got 15.0.2 → 15.0.3

package/dist/source/core/index.js

@@ -25,6 +25,11 @@ import { generateRequestId, publishRequestCreate, publishRequestStart, publishRe
 const supportsBrotli = is.string(process.versions.brotli);
 const supportsZstd = is.string(process.versions.zstd);
 const methodsWithoutBody = new Set(['GET', 'HEAD']);
+const singleValueRequestHeaders = new Set([
+    'authorization',
+    'content-length',
+    'proxy-authorization',
+]);
 const cacheableStore = new WeakableMap();
 const redirectCodes = new Set([301, 302, 303, 307, 308]);
 export { crossOriginStripHeaders } from './options.js';
@@ -698,6 +703,9 @@ export default class Request extends Duplex {
             response = decompressResponse(response);
             typedResponse = prepareResponse(response);
         }
+        // `decompressResponse` wraps the response stream when it decompresses,
+        // so `response !== nativeResponse` indicates decompression happened.
+        const wasDecompressed = response !== nativeResponse;
         this._responseSize = Number(response.headers['content-length']) || undefined;
         this.response = typedResponse;
         // eslint-disable-next-line @typescript-eslint/naming-convention
@@ -711,10 +719,26 @@ export default class Request extends Duplex {
             isFromCache: typedResponse.isFromCache,
         });
         response.once('error', (error) => {
+            // Node synthesizes ECONNRESET for close-delimited responses after all body
+            // bytes have been delivered. Only ignore that late synthetic error on the
+            // native response. Wrapped decompression streams surface real checksum and
+            // truncation failures after the underlying response has completed.
+            if (!wasDecompressed
+                && response.complete
+                && this._responseSize === undefined
+                && error.code === 'ECONNRESET') {
+                return;
+            }
             this._aborted = true;
             this._beforeError(new ReadError(error, this));
         });
         response.once('aborted', () => {
+            // Without Content-Length, connection close is the intended EOF signal (RFC 9110 §8.6),
+            // not a premature abort. For wrapped decompression streams, rely on the native
+            // response completion state because the wrapper strips `content-length`.
+            if (this._responseSize === undefined && nativeResponse.complete) {
+                return;
+            }
             this._aborted = true;
             // Check if there's a content-length mismatch to provide a more specific error
             if (!this._checkContentLengthMismatch()) {
@@ -907,9 +931,6 @@ export default class Request extends Duplex {
             this._beforeError(new HTTPError(typedResponse));
             return;
         }
-        // `decompressResponse` wraps the response stream when it decompresses,
-        // so `response !== nativeResponse` indicates decompression happened.
-        const wasDecompressed = response !== nativeResponse;
         // Store the expected content-length from the native response for validation.
         // This is the content-length before decompression, which is what actually gets transferred.
         // Skip storing for responses that shouldn't have bodies per RFC 9110.
@@ -1528,11 +1549,6 @@ export default class Request extends Duplex {
     }
     async _makeRequest() {
         const { options } = this;
-        const initialHeaders = options.getInternalHeaders();
-        const explicitAuthorizationHeader = options.isHeaderExplicitlySet('authorization') ? initialHeaders.authorization : undefined;
-        const explicitCookieHeader = options.isHeaderExplicitlySet('cookie') ? initialHeaders.cookie : undefined;
-        const authorizationWasInitiallyOmitted = options.isHeaderExplicitlySet('authorization') && is.undefined(initialHeaders.authorization);
-        const cookieWasInitiallyOmitted = options.isHeaderExplicitlySet('cookie') && is.undefined(initialHeaders.cookie);
         const shouldDeleteGeneratedHeader = (currentHeader, generatedHeader) => currentHeader === generatedHeader || is.undefined(currentHeader);
         const syncGeneratedHeader = (name, { currentHeader, explicitHeader, nextHeader, staleGeneratedHeader, }) => {
             if (!is.undefined(nextHeader)) {
@@ -1557,6 +1573,22 @@ export default class Request extends Duplex {
                 else if (is.null(currentHeaders[key])) {
                     throw new TypeError(`Use \`undefined\` instead of \`null\` to delete the \`${key}\` header`);
                 }
+                else if (Array.isArray(currentHeaders[key]) && key === 'transfer-encoding') {
+                    // Node serializes request header arrays as repeated field lines. Keep framing
+                    // unambiguous by allowing only one transfer-encoding value here.
+                    if (currentHeaders[key].length !== 1) {
+                        throw new TypeError(`The \`${key}\` header must be a single value`);
+                    }
+                    options.setInternalHeader(key, currentHeaders[key][0]);
+                }
+                else if (Array.isArray(currentHeaders[key]) && singleValueRequestHeaders.has(key)) {
+                    // Duplicate credential and content-length lines are not allowed on requests.
+                    // Normalize a single-element array to match the long-supported string path.
+                    if (currentHeaders[key].length !== 1) {
+                        throw new TypeError(`The \`${key}\` header must be a single value`);
+                    }
+                    options.setInternalHeader(key, currentHeaders[key][0]);
+                }
             }
             return currentHeaders;
         };
@@ -1568,6 +1600,12 @@ export default class Request extends Duplex {
             return is.nonEmptyString(cookieString) ? cookieString : undefined;
         };
         const headers = sanitizeHeaders();
+        const initialHeaders = options.getInternalHeaders();
+        const authorizationWasInitiallyExplicit = options.isHeaderExplicitlySet('authorization');
+        const explicitAuthorizationHeader = authorizationWasInitiallyExplicit ? initialHeaders.authorization : undefined;
+        const explicitCookieHeader = options.isHeaderExplicitlySet('cookie') ? initialHeaders.cookie : undefined;
+        const authorizationWasInitiallyOmitted = options.isHeaderExplicitlySet('authorization') && is.undefined(initialHeaders.authorization);
+        const cookieWasInitiallyOmitted = options.isHeaderExplicitlySet('cookie') && is.undefined(initialHeaders.cookie);
         if (options.decompress && is.undefined(headers['accept-encoding'])) {
             const encodings = ['gzip', 'deflate'];
             if (supportsBrotli) {
@@ -1580,7 +1618,11 @@ export default class Request extends Duplex {
         }
         const { username, password } = options;
         const cookieJar = options.cookieJar;
-        const generatedAuthorizationHeader = getAuthorizationHeader(username, password, authorizationWasInitiallyOmitted);
+        // Preserve an explicit Authorization header over URL-derived Basic auth. This keeps
+        // normalized single-element arrays aligned with the long-supported string behavior.
+        const generatedAuthorizationHeader = is.undefined(explicitAuthorizationHeader)
+            ? getAuthorizationHeader(username, password, authorizationWasInitiallyOmitted)
+            : undefined;
         let generatedCookieHeader;
         if (!is.undefined(generatedAuthorizationHeader)) {
             options.setInternalHeader('authorization', generatedAuthorizationHeader);
@@ -1610,11 +1652,21 @@ export default class Request extends Duplex {
             // `headers.authorization = undefined` / `headers.cookie = undefined` is an
             // explicit opt-out. Respect that instead of regenerating values from URL
             // credentials or the cookie jar later in request setup.
-            const isHeaderExplicitlyOmitted = (header) => options.isHeaderExplicitlySet(header) && is.undefined(currentHeaders[header]);
-            const authorizationWasExplicitlyOmitted = isHeaderExplicitlyOmitted('authorization');
-            const cookieWasExplicitlyOmitted = isHeaderExplicitlyOmitted('cookie');
+            const isHeaderExplicitlyOmitted = (header) => options.isHeaderExplicitlySet(header)
+                && Object.hasOwn(currentHeaders, header)
+                && is.undefined(currentHeaders[header]);
             const currentAuthorizationHeader = currentHeaders.authorization;
             const currentCookieHeader = currentHeaders.cookie;
+            // Authorization follows a small contract:
+            // - A concrete Authorization header is sent as-is.
+            // - `authorization = undefined` means omit Authorization entirely, including URL auth.
+            // - Deleting an Authorization header that started explicit also means omit it.
+            // - Otherwise, if the request did not start with explicit Authorization, Got may
+            //   generate Basic auth from the current username/password.
+            const authorizationWasExplicitlyOmitted = isHeaderExplicitlyOmitted('authorization')
+                || (authorizationWasInitiallyExplicit && is.undefined(currentAuthorizationHeader));
+            const cookieWasExplicitlyOmitted = is.undefined(currentCookieHeader)
+                && (cookieWasInitiallyOmitted || isHeaderExplicitlyOmitted('cookie'));
             sanitizeHeaders();
             if (!is.undefined(currentHeaders['transfer-encoding']) && !is.undefined(currentHeaders['content-length'])) {
                 options.deleteInternalHeader('content-length');
@@ -1626,15 +1678,22 @@ export default class Request extends Duplex {
                     delete options.headers.authorization;
                 }
             }
-            const authorizationHeader = getAuthorizationHeader(options.username, options.password, authorizationWasExplicitlyOmitted);
+            const authorizationHeader = !authorizationWasInitiallyExplicit
+                && !authorizationWasInitiallyOmitted
+                && !authorizationWasExplicitlyOmitted
+                ? getAuthorizationHeader(options.username, options.password, authorizationWasExplicitlyOmitted)
+                : undefined;
             const cookieJar = options.cookieJar;
-            if (changedState.has('authorization')) {
+            if (changedState.has('authorization') && !is.undefined(currentAuthorizationHeader)) {
                 // A beforeRequest hook intentionally set the outgoing Authorization header.
             }
             else {
+                const restorableAuthorizationHeader = changedState.has('authorization') && is.undefined(currentAuthorizationHeader)
+                    ? undefined
+                    : explicitAuthorizationHeader;
                 syncGeneratedHeader('authorization', {
                     currentHeader: currentAuthorizationHeader,
-                    explicitHeader: explicitAuthorizationHeader,
+                    explicitHeader: restorableAuthorizationHeader,
                     nextHeader: authorizationHeader,
                     staleGeneratedHeader: generatedAuthorizationHeader,
                 });
@@ -1649,10 +1708,13 @@ export default class Request extends Duplex {
                 // A beforeRequest hook intentionally set the outgoing Cookie header.
             }
             else {
+                const cookieHeader = !cookieWasInitiallyOmitted && !cookieWasExplicitlyOmitted
+                    ? await getCookieHeader(cookieJar)
+                    : undefined;
                 syncGeneratedHeader('cookie', {
                     currentHeader: currentCookieHeader,
                     explicitHeader: explicitCookieHeader,
-                    nextHeader: await getCookieHeader(cookieJar),
+                    nextHeader: cookieHeader,
                     staleGeneratedHeader: generatedCookieHeader,
                 });
             }

