Comparing axios@1.17.0...axios@1.18.0 • npm-diff.app 📦🔃

@@ -397,6 +397,7 @@
397	397	clarifyTimeoutError?: boolean;
398	398	legacyInterceptorReqResOrdering?: boolean;
399	399	advertiseZstdAcceptEncoding?: boolean;
	400	validateStatusUndefinedResolves?: boolean;
400	401	}
401	402
402	403	interface GenericAbortSignal {
@@ -559,6 +560,7 @@
559	560	};
560	561	formDataHeaderPolicy?: 'legacy' \| 'content-only';
561	562	redact?: string[];
	563	sensitiveHeaders?: string[];
562	564	}
563	565
564	566	// Alias

           clarifyTimeoutError: validators.transitional(validators.boolean),
           legacyInterceptorReqResOrdering: validators.transitional(validators.boolean),
           advertiseZstdAcceptEncoding: validators.transitional(validators.boolean),
+          validateStatusUndefinedResolves: validators.transitional(validators.boolean),
         },
         false
       );
   getUri(config) {
     config = mergeConfig(this.defaults, config);
+    const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls);
+    const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls, config);
     return buildURL(fullPath, config.params, config.paramsSerializer);
+  }
+}
       mergeConfig(config || {}, {
         method,
         url,
+        data: (config || {}).data,
+        data: config && utils.hasOwnProp(config, 'data') ? config.data : undefined,
       })
     );
   };

       setHeaders(header, valueOrRewrite);
     } else if (utils.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) {
       setHeaders(parseHeaders(header), valueOrRewrite);
+    } else if (utils.isObject(header) && utils.isIterable(header)) {
+      let obj = {},
+    } else if (utils.isObject(header) && utils.isSafeIterable(header)) {
+      let obj = Object.create(null),
         dest,
         key;
       for (const entry of header) {
           throw new TypeError('Object iterator must return a key-value pair');
+        }
+        obj[(key = entry[0])] = (dest = obj[key])
+          ? utils.isArray(dest)
+            ? [...dest, entry[1]]
+            : [dest, entry[1]]
+          : entry[1];
+        key = entry[0];
+        if (utils.hasOwnProp(obj, key)) {
+          dest = obj[key];
+          obj[key] = utils.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]];
+        } else {
+          obj[key] = entry[1];
+        }
+      }
       setHeaders(obj, valueOrRewrite);

 'use strict';
+import AxiosError from './AxiosError.js';
 import isAbsoluteURL from '../helpers/isAbsoluteURL.js';
 import combineURLs from '../helpers/combineURLs.js';
+const malformedHttpProtocol = /^https?:(?!\/\/)/i;
+const httpProtocolControlCharacters = /[\t\n\r]/g;
+function stripLeadingC0ControlOrSpace(url) {
+  let i = 0;
+  while (i < url.length && url.charCodeAt(i) <= 0x20) {
+    i++;
+  }
+  return url.slice(i);
+}
+function normalizeURLForProtocolCheck(url) {
+  return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, '');
+}
+function assertValidHttpProtocolURL(url, config) {
+  if (typeof url === 'string' && malformedHttpProtocol.test(normalizeURLForProtocolCheck(url))) {
+    throw new AxiosError(
+      'Invalid URL: missing "//" after protocol',
+      AxiosError.ERR_INVALID_URL,
+      config
+    );
+  }
+}
 /**
  * Creates a new URL by combining the baseURL with the requestedURL,
  * only when the requestedURL is not already an absolute URL.
+ *
  * @returns {string} The combined full path
  */
+export default function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
+export default function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {
+  assertValidHttpProtocolURL(requestedURL, config);
   let isRelativeUrl = !isAbsoluteURL(requestedURL);
   if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
+    assertValidHttpProtocolURL(baseURL, config);
     return combineURLs(baseURL, requestedURL);
+  }
   return requestedURL;

     return url;
+  }
+  const _encode = (options && options.encode) || encode;
   const _options = utils.isFunction(options)
     ? {
         serialize: options,
+      }
     : options;
+  const serializeFn = _options && _options.serialize;
+  // Read serializer options pollution-safely: own properties and methods on a
+  // class/template prototype are honored, but values injected onto a polluted
+  // Object.prototype are ignored.
+  const _encode = utils.getSafeProp(_options, 'encode') || encode;
+  const serializeFn = utils.getSafeProp(_options, 'serialize');
   let serializedParams;

