Summary by cubic

Enforce maxBodyLength for streamed uploads when using the native Node http/https transport (maxRedirects: 0). Prevents oversized bodies from being sent and aligns behavior with follow-redirects.

Description

• Summary of changes: Add a transform pipeline to track bytes and throw when exceeding maxBodyLength only when maxRedirects is 0; pipe uploadStream to the request and destroy on error.
• Reasoning: Previously the limit wasn’t enforced on the native path, allowing large uploads (GHSA-5c9x-8gcm-mpgx). This brings parity with follow-redirects.
• Additional context: No change for redirected requests; only affects streamed uploads on Node with maxRedirects: 0.

Docs

• Note in the Node adapter docs that maxBodyLength is enforced for streamed uploads even when maxRedirects is 0.
• Document the error message: “Request body larger than maxBodyLength limit”.

Testing

• Added two unit tests:
  • Rejects streamed upload exceeding maxBodyLength with maxRedirects: 0.
  • Allows streamed upload under the limit with maxRedirects: 0.

^{Written for commit bf0a349. Summary will update on new commits.}