cacheable-request - fix: pass the response status to the cache policy - #1757

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Bug fix.

Fixes #1755

Problem

cacheable-request creates the cache policy with new CachePolicy(options_, response, options_). The response is a Node IncomingMessage. http-cache-semantics reads the status code from response.status, but an IncomingMessage has only statusCode. Thus the policy used status 200 for each new response.

Because of this, the cache did these things:

• It stored a 206 Partial Content response to a Range request under the plain URL. A later request without Range got the partial body from the cache.
• It stored error responses such as 503 with a Last-Modified header (heuristic freshness), and returned them from the cache.

Change

Set response.status = response.statusCode before new CachePolicy(...). The revalidation path already does this before revalidatedPolicy(...).

Verification

• pnpm test:ci in packages/cacheable-request: Biome check passes, 70 tests pass, 100% statements and lines.
• pnpm build in packages/cacheable-request passes.
• Before the fix, the two new tests fail:
  • A 206 response to a range request is not served for a full request: expected 200, received 206 (from the cache).
  • Error responses with heuristic freshness are not cached: expected cache size 0, received 1.
• After the fix, the two new tests pass.

Test audit (new tests only, no tests changed or deleted):

• A 206 response to a range request is not served for a full request
  1. Contract: a full request does not get a cached partial response.
  2. Regression: the policy does not get the real status, so the 206 response is stored and served.
  3. No current test sends a Range request or gets a 206 response.
  4. No new export or hook. The test uses the public request() API and a test server route.
• Error responses with heuristic freshness are not cached
  1. Contract: a 503 response with only Last-Modified is not stored.
  2. Regression: the policy uses status 200 and applies heuristic freshness to the 503 response.
  3. checks status codes when comparing cache & response uses a 502 response without validators or freshness headers, so it passes with and without the fix.
  4. No new export or hook. The test uses the public request() API and a test server route.