got 15.0.1 → 15.0.3

package/dist/source/as-promise/index.js

@@ -69,12 +69,18 @@ export default function asPromise(firstRequest) {
                                     : (Object.hasOwn(updatedOptions, 'body') && updatedOptions.body !== undefined)
                                         || (Object.hasOwn(updatedOptions, 'json') && updatedOptions.json !== undefined)
                                         || (Object.hasOwn(updatedOptions, 'form') && updatedOptions.form !== undefined);
+                                const clearsCookieJar = Object.hasOwn(updatedOptions, 'cookieJar') && updatedOptions.cookieJar === undefined;
                                 if (hasExplicitBody && !reusesRequestOptions) {
                                     options.clearBody();
                                 }
+                                if (!reusesRequestOptions && clearsCookieJar) {
+                                    options.cookieJar = undefined;
+                                }
                                 if (!reusesRequestOptions) {
                                     options.merge(updatedOptions);
+                                    options.syncCookieHeaderAfterMerge(previousState, updatedOptions.headers);
                                 }
+                                options.clearUnchangedCookieHeader(previousState, reusesRequestOptions ? changedState : undefined);
                                 if (updatedOptions.url) {
                                     const nextUrl = reusesRequestOptions
                                         ? options.url

package/dist/source/core/index.js

@@ -25,6 +25,11 @@ import { generateRequestId, publishRequestCreate, publishRequestStart, publishRe
 const supportsBrotli = is.string(process.versions.brotli);
 const supportsZstd = is.string(process.versions.zstd);
 const methodsWithoutBody = new Set(['GET', 'HEAD']);
+const singleValueRequestHeaders = new Set([
+    'authorization',
+    'content-length',
+    'proxy-authorization',
+]);
 const cacheableStore = new WeakableMap();
 const redirectCodes = new Set([301, 302, 303, 307, 308]);
 export { crossOriginStripHeaders } from './options.js';
@@ -698,6 +703,9 @@ export default class Request extends Duplex {
             response = decompressResponse(response);
             typedResponse = prepareResponse(response);
         }
+        // `decompressResponse` wraps the response stream when it decompresses,
+        // so `response !== nativeResponse` indicates decompression happened.
+        const wasDecompressed = response !== nativeResponse;
         this._responseSize = Number(response.headers['content-length']) || undefined;
         this.response = typedResponse;
         // eslint-disable-next-line @typescript-eslint/naming-convention
@@ -711,10 +719,26 @@ export default class Request extends Duplex {
             isFromCache: typedResponse.isFromCache,
         });
         response.once('error', (error) => {
+            // Node synthesizes ECONNRESET for close-delimited responses after all body
+            // bytes have been delivered. Only ignore that late synthetic error on the
+            // native response. Wrapped decompression streams surface real checksum and
+            // truncation failures after the underlying response has completed.
+            if (!wasDecompressed
+                && response.complete
+                && this._responseSize === undefined
+                && error.code === 'ECONNRESET') {
+                return;
+            }
             this._aborted = true;
             this._beforeError(new ReadError(error, this));
         });
         response.once('aborted', () => {
+            // Without Content-Length, connection close is the intended EOF signal (RFC 9110 §8.6),
+            // not a premature abort. For wrapped decompression streams, rely on the native
+            // response completion state because the wrapper strips `content-length`.
+            if (this._responseSize === undefined && nativeResponse.complete) {
+                return;
+            }
             this._aborted = true;
             // Check if there's a content-length mismatch to provide a more specific error
             if (!this._checkContentLengthMismatch()) {
@@ -725,6 +749,40 @@ export default class Request extends Duplex {
                 }, this));
             }
         });
+        let canFinalizeResponse = false;
+        const handleResponseEnd = () => {
+            if (!canFinalizeResponse
+                || !response.readableEnded) {
+                return;
+            }
+            canFinalizeResponse = false;
+            if (this._stopReading) {
+                return;
+            }
+            // Validate content-length if it was provided
+            // Per RFC 9112: "If the sender closes the connection before the indicated number
+            // of octets are received, the recipient MUST consider the message to be incomplete"
+            if (this._checkContentLengthMismatch()) {
+                return;
+            }
+            this._responseSize = this._downloadedSize;
+            this.emit('downloadProgress', this.downloadProgress);
+            // Publish response end event
+            publishResponseEnd({
+                requestId: this._requestId,
+                url: typedResponse.url,
+                statusCode,
+                bodySize: this._downloadedSize,
+                timings: this.timings,
+            });
+            this.push(null);
+        };
+        if (!shouldFollowRedirect) {
+            // `set-cookie` handling below awaits the cookie jar. A fast response can fully
+            // end during that await, so we need to observe `end` early without completing
+            // the outward stream until cookie handling has finished.
