Fixes #5509

What

CacheHandler.onResponseStart deleted only the request URI's entry on a 2xx/3xx response to an unsafe method. RFC 9111 §4.4 also says caches SHOULD invalidate the URIs in the response's Location and Content-Location header fields when they share the request URI's origin — so the classic POST /collection → 201 Location: /collection/123 flow left a previously cached GET /collection/123 stale.

This adds a #deleteLocationHeaderEntries step to the existing invalidation branch: it resolves each header value against the request URI (relative references included), applies the same-origin check from the RFC's security note (invalidating cross-origin URIs could be abused for cache poisoning), and deletes the matching entry from the store.

Repro / evidence

Origin: GET /target served with Cache-Control: public, s-maxage=100; POST /src answers 201 with Location: <origin>/target.

Before (main @ cb4c2f1, Node 22):

1. GET /target → origin hit, cached
2. POST /src (response carries Location: <origin>/target)
3. GET /target → served from cache (1 origin hit total on /target)

After: step 3 goes back to the origin (2 hits), for both Location and Content-Location, absolute and relative forms. A Location pointing at another origin (even with a path that collides with a cached entry) does not invalidate — covered by the added test in test/interceptors/cache.js.

Tests

• New node:test case unsafe methods invalidate the URIs in Location and Content-Location response headers in test/interceptors/cache.js (fails on main with expected: 2, actual: 1 origin hits, passes with this change).
• Full cache test files (test/interceptors/cache*.js, test/cache-interceptor/*): 122 pass / 0 fail (121 baseline + 1 new).
• mnot cache-tests conformance runner (node test/cache-interceptor/cache-tests.mjs): the eight invalidate-{POST,PUT,DELETE,M-SEARCH}-{location,cl} tests move from failed-optional to passing in every environment — totals go 220 → 228 passed, 58 → 50 failed-optional, still 0 required failures. Nothing needed un-skipping in the runner's ignore list.

Notes

• This change is agent-assisted (Claude Fable 5) working with @jeswr.
• Self-contained against main; independent of the sibling cache-conformance PRs fix: honor request cache-control max-age=0 in cache interceptor #5510 (fix/cache-request-max-age-zero), fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error #5511 (fix/cache-must-revalidate-max-stale), fix: send stored last-modified as if-modified-since when revalidating #5512 (fix/cache-if-modified-since-value) and fix: honor stale-if-error on connection errors during revalidation #5513 (fix/cache-stale-if-error-network), which touch the interceptor/revalidation paths rather than this invalidation hook.

🤖 Generated with Claude Code