@@ -1,1 +1,1 @@
1		export const VERSION = "1.17.0";
	1	export const VERSION = "1.18.0";

  * Estimate decoded byte length of a data:// URL *without* allocating large buffers.
  * - For base64: compute exact decoded size using length and padding;
  *               handle %XX at the character-count level (no string allocation).
+ * - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound.
+ * - For non-base64: compute the exact percent-decoded UTF-8 byte length.
+ *
  * @param {string} url
  * @returns {number}
  */
+const isHexDigit = (charCode) =>
+  (charCode >= 48 && charCode <= 57) ||
+  (charCode >= 65 && charCode <= 70) ||
+  (charCode >= 97 && charCode <= 102);
+const isPercentEncodedByte = (str, i, len) =>
+  i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2));
 export default function estimateDataURLDecodedBytes(url) {
   if (!url || typeof url !== 'string') return 0;
   if (!url.startsWith('data:')) return 0;
       if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) {
         const a = body.charCodeAt(i + 1);
         const b = body.charCodeAt(i + 2);
+        const isHex =
+          ((a >= 48 && a <= 57) || (a >= 65 && a <= 70) || (a >= 97 && a <= 102)) &&
+          ((b >= 48 && b <= 57) || (b >= 65 && b <= 70) || (b >= 97 && b <= 102));
+        const isHex = isHexDigit(a) && isHexDigit(b);
         if (isHex) {
           effectiveLen -= 2;
     return bytes > 0 ? bytes : 0;
+  }
+  if (typeof Buffer !== 'undefined' && typeof Buffer.byteLength === 'function') {
+    return Buffer.byteLength(body, 'utf8');
+  }
   // Compute UTF-8 byte length directly from UTF-16 code units without allocating
   // a byte buffer (TextEncoder.encode would defeat the DoS guard on large bodies).
+  // Using body.length here would undercount non-ASCII (e.g. '€' is 1 code unit
+  // but 3 UTF-8 bytes).
+  // Valid %XX triplets count as one decoded byte; this matches the bytes that
+  // decodeURIComponent(body) would produce before Buffer re-encodes the string.
   let bytes = 0;
   for (let i = 0, len = body.length; i < len; i++) {
     const c = body.charCodeAt(i);
+    if (c < 0x80) {
+    if (c === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) {
       bytes += 1;
+      i += 2;
+    } else if (c < 0x80) {
+      bytes += 1;
     } else if (c < 0x800) {
       bytes += 2;
     } else if (c >= 0xd800 && c <= 0xdbff && i + 1 < len) {

 'use strict';
 import utils from '../utils.js';
+import AxiosError from '../core/AxiosError.js';
+import { DEFAULT_FORM_DATA_MAX_DEPTH } from './toFormData.js';
+const MAX_DEPTH = DEFAULT_FORM_DATA_MAX_DEPTH;
+function throwIfDepthExceeded(index) {
+  if (index > MAX_DEPTH) {
+    throw new AxiosError(
+      'FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH,
+      AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED
+    );
+  }
+}
 /**
  * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z']
+ *
   // foo.x.y.z
   // foo-x-y-z
   // foo x y z
+  return utils.matchAll(/\w+|\[(\w*)]/g, name).map((match) => {
+    return match[0] === '[]' ? '' : match[1] || match[0];
+  });
+  const path = [];
+  const pattern = /\w+|\[(\w*)]/g;
+  let match;
+  while ((match = pattern.exec(name)) !== null) {
+    throwIfDepthExceeded(path.length);
+    path.push(match[0] === '[]' ? '' : match[1] || match[0]);
+  }
+  return path;
+}
 /**
  */
 function formDataToJSON(formData) {
   function buildPath(path, value, target, index) {
+    throwIfDepthExceeded(index);
     let name = path[index++];
     if (name === '__proto__') return true;