+            response.once('end', handleResponseEnd);
+        }
         const noPipeCookieJarRawBodyPromise = this._noPipe
             && is.object(options.cookieJar)
             && !isRedirect
@@ -828,6 +886,7 @@ export default class Request extends Duplex {
                     }
                     return changedState;
                 });
+                updatedOptions.clearUnchangedCookieHeader(preHookState, changedState);
                 // If a beforeRedirect hook changed the URL to a different origin,
                 // strip sensitive headers that were preserved for the original origin.
                 // When isDifferentOrigin was already true, headers were already stripped above.
@@ -836,15 +895,7 @@ export default class Request extends Duplex {
                     const hookUrl = updatedOptions.url;
                     if (!isSameOrigin(state.url, hookUrl)) {
                         this._stripUnchangedCrossOriginState(updatedOptions, hookUrl, shouldDropBody, {
-                            headers: state.headers,
-                            username: state.username,
-                            password: state.password,
-                            body: state.body,
-                            json: state.json,
-                            form: state.form,
-                            bodySnapshot: state.bodySnapshot,
-                            jsonSnapshot: state.jsonSnapshot,
-                            formSnapshot: state.formSnapshot,
+                            ...state,
                             changedState,
                             preserveUsername: hasExplicitCredentialInUrlChange(changedState, hookUrl, 'username')
                                 || isCrossOriginCredentialChanged(state.url, hookUrl, 'username'),
@@ -870,6 +921,8 @@ export default class Request extends Duplex {
             }
             return;
         }
+        canFinalizeResponse = true;
+        handleResponseEnd();
         // `HTTPError`s always have `error.response.body` defined.
         // Therefore, we cannot retry if `options.throwHttpErrors` is false.
         // On the last retry, if `options.throwHttpErrors` is false, we would need to return the body,
@@ -878,9 +931,6 @@ export default class Request extends Duplex {
             this._beforeError(new HTTPError(typedResponse));
             return;
         }
-        // `decompressResponse` wraps the response stream when it decompresses,
-        // so `response !== nativeResponse` indicates decompression happened.
-        const wasDecompressed = response !== nativeResponse;
         // Store the expected content-length from the native response for validation.
         // This is the content-length before decompression, which is what actually gets transferred.
         // Skip storing for responses that shouldn't have bodies per RFC 9110.
@@ -894,32 +944,6 @@ export default class Request extends Duplex {
                 }
             }
         }
-        // Set up end listener AFTER redirect check to avoid emitting progress for redirect responses
-        let responseEndHandled = false;
-        const handleResponseEnd = () => {
-            if (responseEndHandled) {
-                return;
-            }
-            responseEndHandled = true;
-            // Validate content-length if it was provided
-            // Per RFC 9112: "If the sender closes the connection before the indicated number
-            // of octets are received, the recipient MUST consider the message to be incomplete"
-            if (this._checkContentLengthMismatch()) {
-                return;
-            }
-            this._responseSize = this._downloadedSize;
-            this.emit('downloadProgress', this.downloadProgress);
-            // Publish response end event
-            publishResponseEnd({
-                requestId: this._requestId,
-                url: typedResponse.url,
-                statusCode,
-                bodySize: this._downloadedSize,
-                timings: this.timings,
-            });
-            this.push(null);
-        };
-        response.once('end', handleResponseEnd);
         this.emit('downloadProgress', this.downloadProgress);
         response.on('readable', () => {
             if (this._triggerRead) {
@@ -1525,17 +1549,63 @@ export default class Request extends Duplex {
     }
     async _makeRequest() {
         const { options } = this;
-        const headers = options.getInternalHeaders();
-        const { username, password } = options;
-        const cookieJar = options.cookieJar;
-        for (const key in headers) {
-            if (is.undefined(headers[key])) {
