders = options.getInternalHeaders();
+        const explicitAuthorizationHeader = options.isHeaderExplicitlySet('authorization') ? initialHeaders.authorization : undefined;
+        const explicitCookieHeader = options.isHeaderExplicitlySet('cookie') ? initialHeaders.cookie : undefined;
+        const authorizationWasInitiallyOmitted = options.isHeaderExplicitlySet('authorization') && is.undefined(initialHeaders.authorization);
+        const cookieWasInitiallyOmitted = options.isHeaderExplicitlySet('cookie') && is.undefined(initialHeaders.cookie);
+        const shouldDeleteGeneratedHeader = (currentHeader, generatedHeader) => currentHeader === generatedHeader || is.undefined(currentHeader);
+        const syncGeneratedHeader = (name, { currentHeader, explicitHeader, nextHeader, staleGeneratedHeader, }) => {
+            if (!is.undefined(nextHeader)) {
+                options.setInternalHeader(name, nextHeader);
+            }
+            else if (!is.undefined(explicitHeader) && currentHeader === staleGeneratedHeader) {
+                options.setInternalHeader(name, explicitHeader);
+            }
+            else if (shouldDeleteGeneratedHeader(currentHeader, staleGeneratedHeader)) {
+                options.deleteInternalHeader(name);
+            }
+        };
+        const getAuthorizationHeader = (username, password, isExplicitlyOmitted) => !isExplicitlyOmitted && (username || password)
+            ? `Basic ${stringToBase64(`${username}:${password}`)}`
+            : undefined;
+        const sanitizeHeaders = () => {
+            const currentHeaders = options.getInternalHeaders();
+            for (const key in currentHeaders) {
+                if (is.undefined(currentHeaders[key])) {
+                    options.deleteInternalHeader(key);
+                }
+                else if (is.null(currentHeaders[key])) {
+                    throw new TypeError(`Use \`undefined\` instead of \`null\` to delete the \`${key}\` header`);
+                }
             }
-            else if (is.null(headers[key])) {
-                throw new TypeError(`Use \`undefined\` instead of \`null\` to delete the \`${key}\` header`);
+            return currentHeaders;
+        };
+        const getCookieHeader = async (cookieJar) => {
+            if (!cookieJar) {
+                return undefined;
             }
-        }
+            const cookieString = await cookieJar.getCookieString(options.url.toString());
+            return is.nonEmptyString(cookieString) ? cookieString : undefined;
+        };
+        const headers = sanitizeHeaders();
         if (options.decompress && is.undefined(headers['accept-encoding'])) {
             const encodings = ['gzip', 'deflate'];
             if (supportsBrotli) {
@@ -1543,34 +1578,93 @@ export default class Request extends Duplex {
             }
             options.setInternalHeader('accept-encoding', encodings.join(', '));
         }
-        if (username || password) {
-            const credentials = stringToBase64(`${username}:${password}`);
-            options.setInternalHeader('authorization', `Basic ${credentials}`);
+        const { username, password } = options;
+        const cookieJar = options.cookieJar;
+        const generatedAuthorizationHeader = getAuthorizationHeader(username, password, authorizationWasInitiallyOmitted);
+        let generatedCookieHeader;
+        if (!is.undefined(generatedAuthorizationHeader)) {
+            options.setInternalHeader('authorization', generatedAuthorizationHeader);
         }
-        // Set cookies
-        if (cookieJar) {
-            const cookieString = await cookieJar.getCookieString(options.url.toString());
-            if (is.nonEmptyString(cookieString)) {
-                options.setInternalHeader('cookie', cookieString);
+        if (!cookieWasInitiallyOmitted) {
+            generatedCookieHeader = await getCookieHeader(cookieJar);
+            if (!is.undefined(generatedCookieHeader)) {
+                options.setInternalHeader('cookie', generatedCookieHeader);
             }
         }
         let request;
-        for (const hook of options.hooks.beforeRequest) {
-            // eslint-disable-next-line no-await-in-loop
-            const result = await hook(options, { retryCount: this.retryCount });
-            if (!is.undefined(result)) {
-                // @ts-expect-error Skip the type mismatch to support abstract responses
-                request = () => result;