package/dist/source/core/options.d.ts

@@ -1464,6 +1464,7 @@ export default class Options {
     set strictContentLength(value: boolean);
     toJSON(): {
         timeout: Delays;
+        localAddress: string | undefined;
         headers: Headers;
         request: RequestFunction | undefined;
         json: unknown;
@@ -1496,7 +1497,6 @@ export default class Options {
         dnsLookupIpVersion: DnsLookupIpVersion;
         parseJson: ParseJsonFunction;
         stringifyJson: StringifyJsonFunction;
-        localAddress: string | undefined;
         method: Method;
         createConnection: CreateConnectionFunction | undefined;
         cacheOptions: CacheOptions;

package/dist/source/core/options.js

@@ -93,13 +93,14 @@ function assertValidHeaderName(name) {
 Safely assign own properties from source to target, skipping `__proto__` to prevent prototype pollution from JSON.parse'd input.
 */
 function safeObjectAssign(target, source) {
-    for (const key of Object.keys(source)) {
+    for (const [key, value] of Object.entries(source)) {
         if (key === '__proto__') {
             continue;
         }
-        target[key] = source[key];
+        Reflect.set(target, key, value);
     }
 }
+const isToughCookieJar = (cookieJar) => cookieJar.setCookie.length === 4 && cookieJar.getCookieString.length === 0;
 function validateSearchParameters(searchParameters) {
     for (const key of Object.keys(searchParameters)) {
         if (key === '__proto__') {
@@ -916,10 +917,10 @@ export default class Options {
         assert.function(setCookie);
         assert.function(getCookieString);
         /* istanbul ignore next: Horrible `tough-cookie` v3 check */
-        if (setCookie.length === 4 && getCookieString.length === 0) {
+        if (isToughCookieJar(value)) {
             this.#internals.cookieJar = {
-                setCookie: promisify(setCookie.bind(value)),
-                getCookieString: promisify(getCookieString.bind(value)),
+                setCookie: promisify(value.setCookie.bind(value)),
+                getCookieString: promisify(value.getCookieString.bind(value)),
             };
         }
         else {