-                options.deleteInternalHeader(key);
+        const shouldDeleteGeneratedHeader = (currentHeader, generatedHeader) => currentHeader === generatedHeader || is.undefined(currentHeader);
+        const syncGeneratedHeader = (name, { currentHeader, explicitHeader, nextHeader, staleGeneratedHeader, }) => {
+            if (!is.undefined(nextHeader)) {
+                options.setInternalHeader(name, nextHeader);
             }
-            else if (is.null(headers[key])) {
-                throw new TypeError(`Use \`undefined\` instead of \`null\` to delete the \`${key}\` header`);
+            else if (!is.undefined(explicitHeader) && currentHeader === staleGeneratedHeader) {
+                options.setInternalHeader(name, explicitHeader);
             }
-        }
+            else if (shouldDeleteGeneratedHeader(currentHeader, staleGeneratedHeader)) {
+                options.deleteInternalHeader(name);
+            }
+        };
+        const getAuthorizationHeader = (username, password, isExplicitlyOmitted) => !isExplicitlyOmitted && (username || password)
+            ? `Basic ${stringToBase64(`${username}:${password}`)}`
+            : undefined;
+        const sanitizeHeaders = () => {
+            const currentHeaders = options.getInternalHeaders();
+            for (const key in currentHeaders) {
+                if (is.undefined(currentHeaders[key])) {
+                    options.deleteInternalHeader(key);
+                }
+                else if (is.null(currentHeaders[key])) {
+                    throw new TypeError(`Use \`undefined\` instead of \`null\` to delete the \`${key}\` header`);
+                }
+                else if (Array.isArray(currentHeaders[key]) && key === 'transfer-encoding') {
+                    // Node serializes request header arrays as repeated field lines. Keep framing
+                    // unambiguous by allowing only one transfer-encoding value here.
+                    if (currentHeaders[key].length !== 1) {
+                        throw new TypeError(`The \`${key}\` header must be a single value`);
+                    }
+                    options.setInternalHeader(key, currentHeaders[key][0]);
+                }
+                else if (Array.isArray(currentHeaders[key]) && singleValueRequestHeaders.has(key)) {
+                    // Duplicate credential and content-length lines are not allowed on requests.
+                    // Normalize a single-element array to match the long-supported string path.
+                    if (currentHeaders[key].length !== 1) {
+                        throw new TypeError(`The \`${key}\` header must be a single value`);
+                    }
+                    options.setInternalHeader(key, currentHeaders[key][0]);
+                }
+            }
+            return currentHeaders;
+        };
+        const getCookieHeader = async (cookieJar) => {
+            if (!cookieJar) {
+                return undefined;
+            }
+            const cookieString = await cookieJar.getCookieString(options.url.toString());
+            return is.nonEmptyString(cookieString) ? cookieString : undefined;
+        };
+        const headers = sanitizeHeaders();
+        const initialHeaders = options.getInternalHeaders();
+        const authorizationWasInitiallyExplicit = options.isHeaderExplicitlySet('authorization');
+        const explicitAuthorizationHeader = authorizationWasInitiallyExplicit ? initialHeaders.authorization : undefined;
+        const explicitCookieHeader = options.isHeaderExplicitlySet('cookie') ? initialHeaders.cookie : undefined;
+        const authorizationWasInitiallyOmitted = options.isHeaderExplicitlySet('authorization') && is.undefined(initialHeaders.authorization);
+        const cookieWasInitiallyOmitted = options.isHeaderExplicitlySet('cookie') && is.undefined(initialHeaders.cookie);
         if (options.decompress && is.undefined(headers['accept-encoding'])) {
             const encodings = ['gzip', 'deflate'];
             if (supportsBrotli) {
@@ -1546,34 +1616,117 @@ export default class Request extends Duplex {
             }
             options.setInternalHeader('accept-encoding', encodings.join(', '));
         }
-        if (username || password) {
-            const credentials = stringToBase64(`${username}:${password}`);
-            options.setInternalHeader('authorization', `Basic ${credentials}`);
+        const { username, password } = options;
+        const cookieJar = options.cookieJar;
+        // Preserve an explicit Authorization header over URL-derived Basic auth. This keeps
+        // normalized single-element arrays aligned with the long-supported string behavior.