+    }
+  }
+  function getMergedTransitionalOption(prop) {
+    const transitional2 = utils.hasOwnProp(config2, 'transitional') ? config2.transitional : undefined;
+    if (!utils.isUndefined(transitional2)) {
+      if (utils.isPlainObject(transitional2)) {
+        if (utils.hasOwnProp(transitional2, prop)) {
+          return transitional2[prop];
+        }
+      } else {
+        return undefined;
+      }
+    }
+    const transitional1 = utils.hasOwnProp(config1, 'transitional') ? config1.transitional : undefined;
+    if (utils.isPlainObject(transitional1) && utils.hasOwnProp(transitional1, prop)) {
+      return transitional1[prop];
+    }
+    return undefined;
+  }
   // eslint-disable-next-line consistent-return
   function mergeDirectKeys(a, b, prop) {
     if (utils.hasOwnProp(config2, prop)) {
     (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
   });
+  if (
+    utils.hasOwnProp(config2, 'validateStatus') &&
+    utils.isUndefined(config2.validateStatus) &&
+    getMergedTransitionalOption('validateStatusUndefinedResolves') === false
+  ) {
+    if (utils.hasOwnProp(config1, 'validateStatus')) {
+      config.validateStatus = getMergedValue(undefined, config1.validateStatus);
+    } else {
+      delete config.validateStatus;
+    }
+  }
   return config;
+}

   newConfig.headers = headers = AxiosHeaders.from(headers);
   newConfig.url = buildURL(
+    buildFullPath(baseURL, url, allowAbsoluteUrls),
+    buildFullPath(baseURL, url, allowAbsoluteUrls, newConfig),
     own('params'),
     own('paramsSerializer')
   );
   // HTTP basic authentication
   if (auth) {
+    const username = utils.getSafeProp(auth, 'username') || '';
+    const password = utils.getSafeProp(auth, 'password') || '';
     headers.set(
       'Authorization',
+      'Basic ' +
+        btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
+      'Basic ' + btoa(username + ':' + (password ? encodeUTF8(password) : ''))
     );
+  }

+const LOOPBACK_HOSTNAMES = new Set(['localhost']);
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '0.0.0.0']);
 const isIPv4Loopback = (host) => {
   const parts = host.split('.');
   return parts.every((p) => /^\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255);
 };
+const isIPv6ZeroGroup = (group) => /^0{1,4}$/.test(group);
+// The unspecified address (IPv4 0.0.0.0 / IPv6 ::) resolves to the local host
+// for outbound connections, so treat it as loopback-equivalent for NO_PROXY
+// matching. 0.0.0.0 is covered by LOOPBACK_HOSTNAMES; this handles compressed
+// and full IPv6 all-zero forms so both families bypass symmetrically.
+const isIPv6Unspecified = (host) => {
+  if (host === '::') return true;
+  const compressionIndex = host.indexOf('::');
+  if (compressionIndex !== -1) {
+    if (compressionIndex !== host.lastIndexOf('::')) return false;
+    const left = host.slice(0, compressionIndex);
+    const right = host.slice(compressionIndex + 2);
+    const leftGroups = left ? left.split(':') : [];
+    const rightGroups = right ? right.split(':') : [];
+    const explicitGroups = leftGroups.length + rightGroups.length;
+    return (
+      explicitGroups < 8 &&
+      leftGroups.every(isIPv6ZeroGroup) &&
+      rightGroups.every(isIPv6ZeroGroup)
+    );
+  }
+  const groups = host.split(':');
+  return groups.length === 8 && groups.every(isIPv6ZeroGroup);
+};
 const isIPv6Loopback = (host) => {
   // Collapse all-zero groups: any form of ::1 / 0:0:...:0:1
   // First, strip any leading "::" by normalising with Set lookup of common forms,
   if (!host) return false;
   if (LOOPBACK_HOSTNAMES.has(host)) return true;
   if (isIPv4Loopback(host)) return true;
+  if (isIPv6Unspecified(host)) return true;
   return isIPv6Loopback(host);
 };

