This repository was archived by the owner on Apr 23, 2026. It is now read-only.
Closed
Conversation
renovate
Bot
requested review from
DarrenOfficial and
SudhanPlayz
as code owners
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/axios-0.x
branch
from
0dffdfb to
ccb8d7d
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.27.0→^0.31.0Release Notes
axios/axios (axios)
v0.31.1Compare Source
This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed
dist/artefacts along with Bower support.dist/Removed:dist/bundles are no longer committed to the repo, andbower.jsonplus the Gruntpackage2bowertask have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)🔒 Security Fixes
isFormDatato reject plain/null-prototype objects and requireappend, and guarded the Node HTTP adapter sodata.getHeaders()is only merged when it is not inherited fromObject.prototype. Blocks injected headers via pollutedgetHeaders. (#10750)mergeConfig, defaults resolution, and the HTTP adapter now uses own-property checks fortransport,env,Blob,formSerializer, and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. (#10752)maxDepth(default100,Infinitydisables) totoFormDataand params serialisation, throwingAxiosErrorwith codeERR_FORM_DATA_DEPTH_EXCEEDEDwhen exceeded. Circular-reference detection is preserved. (#10728)%00→ null-byte substitution fromAxiosURLSearchParams.encodeso%00is preserved as-is. Other encoding behaviour (including%20→+) unchanged. (#10737)v0.x:maxContentLengthenforcement forresponseType: 'stream'via a guarded transform with deferred piping,maxBodyLengthenforcement for streamed uploads on nativehttp/httpswithmaxRedirects: 0, and stricterwithXSRFTokenhandling so only own booleantrueenables cross-origin XSRF headers. (#10764)🔧 Maintenance & Chores
.github/CODEOWNERSwith* @​jasonsaaymanto set a default reviewer for all paths. (#10740)Full Changelog
v0.31.0Compare Source
This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and
zizmorscanning, resolves TypeScript typing issues inAxiosInstance, and fixes a performance regression inisEmptyObject().🔒 Security Fixes
Header Injection & Proxy Bypass: Backports v1 security hardening — sanitizes outgoing header values to strip invalid bytes, CRLF sequences, and boundary whitespace (including array values); adds proper
NO_PROXY/no_proxyenforcement covering wildcards, explicit ports, loopback aliases (localhost,127.0.0.1,::1), bracketed IPv6, and trailing-dot hostnames. Proxy bypass is now checked before the proxy URL is parsed, andparsed.hostis used for correct port and IPv6 handling. (#10688)CI Security: SHA-pins all actions and disables credential persistence in v0.x CI, introduces
zizmorsecurity scanning with SARIF upload to code scanning, adds an OIDC Trusted Publishing workflow with npm provenance attestations, and gates all publishes behind a requirednpm-publishGitHub Environment with configurable reviewer protections. (#10638, #10639, #10667)🐛 Bug Fixes
TypeScript —
AxiosInstanceReturn Types: Fixes return types inAxiosInstancemethods to correctly resolve toPromise<R>(matchingAxiosPromise<T>semantics), and corrects the generic call signature so TypeScript properly enforces the response data type. TypeScript-only changes; no runtime impact. (#6253, #7328)Performance: Fixes a performance regression in
isEmptyObject()that caused excessive computation when the argument was a large string. (#6484)🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog
v0.30.3: Release notes - v0.30.3Compare Source
This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).
Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.
🛡️ Security Fixes
⚙️ Maintenance & CI
Configuration Merging Behavior:
As part of the security fix, Axios now restricts the merging of the proto key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.
Full Changelog: v0.30.2...v0.30.3
v0.30.2Compare Source
What's Changed
maxContentLengthvulnerability fix to v0.x by @FeBe95 in #7034New Contributors
Full Changelog: axios/axios@v0.30.1...v0.30.2
v0.30.1Compare Source
Release notes:
Bug Fixes
Contributors to this release
Full Changelog: axios/axios@v0.30.0...v0.30.1
v0.30.0Compare Source
Release notes:
Bug Fixes
Contributors to this release
Full Changelog: axios/axios@v0.29.0...v0.30.0
v0.29.0Compare Source
Release notes:
Bug Fixes
Contributors to this release
v0.28.1Compare Source
Release notes:
Release notes:
Bug Fixes
reqis not defined (#6307)v0.28.0Compare Source
Release notes:
Bug Fixes
withXSRFTokenoption to v0.x (#6091)Backports from v1.x:
axios.formToJSONmethod (#4735)url-encoded-formserializer to respect theformSerializerconfig (#4721)string[]toAxiosRequestHeaderstype (#4322)AxiosErrorstack capturing; (#4718)AxiosErrorstatus code type; (#4717)blobto the list of protocols supported by the browser (#4678)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.