+        const generatedAuthorizationHeader = is.undefined(explicitAuthorizationHeader)
+            ? getAuthorizationHeader(username, password, authorizationWasInitiallyOmitted)
+            : undefined;
+        let generatedCookieHeader;
+        if (!is.undefined(generatedAuthorizationHeader)) {
+            options.setInternalHeader('authorization', generatedAuthorizationHeader);
         }
-        // Set cookies
-        if (cookieJar) {
-            const cookieString = await cookieJar.getCookieString(options.url.toString());
-            if (is.nonEmptyString(cookieString)) {
-                options.setInternalHeader('cookie', cookieString);
+        if (!cookieWasInitiallyOmitted) {
+            generatedCookieHeader = await getCookieHeader(cookieJar);
+            if (!is.undefined(generatedCookieHeader)) {
+                options.setInternalHeader('cookie', generatedCookieHeader);
             }
         }
         let request;
-        for (const hook of options.hooks.beforeRequest) {
-            // eslint-disable-next-line no-await-in-loop
-            const result = await hook(options, { retryCount: this.retryCount });
-            if (!is.undefined(result)) {
-                // @ts-expect-error Skip the type mismatch to support abstract responses
-                request = () => result;
-                break;
+        let shouldOmitRequestUrlCredentials = false;
+        const changedState = await options.trackStateMutations(async (changedState) => {
+            for (const hook of options.hooks.beforeRequest) {
+                // eslint-disable-next-line no-await-in-loop
+                const result = await hook(options, { retryCount: this.retryCount });
+                if (!is.undefined(result)) {
+                    // @ts-expect-error Skip the type mismatch to support abstract responses
+                    request = () => result;
+                    break;
+                }
+            }
+            return changedState;
+        });
+        if (request === undefined) {
+            const currentHeaders = options.getInternalHeaders();
+            // `headers.authorization = undefined` / `headers.cookie = undefined` is an
+            // explicit opt-out. Respect that instead of regenerating values from URL
+            // credentials or the cookie jar later in request setup.
+            const isHeaderExplicitlyOmitted = (header) => options.isHeaderExplicitlySet(header)
+                && Object.hasOwn(currentHeaders, header)
+                && is.undefined(currentHeaders[header]);
+            const currentAuthorizationHeader = currentHeaders.authorization;
+            const currentCookieHeader = currentHeaders.cookie;
+            // Authorization follows a small contract:
+            // - A concrete Authorization header is sent as-is.
+            // - `authorization = undefined` means omit Authorization entirely, including URL auth.
+            // - Deleting an Authorization header that started explicit also means omit it.
+            // - Otherwise, if the request did not start with explicit Authorization, Got may
+            //   generate Basic auth from the current username/password.
+            const authorizationWasExplicitlyOmitted = isHeaderExplicitlyOmitted('authorization')
+                || (authorizationWasInitiallyExplicit && is.undefined(currentAuthorizationHeader));
+            const cookieWasExplicitlyOmitted = is.undefined(currentCookieHeader)
+                && (cookieWasInitiallyOmitted || isHeaderExplicitlyOmitted('cookie'));
+            sanitizeHeaders();
+            if (!is.undefined(currentHeaders['transfer-encoding']) && !is.undefined(currentHeaders['content-length'])) {
+                options.deleteInternalHeader('content-length');
+            }
+            if (authorizationWasExplicitlyOmitted) {
+                shouldOmitRequestUrlCredentials = true;
+                options.deleteInternalHeader('authorization');
+                if (changedState.has('authorization') && is.undefined(explicitAuthorizationHeader) && !authorizationWasInitiallyOmitted) {
+                    delete options.headers.authorization;
+                }
+            }
+            const authorizationHeader = !authorizationWasInitiallyExplicit
+                && !authorizationWasInitiallyOmitted
+                && !authorizationWasExplicitlyOmitted
+                ? getAuthorizationHeader(options.username, options.password, authorizationWasExplicitlyOmitted)
+                : undefined;
+            const cookieJar = options.cookieJar;
+            if (changedState.has('authorization') && !is.undefined(currentAuthorizationHeader)) {
+                // A beforeRequest hook intentionally set the outgoing Authorization header.
+            }
+            else {
+                const restorableAuthorizationHeader = changedState.has('authorization') && is.undefined(currentAuthorizationHeader)
+                    ? undefined
+                    : explicitAuthorizationHeader;
+                syncGeneratedHeader('authorization', {
+                    currentHeader: currentAuthorizationHeader,
+                    explicitHeader: restorableAuthorizationHeader,
+                    nextHeader: authorizationHeader,
+                    staleGeneratedHeader: generatedAuthorizationHeader,
+                });
+            }
+            if (cookieWasExplicitlyOmitted) {
+                options.deleteInternalHeader('cookie');
+                if (changedState.has('cookie') && is.undefined(explicitCookieHeader) && !cookieWasInitiallyOmitted) {
+                    delete options.headers.cookie;
+                }
+            }
+            else if (changedState.has('cookie')) {
+                // A beforeRequest hook intentionally set the outgoing Cookie header.