 // temporary hotfix to avoid circular references until AxiosURLSearchParams is refactored
 import PlatformFormData from '../platform/node/classes/FormData.js';
+// Default nesting limit shared with the inverse transform (formDataToJSON) so
+// the FormData <-> JSON round-trip stays symmetric.
+export const DEFAULT_FORM_DATA_MAX_DEPTH = 100;
 /**
  * Determines if the given thing is a array or js object.
+ *
   const dots = options.dots;
   const indexes = options.indexes;
   const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
+  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
+  const maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;
   const useBlob = _Blob && utils.isSpecCompliantForm(formData);
+  const stack = [];
   if (!utils.isFunction(visitor)) {
     throw new TypeError('visitor must be a function');
     return value;
+  }
+  function throwIfMaxDepthExceeded(depth) {
+    if (depth > maxDepth) {
+      throw new AxiosError(
+        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+        AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED
+      );
+    }
+  }
+  function stringifyWithDepthLimit(value, depth) {
+    if (maxDepth === Infinity) {
+      return JSON.stringify(value);
+    }
+    const ancestors = [];
+    return JSON.stringify(value, function limitDepth(_key, currentValue) {
+      if (!utils.isObject(currentValue)) {
+        return currentValue;
+      }
+      while (ancestors.length && ancestors[ancestors.length - 1] !== this) {
+        ancestors.pop();
+      }
+      ancestors.push(currentValue);
+      throwIfMaxDepthExceeded(depth + ancestors.length - 1);
+      return currentValue;
+    });
+  }
   /**
    * Default visitor.
+   *
         // eslint-disable-next-line no-param-reassign
         key = metaTokens ? key : key.slice(0, -2);
         // eslint-disable-next-line no-param-reassign
+        value = JSON.stringify(value);
+        value = stringifyWithDepthLimit(value, 1);
       } else if (
         (utils.isArray(value) && isFlatArray(value)) ||
         ((utils.isFileList(value) || utils.endsWith(key, '[]')) && (arr = utils.toArray(value)))
     return false;
+  }
+  const stack = [];
   const exposedHelpers = Object.assign(predicates, {
     defaultVisitor,
     convertValue,
   function build(value, path, depth = 0) {
     if (utils.isUndefined(value)) return;
+    if (depth > maxDepth) {
+      throw new AxiosError(
+        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+        AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED
+      );
+    }
+    throwIfMaxDepthExceeded(depth);
     if (stack.indexOf(value) !== -1) {
       throw new Error('Circular reference detected in ' + path.join('.'));

@@ -6,4 +6,5 @@
6	6	clarifyTimeoutError: false,
7	7	legacyInterceptorReqResOrdering: true,
8	8	advertiseZstdAcceptEncoding: false,
	9	validateStatusUndefinedResolves: true,
9	10	};

