Make redirect handling configurable in all five languages

[brentrager]

The bug

Redirects were followed unconditionally in all five languages. TypeScript went further than "no option":

merge({}, init, { redirect: 'follow' })

The literal is last, and merge lets later sources win — so a caller passing redirect: 'manual' had it silently overwritten.

There was already a test for this. It asks for 'follow' and asserts 'follow', so it passed under the bug and would have kept passing forever.

	before
TypeScript	caller's setting silently discarded
Python	follow_redirects=True hardcoded into the httpx kwargs
Rust	nothing set → reqwest default, 10 hops
Go	nothing set → http.Client default, 10 hops
.NET	nothing set → AllowAutoRedirect true

Why it matters beyond ergonomics

A caller that resolves a hostname and checks it against an SSRF allowlist has that guard defeated entirely by a 302 to an internal address — the check was performed on the original host. RFC 8461 separately forbids following redirects when fetching an MTA-STS policy.

api-prime hit both and had to hand-roll its own reqwest client to work around this library.

The API

• TypeScript — redirect honoured (defaults first, caller last)
• Python — FetchOptions.follow_redirects
• Rust — RequestInit.follow_redirects: Option<bool>
• Go — ClientBuilder.WithFollowRedirects
• .NET — SmooFetchOptions.FollowRedirects / WithFollowRedirects

Two deliberate choices. Rust uses Option<bool>: a bare bool would make derive(Default) produce false and silently flip behaviour for every existing ..Default::default() caller, and None lets merge_init distinguish "unset" from "explicitly true" so a client-level default isn't clobbered. Go applies the setting to a caller-supplied *http.Client too — unlike the connect timeout — because a security control that silently doesn't apply because you brought your own client is worse than not offering one.

Honouring the option wasn't enough

Four of the five languages proved this in turn: a 3xx is neither ok nor redirected, so it was raised as an error and the option undone a line later. TS, Rust, Go and .NET each now return a deliberately-unfollowed 3xx as an ordinary response. Python already did, via is_redirect.

Two things only the tests caught

.NET's SmooFetchBuilder.Build() copies options field by field. FollowRedirects was honoured by the handler and dropped in transit — the option worked when set directly and did nothing through the builder. That's a standing hazard for every future option, now noted in the code.

.NET wraps JSON deserialization failures in the same HttpResponseError it raises for a bad status. The redirect fixture serves a JSON body deliberately; without one the throwing-path test can't tell "threw for the 3xx" from "threw because an empty body won't deserialize".

Verification

Every language mutation-tested — reverting each fix turns its new tests red.

• TypeScript 43 · Rust 14 suites · Go all · Python 134 · .NET 43
• tsc --noEmit, cargo fmt/clippy -D warnings, go vet, dotnet build all clean

Defaults are unchanged everywhere: everything still follows unless a caller says otherwise, so this is a minor.

Pearl: th-86dc77

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 36fedd8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@smooai/fetch	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR