Update dependency axios to ^0.34.0 - #123

v0.34.0

Compare Source

v0.34.0 — September 13, 2026

This release hardens request configuration and proxy handling, adds caller diagnostics and cancellation context, and tightens TypeScript header types.

⚠️ Breaking Changes & Deprecations

• Header Types: TypeScript now rejects header values that are Promises, functions, or objects with custom toString() methods. Resolve promises, call functions, or explicitly convert objects before assigning header values. Supported scalar, array, and grouped headers remain available. (#​11209)
• Proxy Routing: NO_PROXY / no_proxy entries now support IPv4 and IPv6 CIDR ranges. Previously ineffective ranges now cause matching IP destinations to bypass the proxy; review existing ranges when upgrading. (#​11172)

🔒 Security Fixes

• Request Configuration: Prevent inherited properties from influencing form serializer options, default request methods, headers on interceptor-returned configs, and HTTP redirect hooks. Applications relying on inherited options must define those values as own properties. (#​11172)
• Hostname Processing: Replace quadratic regular-expression backtracking in proxy bypass hostname normalization with a linear scan, preventing excessive processing of crafted redirect hostnames. (#​11172)

🚀 New Features

• Caller Diagnostics: Enable captureCallerStack: true on a request or instance to append original caller frames to asynchronous error stacks. Disabled by default. (#​11209)
• Cancellation Context: Preserve AbortSignal.reason as CanceledError.reason, including objects and falsy values. Native and structural signals retain their identity and live getters through config merging. (#​11209)

🐛 Bug Fixes

• Proxy Protocols: Accept HTTP(S) proxy schemes with or without a trailing colon, including casing and surrounding whitespace variations. Invalid nonempty strings now fail before connecting with ERR_BAD_OPTION_VALUE; redirect failures retain ERR_FR_REDIRECTION_FAILURE wrapping. Omitted protocols continue to inherit the target protocol. (#​11182)
• Request Interceptors: Route synchronous interceptor and dispatch failures through response interceptors. Await recovery promises before dispatch; rejected recovery prevents sending the request, while successful recovery retains the last request config and ignores recovery return values. (#​11209)
• Error Compatibility: Allow Axios to load alongside a read-only Error.prototype.toJSON, while preserving supplied own property descriptors and setters. (#​11209)

🔧 Maintenance & Chores

• Publishing and Tests: Use npm bundled with Node in the v0 publishing workflow and replace the FormData browser test’s external HTTP request with a Jasmine-Ajax stub. (#​11084)
• Repository Cleanup: Add .codex/ to .gitignore. (#​11033)
• Release Preparation: Update package and runtime version metadata to 0.34.0. (#​11217)

Full Changelog: axios/axios@v0.33.0...v0.34.0

v0.33.0

Compare Source

v0.33.0 — June 13, 2026

This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

🔒 Security Fixes

• Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats 0.0.0.0 as local for proxy bypass. (#​11001)

🚀 New Features

• Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#​10937)

🔧 Maintenance & Chores

• Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#​10936, #​10943)
• Changelog: Backfills missing v0.x changelog entries for prior releases. (#​10842)
• Release Metadata: Bumps package and internal version metadata for v0.33.0. (#​11002)

Full Changelog

v0.32.0

Compare Source

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

• Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#​10838)

🔒 Security Fixes

• Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#​10838)
• Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#​10838)
• Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#​10838)
• Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#​10838)
• Browser xhr adapter: Stricter own-property checks when reading config and headers. (#​10838)
• URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#​10838)
• Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#​10838)

🔧 Maintenance & Chores

• Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#​10838)

Full Changelog

v0.31.1

Compare Source

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

• Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#​10747)

🔒 Security Fixes

• Prototype Pollution in Header Merge (GHSA-6chq-wfr3-2hj9): Tightened isFormData to reject plain/null-prototype objects and require append, and guarded the Node HTTP adapter so data.getHeaders() is only merged when it is not inherited from Object.prototype. Blocks injected headers via polluted getHeaders. (#​10750)
• Prototype Pollution in Config Merging (GHSA-pf86-5x62-jrwf): mergeConfig, defaults resolution, and the HTTP adapter now uses own-property checks for transport, env, Blob, formSerializer, and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. (#​10752)
• FormData / Params Recursion DoS: Added a configurable maxDepth (default 100, Infinity disables) to toFormData and params serialisation, throwing AxiosError with code ERR_FORM_DATA_DEPTH_EXCEEDED when exceeded. Circular-reference detection is preserved. (#​10728)
• Null-Byte Injection in Query Strings: Removed the unsafe %00 → null-byte substitution from AxiosURLSearchParams.encode so %00 is preserved as-is. Other encoding behaviour (including %20 → +) unchanged. (#​10737)
• Consolidated v1 Security Backport: Rolls up remaining v1 hardenings into v0.x: maxContentLength enforcement for responseType: 'stream' via a guarded transform with deferred piping, maxBodyLength enforcement for streamed uploads on native http/https with maxRedirects: 0, and stricter withXSRFToken handling so only own boolean true enables cross-origin XSRF headers. (#​10764)

🔧 Maintenance & Chores

• CODEOWNERS: Added .github/CODEOWNERS with * @jasonsaayman to set a default reviewer for all paths. (#​10740)

Full Changelog

v0.31.0

Compare Source

This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and zizmor scanning, resolves TypeScript typing issues in AxiosInstance, and fixes a performance regression in isEmptyObject().

🔒 Security Fixes

• Header Injection & Proxy Bypass: Backports v1 security hardening — sanitizes outgoing header values to strip invalid bytes, CRLF sequences, and boundary whitespace (including array values); adds proper NO_PROXY/no_proxy enforcement covering wildcards, explicit ports, loopback aliases (localhost, 127.0.0.1, ::1), bracketed IPv6, and trailing-dot hostnames. Proxy bypass is now checked before the proxy URL is parsed, and parsed.host is used for correct port and IPv6 handling. (#​10688)

• CI Security: SHA-pins all actions and disables credential persistence in v0.x CI, introduces zizmor security scanning with SARIF upload to code scanning, adds an OIDC Trusted Publishing workflow with npm provenance attestations, and gates all publishes behind a required npm-publish GitHub Environment with configurable reviewer protections. (#​10638, #​10639, #​10667)

🐛 Bug Fixes

• TypeScript — AxiosInstance Return Types: Fixes return types in AxiosInstance methods to correctly resolve to Promise<R> (matching AxiosPromise<T> semantics), and corrects the generic call signature so TypeScript properly enforces the response data type. TypeScript-only changes; no runtime impact. (#​6253, #​7328)

• Performance: Fixes a performance regression in isEmptyObject() that caused excessive computation when the argument was a large string. (#​6484)

🔧 Maintenance & Chores

• Versioning & CI Workflow: Adds an automated versioning flow for v0.x, renames the CI workflow for consistency with the v1.x naming convention, and corrects the branch name reference in CI config. (#​10690, #​10691, #​10692)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​nakataki17 (#​6253)
• @​gmasclet (#​6484)
• @​shaanmajid (#​10638, #​10639, #​10667)
• @​ivan-churakov (#​7328)

Full Changelog