+            }
+            else {
+                const cookieHeader = !cookieWasInitiallyOmitted && !cookieWasExplicitlyOmitted
+                    ? await getCookieHeader(cookieJar)
+                    : undefined;
+                syncGeneratedHeader('cookie', {
+                    currentHeader: currentCookieHeader,
+                    explicitHeader: explicitCookieHeader,
+                    nextHeader: cookieHeader,
+                    staleGeneratedHeader: generatedCookieHeader,
+                });
             }
-        }
-        if (!is.undefined(headers['transfer-encoding']) && !is.undefined(headers['content-length'])) {
-            // TODO: Throw instead of silently dropping `content-length` in the next major version.
-            options.deleteInternalHeader('content-length');
         }
         request ??= options.getRequestFunction();
-        const url = options.url;
+        const url = shouldOmitRequestUrlCredentials
+            ? new URL(stripUrlAuth(options.url))
+            : options.url;
         this._requestOptions = options.createNativeRequestOptions();
+        if (shouldOmitRequestUrlCredentials) {
+            this._requestOptions.auth = undefined;
+        }
         if (options.cache) {
             this._requestOptions._request = request;
             this._requestOptions.cache = options.cache;

package/dist/source/core/options.d.ts

@@ -31,6 +31,8 @@ export type Agents = {
 export type Headers = Record<string, string | string[] | undefined>;
 export type CrossOriginState = {
     headers: Headers;
+    hadCookieJar: boolean;
+    cookieWasExplicitlySet: boolean;
     username: string;
     password: string;
     body: unknown;
@@ -788,7 +790,7 @@ export declare function applyUrlOverride(options: Options, url: string | URL, {
 All parsing methods supported by Got.
 */
 export type ResponseType = 'json' | 'buffer' | 'text';
-type OptionsToSkip = 'searchParameters' | 'followRedirects' | 'auth' | 'toJSON' | 'merge' | 'isHeaderExplicitlySet' | 'shouldCopyPipedHeader' | 'setPipedHeader' | 'getInternalHeaders' | 'setInternalHeader' | 'deleteInternalHeader' | 'trackStateMutations' | 'clearBody' | 'stripUnchangedCrossOriginState' | 'stripSensitiveHeaders' | 'createNativeRequestOptions' | 'getRequestFunction' | 'freeze';
+type OptionsToSkip = 'searchParameters' | 'followRedirects' | 'auth' | 'toJSON' | 'merge' | 'isHeaderExplicitlySet' | 'shouldCopyPipedHeader' | 'setPipedHeader' | 'getInternalHeaders' | 'setInternalHeader' | 'deleteInternalHeader' | 'trackStateMutations' | 'clearBody' | 'clearUnchangedCookieHeader' | 'restoreCookieHeader' | 'syncCookieHeaderAfterMerge' | 'stripUnchangedCrossOriginState' | 'stripSensitiveHeaders' | 'createNativeRequestOptions' | 'getRequestFunction' | 'freeze';
 export type InternalsType = Except<Options, OptionsToSkip>;
 export type OptionsError = NodeJS.ErrnoException & {
     options?: Options;
@@ -1226,6 +1228,9 @@ export default class Options {
     deleteInternalHeader(name: string): void;
     trackStateMutations<Value>(operation: (changedState: Set<string>) => Promisable<Value>): Promise<Value>;
     clearBody(): void;
+    clearUnchangedCookieHeader(previousState: CrossOriginState | undefined, changedState?: Set<string>): void;
+    restoreCookieHeader(previousState: CrossOriginState | undefined, headers?: Headers): void;
+    syncCookieHeaderAfterMerge(previousState: CrossOriginState | undefined, headers?: Headers): void;
     stripUnchangedCrossOriginState(previousState: CrossOriginState, changedState: Set<string>, { clearBody }?: {
         clearBody?: boolean;
     }): void;
@@ -1459,6 +1464,7 @@ export default class Options {
     set strictContentLength(value: boolean);
     toJSON(): {
         timeout: Delays;
+        localAddress: string | undefined;
         headers: Headers;
         request: RequestFunction | undefined;
         json: unknown;
@@ -1491,7 +1497,6 @@ export default class Options {
         dnsLookupIpVersion: DnsLookupIpVersion;
         parseJson: ParseJsonFunction;
         stringifyJson: StringifyJsonFunction;
-        localAddress: string | undefined;
         method: Method;
         createConnection: CreateConnectionFunction | undefined;
         cacheOptions: CacheOptions;

package/dist/source/core/options.js

@@ -93,13 +93,14 @@ function assertValidHeaderName(name) {
 Safely assign own properties from source to target, skipping `__proto__` to prevent prototype pollution from JSON.parse'd input.
