got 15.0.4 → 15.0.6

package/dist/source/core/index.d.ts

@@ -103,7 +103,7 @@ export default class Request extends Duplex implements RequestEvents<Request> {
     private _triggerRead;
     private readonly _jobs;
     private _cancelTimeouts?;
-    private readonly _abortListenerDisposer?;
+    private _abortListenerDisposer?;
     private _flushed;
     private _aborted;
     private _expectedContentLength?;
@@ -123,6 +123,7 @@ export default class Request extends Duplex implements RequestEvents<Request> {
         end?: boolean;
     }): T;
     unpipe<T extends NodeJS.WritableStream>(destination: T): this;
+    private _attachAbortListener;
     private _shouldIncrementallyDecodeBody;
     private _checkContentLengthMismatch;
     private _finalizeBody;

package/dist/source/core/index.js

@@ -218,24 +218,6 @@ export default class Request extends Duplex {
         if (is.nodeStream(body)) {
             body.once('error', this._onBodyError);
         }
-        if (this.options.signal) {
-            const abort = () => {
-                // See https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal/timeout_static#return_value
-                if (this.options.signal?.reason?.name === 'TimeoutError') {
-                    this.destroy(new TimeoutError(this.options.signal.reason, this.timings, this));
-                }
-                else {
-                    this.destroy(new AbortError(this));
-                }
-            };
-            if (this.options.signal.aborted) {
-                abort();
-            }
-            else {
-                const abortListenerDisposer = addAbortListener(this.options.signal, abort);
-                this._abortListenerDisposer = abortListenerDisposer;
-            }
-        }
     }
     async flush() {
         if (this._flushed) {
@@ -243,6 +225,10 @@ export default class Request extends Duplex {
         }
         this._flushed = true;
         try {
+            this._attachAbortListener();
+            if (this.destroyed) {
+                return;
+            }
             await this._finalizeBody();
             if (this.destroyed) {
                 return;
@@ -564,6 +550,30 @@ export default class Request extends Duplex {
         super.unpipe(destination);
         return this;
     }
+    _attachAbortListener() {
+        if (this._abortListenerDisposer) {
+            return;
+        }
+        const { signal } = this.options;
+        if (!signal) {
+            return;
+        }
+        const abort = () => {
+            // See https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal/timeout_static#return_value
+            if (signal.reason?.name === 'TimeoutError') {
+                this.destroy(new TimeoutError(signal.reason, this.timings, this));
+            }
+            else {
+                this.destroy(new AbortError(this));
+            }
+        };
+        if (signal.aborted) {
+            abort();
+        }
+        else {
+            this._abortListenerDisposer = addAbortListener(signal, abort);
+        }
+    }
     _shouldIncrementallyDecodeBody() {
         const { responseType, encoding } = this.options;
         return Boolean(this._noPipe)

package/dist/source/core/options.d.ts

@@ -701,6 +701,8 @@ export type PaginationOptions<ElementType, BodyType> = {
 
     It should return an object representing Got options pointing to the next page. The options are merged automatically with the previous request, therefore the options returned `pagination.paginate(...)` must reflect changes only. If there are no more pages, `false` should be returned.
 
+    When pagination navigates to a different origin, Got strips inherited sensitive headers such as `authorization`, `cookie`, and `proxy-authorization`. If you trust the next-page URL and want to forward a sensitive header, return it explicitly from `pagination.paginate(...)`.
+
     @example
     ```
     import got from 'got';

package/dist/source/core/options.js

@@ -1006,7 +1006,8 @@ export default class Options {
             updated = new URLSearchParams(value);
         }
         else if (value instanceof URLSearchParams) {
-            updated = value;
+            // Clone so the caller-owned object is not stored by reference.
+            updated = new URLSearchParams(value);
         }
         else {
             validateSearchParameters(value);
@@ -1037,10 +1038,11 @@ export default class Options {
             }
         }
         else if (url) {
-            url.search = searchParameters.toString();
+            // Overrides the query string in the URL.
+            url.search = updated.toString();
         }
         else {
-            this.#internals.searchParams = searchParameters;
+            this.#internals.searchParams = updated;
         }
     }
     get searchParameters() {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "got",
-	"version": "15.0.4",
+	"version": "15.0.6",
 	"description": "Human-friendly and powerful HTTP request library for Node.js",
 	"license": "MIT",
 	"repository": "sindresorhus/got",