-                break;
+        let shouldOmitRequestUrlCredentials = false;
+        const changedState = await options.trackStateMutations(async (changedState) => {
+            for (const hook of options.hooks.beforeRequest) {
+                // eslint-disable-next-line no-await-in-loop
+                const result = await hook(options, { retryCount: this.retryCount });
+                if (!is.undefined(result)) {
+                    // @ts-expect-error Skip the type mismatch to support abstract responses
+                    request = () => result;
+                    break;
+                }
+            }
+            return changedState;
+        });
+        if (request === undefined) {
+            const currentHeaders = options.getInternalHeaders();
+            // `headers.authorization = undefined` / `headers.cookie = undefined` is an
+            // explicit opt-out. Respect that instead of regenerating values from URL
+            // credentials or the cookie jar later in request setup.
+            const isHeaderExplicitlyOmitted = (header) => options.isHeaderExplicitlySet(header) && is.undefined(currentHeaders[header]);
+            const authorizationWasExplicitlyOmitted = isHeaderExplicitlyOmitted('authorization');
+            const cookieWasExplicitlyOmitted = isHeaderExplicitlyOmitted('cookie');
+            const currentAuthorizationHeader = currentHeaders.authorization;
+            const currentCookieHeader = currentHeaders.cookie;
+            sanitizeHeaders();
+            if (!is.undefined(currentHeaders['transfer-encoding']) && !is.undefined(currentHeaders['content-length'])) {
+                options.deleteInternalHeader('content-length');
+            }
+            if (authorizationWasExplicitlyOmitted) {
+                shouldOmitRequestUrlCredentials = true;
+                options.deleteInternalHeader('authorization');
+                if (changedState.has('authorization') && is.undefined(explicitAuthorizationHeader) && !authorizationWasInitiallyOmitted) {
+                    delete options.headers.authorization;
+                }
+            }
+            const authorizationHeader = getAuthorizationHeader(options.username, options.password, authorizationWasExplicitlyOmitted);
+            const cookieJar = options.cookieJar;
+            if (changedState.has('authorization')) {
+                // A beforeRequest hook intentionally set the outgoing Authorization header.
+            }
+            else {
+                syncGeneratedHeader('authorization', {
+                    currentHeader: currentAuthorizationHeader,
+                    explicitHeader: explicitAuthorizationHeader,
+                    nextHeader: authorizationHeader,
+                    staleGeneratedHeader: generatedAuthorizationHeader,
+                });
+            }
+            if (cookieWasExplicitlyOmitted) {
+                options.deleteInternalHeader('cookie');
+                if (changedState.has('cookie') && is.undefined(explicitCookieHeader) && !cookieWasInitiallyOmitted) {
+                    delete options.headers.cookie;
+                }
+            }
+            else if (changedState.has('cookie')) {
+                // A beforeRequest hook intentionally set the outgoing Cookie header.
+            }
+            else {
+                syncGeneratedHeader('cookie', {
+                    currentHeader: currentCookieHeader,
+                    explicitHeader: explicitCookieHeader,
+                    nextHeader: await getCookieHeader(cookieJar),
+                    staleGeneratedHeader: generatedCookieHeader,
+                });
             }
-        }
-        if (!is.undefined(headers['transfer-encoding']) && !is.undefined(headers['content-length'])) {
-            // TODO: Throw instead of silently dropping `content-length` in the next major version.
-            options.deleteInternalHeader('content-length');
         }
         request ??= options.getRequestFunction();
-        const url = options.url;
+        const url = shouldOmitRequestUrlCredentials
+            ? new URL(stripUrlAuth(options.url))
+            : options.url;
         this._requestOptions = options.createNativeRequestOptions();
+        if (shouldOmitRequestUrlCredentials) {
+            this._requestOptions.auth = undefined;
+        }
         if (options.cache) {
             this._requestOptions._request = request;
             this._requestOptions.cache = options.cache;

