got 15.0.5 → 15.0.6

package/dist/source/core/options.d.ts

@@ -701,6 +701,8 @@ export type PaginationOptions<ElementType, BodyType> = {
 
     It should return an object representing Got options pointing to the next page. The options are merged automatically with the previous request, therefore the options returned `pagination.paginate(...)` must reflect changes only. If there are no more pages, `false` should be returned.
 
+    When pagination navigates to a different origin, Got strips inherited sensitive headers such as `authorization`, `cookie`, and `proxy-authorization`. If you trust the next-page URL and want to forward a sensitive header, return it explicitly from `pagination.paginate(...)`.
+
     @example
     ```
     import got from 'got';

package/dist/source/core/options.js

@@ -1006,7 +1006,8 @@ export default class Options {
             updated = new URLSearchParams(value);
         }
         else if (value instanceof URLSearchParams) {
-            updated = value;
+            // Clone so the caller-owned object is not stored by reference.
+            updated = new URLSearchParams(value);
         }
         else {
             validateSearchParameters(value);
@@ -1037,10 +1038,11 @@ export default class Options {
             }
         }
         else if (url) {
-            url.search = searchParameters.toString();
+            // Overrides the query string in the URL.
+            url.search = updated.toString();
         }
         else {
-            this.#internals.searchParams = searchParameters;
+            this.#internals.searchParams = updated;
         }
     }
     get searchParameters() {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "got",
-	"version": "15.0.5",
+	"version": "15.0.6",
 	"description": "Human-friendly and powerful HTTP request library for Node.js",
 	"license": "MIT",
 	"repository": "sindresorhus/got",