 */
 function safeObjectAssign(target, source) {
-    for (const key of Object.keys(source)) {
+    for (const [key, value] of Object.entries(source)) {
         if (key === '__proto__') {
             continue;
         }
-        target[key] = source[key];
+        Reflect.set(target, key, value);
     }
 }
+const isToughCookieJar = (cookieJar) => cookieJar.setCookie.length === 4 && cookieJar.getCookieString.length === 0;
 function validateSearchParameters(searchParameters) {
     for (const key of Object.keys(searchParameters)) {
         if (key === '__proto__') {
@@ -916,10 +917,10 @@ export default class Options {
         assert.function(setCookie);
         assert.function(getCookieString);
         /* istanbul ignore next: Horrible `tough-cookie` v3 check */
-        if (setCookie.length === 4 && getCookieString.length === 0) {
+        if (isToughCookieJar(value)) {
             this.#internals.cookieJar = {
-                setCookie: promisify(setCookie.bind(value)),
-                getCookieString: promisify(getCookieString.bind(value)),
+                setCookie: promisify(value.setCookie.bind(value)),
+                getCookieString: promisify(value.getCookieString.bind(value)),
             };
         }
         else {
@@ -1406,6 +1407,35 @@ export default class Options {
             this.deleteInternalHeader(header);
         }
     }
+    clearUnchangedCookieHeader(previousState, changedState) {
+        if (previousState?.hadCookieJar
+            && this.cookieJar === undefined
+            && !this.isHeaderExplicitlySet('cookie')
+            && !changedState?.has('cookie')
+            && this.headers.cookie === previousState.headers.cookie) {
+            this.deleteInternalHeader('cookie');
+        }
+    }
+    restoreCookieHeader(previousState, headers) {
+        if (!previousState) {
+            return;
+        }
+        if (Object.hasOwn(headers ?? {}, 'cookie')) {
+            return;
+        }
+        if (previousState.cookieWasExplicitlySet) {
+            this.headers.cookie = previousState.headers.cookie;
+            return;
+        }
+        delete this.headers.cookie;
+        if (previousState.headers.cookie !== undefined) {
+            this.setInternalHeader('cookie', previousState.headers.cookie);
+        }
+    }
+    syncCookieHeaderAfterMerge(previousState, headers) {
+        this.restoreCookieHeader(previousState, headers);
+        this.clearUnchangedCookieHeader(previousState);
+    }
     stripUnchangedCrossOriginState(previousState, changedState, { clearBody = true } = {}) {
         const headers = this.getInternalHeaders();
         const url = this.#internals.url;
@@ -2111,6 +2141,8 @@ export default class Options {
 }
 export const snapshotCrossOriginState = (options) => ({
     headers: { ...options.getInternalHeaders() },
+    hadCookieJar: options.cookieJar !== undefined,
+    cookieWasExplicitlySet: options.isHeaderExplicitlySet('cookie'),
     username: options.username,
     password: options.password,
     body: options.body,

package/dist/source/core/parse-link-header.js

@@ -1,9 +1,56 @@
+const splitHeaderValue = (value, separator) => {
+    const values = [];
+    let current = '';
+    let inQuotes = false;
+    let inReference = false;
+    let isEscaped = false;
+    for (const character of value) {
+        if (inQuotes && isEscaped) {
+            current += character;
+            isEscaped = false;
+            continue;
+        }
+        if (inQuotes && character === '\\') {
+            current += character;
+            isEscaped = true;
+            continue;
+        }
+        if (character === '"') {
+            inQuotes = !inQuotes;
+            current += character;
+            continue;
+        }
+        if (!inQuotes && character === '<') {
+            inReference = true;
+            current += character;
+            continue;
+        }
+        if (!inQuotes && character === '>') {
+            inReference = false;
+            current += character;
+            continue;
+        }
+        // Link headers use both quoted strings and <URI-reference> values, so raw
+        // splitting on `,` / `;` would break valid values containing those characters.
