[yxshee]

Credentials in the request URL are sent still percent-encoded. new URL() keeps username and password in their encoded form, and since the switch away from url.parse() (v9.0.2) they go straight into .auth(), so a user like tobi@example.com can't be passed in the URL at all.

request.get('http://tobi%40example.com:learn%20boost%2F@localhost:3000/').end(...)

The server receives Authorization: Basic for tobi%40example.com:learn%20boost%2F. Expected tobi@example.com:learn boost/, which is what http.get() with the same URL sends, and what superagent sent up to 9.0.1.

The node client now runs both parts through decodeURIComponent before calling .auth(), like Node's urlToHttpOptions does. A malformed escape such as a bare %zz is kept as it is instead of throwing.

Tested with a new case in test/node/basic-auth.js. On master it fails with:

AssertionError [ERR_ASSERTION]: 'tobi%40example.com:learn%20boost%2F' == 'tobi@example.com:learn boost/'

With the fix, npm run build, npm run lint (no errors, warnings unchanged) and make test pass on Node 26: 438 passing over HTTP/1 and 432 over HTTP/2.