package/dist/source/core/options.d.ts

@@ -31,6 +31,8 @@ export type Agents = {
 export type Headers = Record<string, string | string[] | undefined>;
 export type CrossOriginState = {
     headers: Headers;
+    hadCookieJar: boolean;
+    cookieWasExplicitlySet: boolean;
     username: string;
     password: string;
     body: unknown;
@@ -91,20 +93,20 @@ export type Hooks = {
 
     @default []
 
-    **Note:**
+    Note:
     > - This hook must be synchronous.
 
-    **Note:**
+    Note:
     > - This is called every time options are merged.
 
-    **Note:**
+    Note:
     > - The `options` object may not have the `url` property. To modify it, use a `beforeRequest` hook instead.
 
-    **Note:**
+    Note:
     > - This hook is called when a new instance of `Options` is created.
     > - Do not confuse this with the creation of `Request` or `got(…)`.
 
-    **Note:**
+    Note:
     > - When using `got(url)` or `got(url, undefined, defaults)` this hook will **not** be called.
 
     This is especially useful in conjunction with `got.extend()` when the input needs custom handling.
@@ -183,10 +185,10 @@ export type Hooks = {
 
     @default []
 
-    **Note:**
+    Note:
     > - Got will make no further changes to the request before it is sent.
 
-    **Note:**
+    Note:
     > - Changing `options.json` or `options.form` has no effect on the request. You should change `options.body` instead. If needed, update the `options.headers` accordingly.
 
     @example
@@ -209,7 +211,7 @@ export type Hooks = {
     );
     ```
 
-    **Example using `context.retryCount`:**
+    Example using `context.retryCount`:
 
     ```
     import got from 'got';
@@ -231,7 +233,7 @@ export type Hooks = {
     });
     ```
 
-    **Tip:**
+    Tip:
     > - You can indirectly override the `request` function by early returning a [`ClientRequest`-like](https://nodejs.org/api/http.html#http_class_http_clientrequest) instance or a [`IncomingMessage`-like](https://nodejs.org/api/http.html#http_class_http_incomingmessage) instance. This is very useful when creating a custom cache mechanism.
     > - [Read more about this tip](https://github.com/sindresorhus/got/blob/main/documentation/cache.md#advanced-caching-mechanisms).
     */
@@ -241,7 +243,7 @@ export type Hooks = {
 
     @default []
 
-    **Tip:**
+    Tip:
     > - This is especially useful when you want to avoid dead sites.
 
     @example
@@ -326,13 +328,13 @@ export type Hooks = {
 
     @default []
 
-    **Note:**
+    Note:
     > - When using the Stream API, this hook is ignored.
 
-    **Note:**
+    Note:
     > - When retrying, the `beforeRequest` hook is called afterwards.
 
-    **Note:**
+    Note:
     > - If no retry occurs, the `beforeError` hook is called instead.
 
     This hook is especially useful when you want to retrieve the cause of a retry.
@@ -361,31 +363,31 @@ export type Hooks = {
 
     @default []
 
-    **Return value:**
+    Return value:
     > - `false` - Prevent caching (remaining hooks are skipped)
     > - `void`/`undefined` - Use default caching behavior (mutations take effect)
 
-    **Modifying the response:**
+    Modifying the response:
     > - Hooks can directly mutate response properties like `headers`, `statusCode`, and `statusMessage`
     > - Mutations to `response.headers` affect how the caching layer decides whether to cache the response and for how long
     > - Changes are applied to what gets cached
 
-    **Note:**
+    Note:
     > - This hook is only called when the `cache` option is enabled.
 
-    **Note:**
+    Note:
     > - This hook must be synchronous. It cannot return a Promise. If you need async logic to determine caching behavior, use a `beforeRequest` hook instead.
 
-    **Note:**
+    Note:
     > - When returning `false`, remaining hooks are skipped and the response will not be cached.
 
-    **Note:**
+    Note:
     > - Returning anything other than `false` or `undefined` will throw a TypeError.
 
-    **Note:**
+    Note:
     > - If a hook throws an error, it will be propagated and the request will fail. This is consistent with how other hooks in Got handle errors.
 
-    **Note:**
+    Note:
     > - At this stage, the response body has not been read yet - it's still a stream. Properties like `response.body` and `response.rawBody` are not available. You can only inspect/modify response headers and status code.
 
     @example
@@ -425,17 +427,17 @@ export type Hooks = {
 
     @default []
 
-    **Note:**
+    Note:
     > - When using the Stream API, this hook is ignored.
 
-    **Note:**
+    Note:
     > - Calling the `retryWithMergedOptions` function will trigger `beforeRetry` hooks. By default, remaining `afterResponse` hooks are removed to prevent duplicate execution. To preserve remaining hooks on retry, set `preserveHooks: true` in the options passed to `retryWithMergedOptions`. In case of an error, `beforeRetry` hooks will be called instead.
     Meanwhile the `init`, `beforeRequest` , `beforeRedirect` as well as already executed `afterResponse` hooks will be skipped.
 