+        if (!inQuotes && !inReference && character === separator) {
+            values.push(current);
+            current = '';
+            continue;
+        }
+        current += character;
+    }
+    if (inQuotes || isEscaped) {
+        throw new Error(`Failed to parse Link header: ${value}`);
+    }
+    values.push(current);
+    return values;
+};
 export default function parseLinkHeader(link) {
     const parsed = [];
-    const items = link.split(',');
+    const items = splitHeaderValue(link, ',');
     for (const item of items) {
         // https://tools.ietf.org/html/rfc5988#section-5
-        const [rawUriReference, ...rawLinkParameters] = item.split(';');
+        const [rawUriReference, ...rawLinkParameters] = splitHeaderValue(item, ';');
         const trimmedUriReference = rawUriReference.trim();
         // eslint-disable-next-line @typescript-eslint/prefer-string-starts-ends-with
         if (trimmedUriReference[0] !== '<' || trimmedUriReference.at(-1) !== '>') {
@@ -11,6 +58,9 @@ export default function parseLinkHeader(link) {
         }
         const reference = trimmedUriReference.slice(1, -1);
         const parameters = {};
+        if (reference.includes('<') || reference.includes('>')) {
+            throw new Error(`Invalid format of the Link header reference: ${trimmedUriReference}`);
+        }
         if (rawLinkParameters.length === 0) {
             throw new Error(`Unexpected end of Link header parameters: ${rawLinkParameters.join(';')}`);
         }

package/dist/source/core/utils/timer.js

@@ -1,6 +1,10 @@
 import { errorMonitor } from 'node:events';
 import { types } from 'node:util';
 import deferToConnect from './defer-to-connect.js';
+const getInitialConnectionTimings = (socket) => Reflect.get(socket, '__initial_connection_timings__');
+const setInitialConnectionTimings = (socket, timings) => {
+    Reflect.set(socket, '__initial_connection_timings__', timings);
+};
 const timer = (request) => {
     if (request.timings) {
         return request.timings;
@@ -58,11 +62,12 @@ const timer = (request) => {
             // original connection so they're not lost.
             timings.lookup = timings.socket;
             timings.connect = timings.socket;
-            if (socket.__initial_connection_timings__) {
+            const initialConnectionTimings = getInitialConnectionTimings(socket);
+            if (initialConnectionTimings) {
                 // Restore the phase timings from the initial connection
-                timings.phases.dns = socket.__initial_connection_timings__.dnsPhase;
-                timings.phases.tcp = socket.__initial_connection_timings__.tcpPhase;
-                timings.phases.tls = socket.__initial_connection_timings__.tlsPhase;
+                timings.phases.dns = initialConnectionTimings.dnsPhase;
+                timings.phases.tcp = initialConnectionTimings.tcpPhase;
+                timings.phases.tls = initialConnectionTimings.tlsPhase;
                 // Set secureConnect timestamp if there was TLS
                 if (timings.phases.tls !== undefined) {
                     timings.secureConnect = timings.socket;
@@ -100,18 +105,21 @@ const timer = (request) => {
                     timings.phases.dns = 0;
                 }
                 // Store connection phase timings on socket for potential reuse
-                socket.__initial_connection_timings__ ??= {
-                    dnsPhase: timings.phases.dns,
-                    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- TypeScript can't prove this is defined due to callback structure
-                    tcpPhase: timings.phases.tcp,
-                };
+                if (!getInitialConnectionTimings(socket)) {
+                    setInitialConnectionTimings(socket, {
+                        dnsPhase: timings.phases.dns,
+                        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- TypeScript can't prove this is defined due to callback structure