package/dist/source/core/utils/timer.js

@@ -1,6 +1,10 @@
 import { errorMonitor } from 'node:events';
 import { types } from 'node:util';
 import deferToConnect from './defer-to-connect.js';
+const getInitialConnectionTimings = (socket) => Reflect.get(socket, '__initial_connection_timings__');
+const setInitialConnectionTimings = (socket, timings) => {
+    Reflect.set(socket, '__initial_connection_timings__', timings);
+};
 const timer = (request) => {
     if (request.timings) {
         return request.timings;
@@ -58,11 +62,12 @@ const timer = (request) => {
             // original connection so they're not lost.
             timings.lookup = timings.socket;
             timings.connect = timings.socket;
-            if (socket.__initial_connection_timings__) {
+            const initialConnectionTimings = getInitialConnectionTimings(socket);
+            if (initialConnectionTimings) {
                 // Restore the phase timings from the initial connection
-                timings.phases.dns = socket.__initial_connection_timings__.dnsPhase;
-                timings.phases.tcp = socket.__initial_connection_timings__.tcpPhase;
-                timings.phases.tls = socket.__initial_connection_timings__.tlsPhase;
+                timings.phases.dns = initialConnectionTimings.dnsPhase;
+                timings.phases.tcp = initialConnectionTimings.tcpPhase;
+                timings.phases.tls = initialConnectionTimings.tlsPhase;
                 // Set secureConnect timestamp if there was TLS
                 if (timings.phases.tls !== undefined) {
                     timings.secureConnect = timings.socket;
@@ -100,18 +105,21 @@ const timer = (request) => {
                     timings.phases.dns = 0;
                 }
                 // Store connection phase timings on socket for potential reuse
-                socket.__initial_connection_timings__ ??= {
-                    dnsPhase: timings.phases.dns,
-                    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- TypeScript can't prove this is defined due to callback structure
-                    tcpPhase: timings.phases.tcp,
-                };
+                if (!getInitialConnectionTimings(socket)) {
+                    setInitialConnectionTimings(socket, {
+                        dnsPhase: timings.phases.dns,
+                        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- TypeScript can't prove this is defined due to callback structure
+                        tcpPhase: timings.phases.tcp,
+                    });
+                }
             },
             secureConnect() {
                 timings.secureConnect = Date.now();
                 timings.phases.tls = timings.secureConnect - timings.connect;
                 // Update stored timings with TLS phase timing
-                if (socket.__initial_connection_timings__) {
-                    socket.__initial_connection_timings__.tlsPhase = timings.phases.tls;
+                const initialConnectionTimings = getInitialConnectionTimings(socket);
+                if (initialConnectionTimings) {
+                    initialConnectionTimings.tlsPhase = timings.phases.tls;
                 }
             },
         });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "got",
-	"version": "15.0.2",
+	"version": "15.0.3",
 	"description": "Human-friendly and powerful HTTP request library for Node.js",
 	"license": "MIT",
 	"repository": "sindresorhus/got",
@@ -51,7 +51,7 @@
 		"ky"
 	],
 	"dependencies": {
-		"@sindresorhus/is": "^7.2.0",
+		"@sindresorhus/is": "^8.0.0",
 		"byte-counter": "^0.1.0",
 		"cacheable-lookup": "^7.0.0",
 		"cacheable-request": "^13.0.18",
@@ -61,27 +61,27 @@
 		"keyv": "^5.6.0",
 		"lowercase-keys": "^4.0.1",
 		"responselike": "^4.0.2",
-		"type-fest": "^5.4.4",
+		"type-fest": "^5.6.0",
 		"uint8array-extras": "^1.5.0"
 	},
 	"devDependencies": {
 		"@hapi/bourne": "^3.0.0",
 		"@sindresorhus/tsconfig": "^8.1.0",
-		"@sinonjs/fake-timers": "^15.1.0",
+		"@sinonjs/fake-timers": "^15.3.2",
 		"@types/benchmark": "^2.1.5",
 		"@types/express": "^5.0.6",
-		"@types/node": "^25.3.0",
+		"@types/node": "^25.6.0",
 		"@types/pem": "^1.14.4",
 		"@types/readable-stream": "^4.0.23",
 		"@types/request": "^2.48.13",
 		"@types/sinon": "^21.0.0",
 		"@types/sinonjs__fake-timers": "^15.0.1",
 		"ava": "^6.4.1",
-		"axios": "^1.13.5",
+		"axios": "^1.15.1",
 		"benchmark": "^2.1.4",
 		"bluebird": "^3.7.2",
 		"body-parser": "^2.2.2",
-		"c8": "^10.1.3",
+		"c8": "^11.0.0",
 		"create-cert": "^1.0.6",
 		"create-test-server": "^3.0.1",
 		"del-cli": "^7.0.0",
@@ -90,14 +90,14 @@
 		"express": "^5.2.1",
 		"get-stream": "^9.0.1",
 		"node-fetch": "^3.3.2",
-		"np": "^11.0.2",
+		"np": "^11.2.0",
 		"p-event": "^7.1.0",
 		"pem": "^1.14.8",
 		"pify": "^6.1.0",
 		"quick-lru": "^7.3.0",
 		"readable-stream": "^4.7.0",
 		"request": "^2.88.2",
-		"sinon": "^21.0.1",
+		"sinon": "^21.1.2",
 		"slow-stream": "0.0.4",
 		"tempy": "^3.2.0",
 		"then-busboy": "^5.2.1",