-    **Note:**
+    Note:
     > - To preserve remaining `afterResponse` hooks after calling `retryWithMergedOptions`, set `preserveHooks: true` in the options passed to `retryWithMergedOptions`. This is useful when you want hooks to run on retried requests.
 
-    **Warning:**
+    Warning:
     > - Be cautious when using `preserveHooks: true`. If a hook unconditionally calls `retryWithMergedOptions` with `preserveHooks: true`, it will create an infinite retry loop. Always ensure hooks have proper conditional logic to avoid infinite retries.
 
     @example
@@ -788,7 +790,7 @@ export declare function applyUrlOverride(options: Options, url: string | URL, {
 All parsing methods supported by Got.
 */
 export type ResponseType = 'json' | 'buffer' | 'text';
-type OptionsToSkip = 'searchParameters' | 'followRedirects' | 'auth' | 'toJSON' | 'merge' | 'isHeaderExplicitlySet' | 'shouldCopyPipedHeader' | 'setPipedHeader' | 'getInternalHeaders' | 'setInternalHeader' | 'deleteInternalHeader' | 'trackStateMutations' | 'clearBody' | 'stripUnchangedCrossOriginState' | 'stripSensitiveHeaders' | 'createNativeRequestOptions' | 'getRequestFunction' | 'freeze';
+type OptionsToSkip = 'searchParameters' | 'followRedirects' | 'auth' | 'toJSON' | 'merge' | 'isHeaderExplicitlySet' | 'shouldCopyPipedHeader' | 'setPipedHeader' | 'getInternalHeaders' | 'setInternalHeader' | 'deleteInternalHeader' | 'trackStateMutations' | 'clearBody' | 'clearUnchangedCookieHeader' | 'restoreCookieHeader' | 'syncCookieHeaderAfterMerge' | 'stripUnchangedCrossOriginState' | 'stripSensitiveHeaders' | 'createNativeRequestOptions' | 'getRequestFunction' | 'freeze';
 export type InternalsType = Except<Options, OptionsToSkip>;
 export type OptionsError = NodeJS.ErrnoException & {
     options?: Options;
@@ -1226,6 +1228,9 @@ export default class Options {
     deleteInternalHeader(name: string): void;
     trackStateMutations<Value>(operation: (changedState: Set<string>) => Promisable<Value>): Promise<Value>;
     clearBody(): void;
+    clearUnchangedCookieHeader(previousState: CrossOriginState | undefined, changedState?: Set<string>): void;
+    restoreCookieHeader(previousState: CrossOriginState | undefined, headers?: Headers): void;
+    syncCookieHeaderAfterMerge(previousState: CrossOriginState | undefined, headers?: Headers): void;
     stripUnchangedCrossOriginState(previousState: CrossOriginState, changedState: Set<string>, { clearBody }?: {
         clearBody?: boolean;
     }): void;