+                        tcpPhase: timings.phases.tcp,
+                    });
+                }
             },
             secureConnect() {
                 timings.secureConnect = Date.now();
                 timings.phases.tls = timings.secureConnect - timings.connect;
                 // Update stored timings with TLS phase timing
-                if (socket.__initial_connection_timings__) {
-                    socket.__initial_connection_timings__.tlsPhase = timings.phases.tls;
+                const initialConnectionTimings = getInitialConnectionTimings(socket);
+                if (initialConnectionTimings) {
+                    initialConnectionTimings.tlsPhase = timings.phases.tls;
                 }
             },
         });

package/dist/source/create.js

@@ -180,6 +180,7 @@ const create = (defaults) => {
             }
             if (optionsToMerge === response.request.options) {
                 normalizedOptions = response.request.options;
+                normalizedOptions.clearUnchangedCookieHeader(previousState, changedState);
                 if (previousUrl) {
                     const nextUrl = normalizedOptions.url;
                     if (nextUrl && !isSameOrigin(previousUrl, nextUrl)) {
@@ -192,10 +193,15 @@ const create = (defaults) => {
                 const hasExplicitBody = (Object.hasOwn(optionsToMerge, 'body') && optionsToMerge.body !== undefined)
                     || (Object.hasOwn(optionsToMerge, 'json') && optionsToMerge.json !== undefined)
                     || (Object.hasOwn(optionsToMerge, 'form') && optionsToMerge.form !== undefined);
+                const clearsCookieJar = Object.hasOwn(optionsToMerge, 'cookieJar') && optionsToMerge.cookieJar === undefined;
                 if (hasExplicitBody) {
                     normalizedOptions.clearBody();
                 }
+                if (clearsCookieJar) {
+                    normalizedOptions.cookieJar = undefined;
+                }
                 normalizedOptions.merge(optionsToMerge);
+                normalizedOptions.syncCookieHeaderAfterMerge(previousState, optionsToMerge.headers);
                 try {
                     assert.any([is.string, is.urlInstance, is.undefined], optionsToMerge.url);
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "got",
-	"version": "15.0.1",
+	"version": "15.0.3",
 	"description": "Human-friendly and powerful HTTP request library for Node.js",
 	"license": "MIT",
 	"repository": "sindresorhus/got",
@@ -51,7 +51,7 @@
 		"ky"
 	],
 	"dependencies": {
-		"@sindresorhus/is": "^7.2.0",
+		"@sindresorhus/is": "^8.0.0",
 		"byte-counter": "^0.1.0",
 		"cacheable-lookup": "^7.0.0",
 		"cacheable-request": "^13.0.18",
@@ -61,27 +61,27 @@
 		"keyv": "^5.6.0",
 		"lowercase-keys": "^4.0.1",
 		"responselike": "^4.0.2",
-		"type-fest": "^5.4.4",
+		"type-fest": "^5.6.0",
 		"uint8array-extras": "^1.5.0"
 	},
 	"devDependencies": {
 		"@hapi/bourne": "^3.0.0",
 		"@sindresorhus/tsconfig": "^8.1.0",
-		"@sinonjs/fake-timers": "^15.1.0",
+		"@sinonjs/fake-timers": "^15.3.2",
 		"@types/benchmark": "^2.1.5",
 		"@types/express": "^5.0.6",
-		"@types/node": "^25.3.0",
+		"@types/node": "^25.6.0",
 		"@types/pem": "^1.14.4",
 		"@types/readable-stream": "^4.0.23",
 		"@types/request": "^2.48.13",
 		"@types/sinon": "^21.0.0",
 		"@types/sinonjs__fake-timers": "^15.0.1",
 		"ava": "^6.4.1",
-		"axios": "^1.13.5",
+		"axios": "^1.15.1",
 		"benchmark": "^2.1.4",
 		"bluebird": "^3.7.2",
 		"body-parser": "^2.2.2",
-		"c8": "^10.1.3",
+		"c8": "^11.0.0",
 		"create-cert": "^1.0.6",
 		"create-test-server": "^3.0.1",
 		"del-cli": "^7.0.0",
@@ -90,14 +90,14 @@
 		"express": "^5.2.1",
 		"get-stream": "^9.0.1",
 		"node-fetch": "^3.3.2",
-		"np": "^11.0.2",
+		"np": "^11.2.0",
 		"p-event": "^7.1.0",
 		"pem": "^1.14.8",
 		"pify": "^6.1.0",
 		"quick-lru": "^7.3.0",
 		"readable-stream": "^4.7.0",
 		"request": "^2.88.2",
-		"sinon": "^21.0.1",
+		"sinon": "^21.1.2",
 		"slow-stream": "0.0.4",
 		"tempy": "^3.2.0",
 		"then-busboy": "^5.2.1",