package/dist/source/core/options.js

@@ -68,8 +68,8 @@ function hasCredentialInUrl(url, credential) {
 }
 export const hasExplicitCredentialInUrlChange = (changedState, url, credential) => (changedState.has(credential)
     || (changedState.has('url') && url?.[credential] !== ''));
-const hasProtocolSlashes = (value) => /^[a-z][a-z\d+.-]*:\/\//i.test(value);
-const hasHttpProtocolWithoutSlashes = (value) => /^https?:(?!\/\/)/i.test(value);
+const hasProtocolSlashes = (value) => /^[a-z][\d+\-.a-z]*:\/\//iv.test(value);
+const hasHttpProtocolWithoutSlashes = (value) => /^https?:(?!\/\/)/iv.test(value);
 export function applyUrlOverride(options, url, { username, password } = {}) {
     if (is.string(url) && options.url) {
         url = new URL(url, options.url).toString();
@@ -486,7 +486,7 @@ export default class Options {
         // would get merged. Instead we set the `searchParams` first, then
         // `url.searchParams` is overwritten as expected.
         //
-        /* eslint-disable no-unsafe-finally */
+        /* eslint-disable no-unsafe-finally -- `finally` is used intentionally here to ensure `url` is always set last, overwriting any merged searchParams */
         try {
             if (is.plainObject(input)) {
                 try {
@@ -912,16 +912,14 @@ export default class Options {
             this.#internals.cookieJar = undefined;
             return;
         }
-        let { setCookie, getCookieString } = value;
+        const { setCookie, getCookieString } = value;
         assert.function(setCookie);
         assert.function(getCookieString);
         /* istanbul ignore next: Horrible `tough-cookie` v3 check */
         if (setCookie.length === 4 && getCookieString.length === 0) {
-            setCookie = promisify(setCookie.bind(value));
-            getCookieString = promisify(getCookieString.bind(value));
             this.#internals.cookieJar = {
-                setCookie,
-                getCookieString: getCookieString,
+                setCookie: promisify(setCookie.bind(value)),
+                getCookieString: promisify(getCookieString.bind(value)),
             };
         }
         else {
@@ -1408,6 +1406,35 @@ export default class Options {
             this.deleteInternalHeader(header);
         }
     }
+    clearUnchangedCookieHeader(previousState, changedState) {
+        if (previousState?.hadCookieJar
+            && this.cookieJar === undefined
+            && !this.isHeaderExplicitlySet('cookie')
+            && !changedState?.has('cookie')
+            && this.headers.cookie === previousState.headers.cookie) {
+            this.deleteInternalHeader('cookie');
+        }
+    }
+    restoreCookieHeader(previousState, headers) {
+        if (!previousState) {
+            return;
+        }
+        if (Object.hasOwn(headers ?? {}, 'cookie')) {
+            return;
+        }
+        if (previousState.cookieWasExplicitlySet) {
+            this.headers.cookie = previousState.headers.cookie;
+            return;
+        }
+        delete this.headers.cookie;
+        if (previousState.headers.cookie !== undefined) {
+            this.setInternalHeader('cookie', previousState.headers.cookie);
+        }
+    }
+    syncCookieHeaderAfterMerge(previousState, headers) {
+        this.restoreCookieHeader(previousState, headers);
+        this.clearUnchangedCookieHeader(previousState);
+    }
     stripUnchangedCrossOriginState(previousState, changedState, { clearBody = true } = {}) {
         const headers = this.getInternalHeaders();
         const url = this.#internals.url;
@@ -1792,11 +1819,11 @@ export default class Options {
         this.#internals.resolveBodyOnly = value;
     }
     /**
-    @internal
     Returns a `Stream` instead of a `Promise`.
     Set internally by `got.stream()`.
 
     @default false
+    @internal
     */
     get isStream() {
         return this.#internals.isStream;
@@ -1945,7 +1972,7 @@ export default class Options {
         }
         let unixSocketGroups;
         if (unixSocketPath !== undefined) {
-            unixSocketGroups = /(?<socketPath>.+?):(?<path>.+)/.exec(`${url.pathname}${url.search}`)?.groups;
+            unixSocketGroups = /^(?<socketPath>[^:]+):(?<path>.+)$/v.exec(`${url.pathname}${url.search}`)?.groups;
         }
         const unixOptions = unixSocketGroups
             ? { socketPath: unixSocketGroups.socketPath, path: unixSocketGroups.path, host: '' }
@@ -2113,6 +2140,8 @@ export default class Options {
 }
 export const snapshotCrossOriginState = (options) => ({
     headers: { ...options.getInternalHeaders() },
+    hadCookieJar: options.cookieJar !== undefined,
+    cookieWasExplicitlySet: options.isHeaderExplicitlySet('cookie'),
     username: options.username,
     password: options.password,
     body: options.body,

package/dist/source/core/parse-link-header.js

@@ -1,9 +1,56 @@
+const splitHeaderValue = (value, separator) => {
+    const values = [];
+    let current = '';
+    let inQuotes = false;
+    let inReference = false;
+    let isEscaped = false;
+    for (const character of value) {
+        if (inQuotes && isEscaped) {
+            current += character;
+            isEscaped = false;
+            continue;
+        }
+        if (inQuotes && character === '\\') {
+            current += character;
+            isEscaped = true;
+            continue;
+        }
+        if (character === '"') {
+            inQuotes = !inQuotes;
+            current += character;
+            continue;
+        }
+        if (!inQuotes && character === '<') {
+            inReference = true;
+            current += character;
+            continue;
+        }
+        if (!inQuotes && character === '>') {
+            inReference = false;
+            current += character;
+            continue;
+        }
+        // Link headers use both quoted strings and <URI-reference> values, so raw
+        // splitting on `,` / `;` would break valid values containing those characters.
+        if (!inQuotes && !inReference && character === separator) {
+            values.push(current);
+            current = '';
+            continue;
+        }
+        current += character;
+    }
+    if (inQuotes || isEscaped) {
+        throw new Error(`Failed to parse Link header: ${value}`);
+    }
+    values.push(current);
+    return values;
+};
 export default function parseLinkHeader(link) {
     const parsed = [];
-    const items = link.split(',');
+    const items = splitHeaderValue(link, ',');
     for (const item of items) {
         // https://tools.ietf.org/html/rfc5988#section-5
-        const [rawUriReference, ...rawLinkParameters] = item.split(';');
+        const [rawUriReference, ...rawLinkParameters] = splitHeaderValue(item, ';');
         const trimmedUriReference = rawUriReference.trim();
         // eslint-disable-next-line @typescript-eslint/prefer-string-starts-ends-with
         if (trimmedUriReference[0] !== '<' || trimmedUriReference.at(-1) !== '>') {
@@ -11,6 +58,9 @@ export default function parseLinkHeader(link) {
         }
         const reference = trimmedUriReference.slice(1, -1);
         const parameters = {};
+        if (reference.includes('<') || reference.includes('>')) {
+            throw new Error(`Invalid format of the Link header reference: ${trimmedUriReference}`);
+        }
         if (rawLinkParameters.length === 0) {
             throw new Error(`Unexpected end of Link header parameters: ${rawLinkParameters.join(';')}`);
         }

package/dist/source/core/timed-out.js

@@ -81,7 +81,7 @@ export default function timedOut(request, delays, options) {
             const { socketPath } = request;
             /* istanbul ignore next: hard to test */
             if (socket.connecting) {
-                const hasPath = Boolean(socketPath ?? net.isIP(hostname ?? host ?? '') !== 0);
+                const hasPath = Boolean(socketPath ?? (net.isIP(hostname ?? host ?? '') !== 0));
                 if (hasLookup && !hasPath && socket.address().address === undefined) {
                     const cancelTimeout = addTimeout(delays.lookup, timeoutHandler, 'lookup');
                     once(socket, 'lookup', cancelTimeout);

package/dist/source/core/utils/is-unix-socket-url.d.ts

@@ -1,4 +1,4 @@
-export default function isUnixSocketURL(url: URL): boolean;
+export default function isUnixSocketUrl(url: URL): boolean;
 /**
 Extract the socket path from a UNIX socket URL.
 

package/dist/source/core/utils/is-unix-socket-url.js

@@ -1,5 +1,4 @@
-// eslint-disable-next-line @typescript-eslint/naming-convention
-export default function isUnixSocketURL(url) {
+export default function isUnixSocketUrl(url) {
     return url.protocol === 'unix:' || url.hostname === 'unix';
 }
 /**
@@ -18,8 +17,8 @@ getUnixSocketPath(new URL('http://example.com'));
 ```
 */
 export function getUnixSocketPath(url) {
-    if (!isUnixSocketURL(url)) {
+    if (!isUnixSocketUrl(url)) {
         return undefined;
     }
-    return /(?<socketPath>.+?):(?<path>.+)/.exec(`${url.pathname}${url.search}`)?.groups?.socketPath;
+    return /^(?<socketPath>[^:]+):/v.exec(`${url.pathname}${url.search}`)?.groups?.socketPath;
 }

package/dist/source/create.js

@@ -180,6 +180,7 @@ const create = (defaults) => {
             }
             if (optionsToMerge === response.request.options) {
                 normalizedOptions = response.request.options;
+                normalizedOptions.clearUnchangedCookieHeader(previousState, changedState);
                 if (previousUrl) {
                     const nextUrl = normalizedOptions.url;
                     if (nextUrl && !isSameOrigin(previousUrl, nextUrl)) {
@@ -192,10 +193,15 @@ const create = (defaults) => {
                 const hasExplicitBody = (Object.hasOwn(optionsToMerge, 'body') && optionsToMerge.body !== undefined)
                     || (Object.hasOwn(optionsToMerge, 'json') && optionsToMerge.json !== undefined)
                     || (Object.hasOwn(optionsToMerge, 'form') && optionsToMerge.form !== undefined);
+                const clearsCookieJar = Object.hasOwn(optionsToMerge, 'cookieJar') && optionsToMerge.cookieJar === undefined;
                 if (hasExplicitBody) {
                     normalizedOptions.clearBody();
                 }
+                if (clearsCookieJar) {
+                    normalizedOptions.cookieJar = undefined;
+                }
                 normalizedOptions.merge(optionsToMerge);
+                normalizedOptions.syncCookieHeaderAfterMerge(previousState, optionsToMerge.headers);
                 try {
                     assert.any([is.string, is.urlInstance, is.undefined], optionsToMerge.url);
                 }

package/dist/source/types.d.ts

@@ -59,10 +59,9 @@ export type ExtendOptions = {
     */
     mutableDefaults?: boolean;
 } & Except<OptionsInit, 'url'>;
-type OptionsInitWithoutUrl = Except<OptionsInit, 'url'>;
-export type StrictOptions = Except<OptionsInitWithoutUrl, 'responseType' | 'resolveBodyOnly'>;
-export type StreamOptions = OptionsInitWithoutUrl;
-export type OptionsWithPagination<T = unknown, R = unknown> = Merge<OptionsInitWithoutUrl, {
+export type StreamOptions = Except<OptionsInit, 'url'>;
+export type StrictOptions = Except<StreamOptions, 'responseType' | 'resolveBodyOnly'>;
+export type OptionsWithPagination<T = unknown, R = unknown> = Merge<StreamOptions, {
     pagination?: PaginationOptions<T, R>;
 }>;
 /**
@@ -188,9 +187,9 @@ export type GotRequestFunction<U extends ExtendOptions = Record<string, unknown>
     (options: OptionsOfTextResponseBodyOnly): RequestPromise<string>;
     <T>(options: OptionsOfJSONResponseBodyOnly): RequestPromise<T>;
     (options: OptionsOfBufferResponseBodyOnly): RequestPromise<Uint8Array<ArrayBuffer>>;
-    (url: string | URL, options?: OptionsInitWithoutUrl): RequestPromise | Request;
-    (options: OptionsInitWithoutUrl): RequestPromise | Request;
-    (url: undefined, options: undefined, defaults: Options): RequestPromise | Request;
+    (url: string | URL, options?: StreamOptions): RequestPromise;
+    (options: StreamOptions): RequestPromise;
+    (url: undefined, options: undefined, defaults: Options): RequestPromise;
 };
 /**
 All available HTTP request methods provided by Got.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "got",
-	"version": "15.0.0",
+	"version": "15.0.2",
 	"description": "Human-friendly and powerful HTTP request library for Node.js",
 	"license": "MIT",
 	"repository": "sindresorhus/got",

package/readme.md

@@ -254,13 +254,11 @@ By default, Got will retry on failure. To disable this option, set [`options.ret
 [s3]: https://www.npmjs.com/package/superagent
 
 <!-- COVERAGE -->
-[gc]: https://img.shields.io/coveralls/github/sindresorhus/got?color=0b9062&label
 [kc]: https://img.shields.io/codecov/c/github/sindresorhus/ky?color=0b9062&label
 [nc]: https://img.shields.io/coveralls/github/bitinn/node-fetch?color=0b9062&label
 [ac]: https://img.shields.io/coveralls/github/mzabriskie/axios?color=0b9062&label
 [sc]: https://img.shields.io/codecov/c/github/visionmedia/superagent?color=0b9062&label
 
-[g4]: https://coveralls.io/github/sindresorhus/got
 [k4]: https://codecov.io/gh/sindresorhus/ky
 [n4]: https://coveralls.io/github/bitinn/node-fetch
 [a4]: https://coveralls.io/github/mzabriskie/axios
@@ -342,7 +340,6 @@ By default, Got will retry on failure. To disable this option, set [`options.ret
 [k10]: https://github.com/sindresorhus/ky
 [n10]: https://github.com/node-fetch/node-fetch
 [a10]: https://github.com/axios/axios
-[s10]: https://github.com/visionmedia/superagent
 
 <!-- LAST COMMIT -->
 [glc]: https://img.shields.io/github/last-commit/sindresorhus/got?color=gray&label