 const { getPrototypeOf } = Object;
 const { iterator, toStringTag } = Symbol;
+/* Creating a function that will check if an object has a property. */
+const hasOwnProperty = (
+  ({ hasOwnProperty }) =>
+  (obj, prop) =>
+    hasOwnProperty.call(obj, prop)
+)(Object.prototype);
+/**
+ * Walk the prototype chain (excluding the shared Object.prototype) looking for
+ * an own `prop`. This distinguishes genuine own/inherited members — including
+ * class accessors and template prototypes — from members injected via
+ * Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which
+ * live on Object.prototype itself and are therefore never matched.
+ *
+ * @param {*} thing The value whose chain to inspect
+ * @param {string|symbol} prop The property key to look for
+ *
+ * @returns {boolean} True when `prop` is owned below Object.prototype
+ */
+const hasOwnInPrototypeChain = (thing, prop) => {
+  let obj = thing;
+  const seen = [];
+  while (obj != null && obj !== Object.prototype) {
+    if (seen.indexOf(obj) !== -1) {
+      return false;
+    }
+    seen.push(obj);
+    if (hasOwnProperty(obj, prop)) {
+      return true;
+    }
+    obj = getPrototypeOf(obj);
+  }
+  return false;
+};
+/**
+ * Read `obj[prop]` only when it is safe from Object.prototype pollution. Own
+ * properties and members inherited from a non-Object.prototype source (a class
+ * instance or template object) are honored; a value reachable only through a
+ * polluted Object.prototype is ignored and `undefined` is returned.
+ *
+ * @param {*} obj The source object
+ * @param {string|symbol} prop The property key to read
+ *
+ * @returns {*} The resolved value, or undefined when unsafe/absent
+ */
+const getSafeProp = (obj, prop) =>
+  obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : undefined;
 const kindOf = ((cache) => (thing) => {
   const str = toString.call(thing);
   return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase());
  * @returns {boolean} True if value is a plain Object, otherwise false
  */
 const isPlainObject = (val) => {
+  if (kindOf(val) !== 'object') {
+  if (!isObject(val)) {
     return false;
+  }
   return (
     (prototype === null ||
       prototype === Object.prototype ||
+      Object.getPrototypeOf(prototype) === null) &&
+    !(toStringTag in val) &&
+    !(iterator in val)
+      getPrototypeOf(prototype) === null) &&
+    // Treat any genuine (non-Object.prototype-polluted) Symbol.toStringTag or
+    // Symbol.iterator as evidence the value is a tagged/iterable type rather
+    // than a plain object, while ignoring keys injected onto Object.prototype.
+    !hasOwnInPrototypeChain(val, toStringTag) &&
+    !hasOwnInPrototypeChain(val, iterator)
   );
 };
   });
 };
+/* Creating a function that will check if an object has a property. */
+const hasOwnProperty = (
+  ({ hasOwnProperty }) =>
+  (obj, prop) =>
+    hasOwnProperty.call(obj, prop)
+)(Object.prototype);
 const { propertyIsEnumerable } = Object.prototype;
 /**
 const isIterable = (thing) => thing != null && isFunction(thing[iterator]);
+/**
+ * Determine if a value is iterable via an iterator that is NOT sourced solely
+ * from a polluted Object.prototype. Use this instead of `isIterable` whenever
+ * the iterable comes from untrusted input (e.g. user-supplied header sources),
+ * so `Object.prototype[Symbol.iterator] = ...` cannot turn an ordinary object
+ * into an attacker-controlled entries iterator.
+ *
+ * @param {*} thing The value to test
+ *
+ * @returns {boolean} True if value has a non-polluted iterator
+ */
+const isSafeIterable = (thing) =>
+  thing != null && hasOwnInPrototypeChain(thing, iterator) && isIterable(thing);
 export default {
   isArray,
   isArrayBuffer,
   isHTMLForm,
   hasOwnProperty,
   hasOwnProp: hasOwnProperty, // an alias to avoid ESLint no-prototype-builtins detection
+  hasOwnInPrototypeChain,
+  getSafeProp,
   reduceDescriptors,
   freezeMethods,
   toObjectSet,
   setImmediate: _setImmediate,
   asap,
   isIterable,
+  isSafeIterable,
 };

+{
   "name": "axios",
+  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "Promise based HTTP client for the browser and node.js",
   "main": "./dist/node/axios.cjs",
   "module": "./index.js",

@@ -284,6 +284,7 @@
284	284	clarifyTimeoutError?: boolean;
285	285	legacyInterceptorReqResOrdering?: boolean;
286	286	advertiseZstdAcceptEncoding?: boolean;
	287	validateStatusUndefinedResolves?: boolean;
287	288	}
288	289
289	290	export interface GenericAbortSignal {
@@ -452,6 +453,7 @@
452	453	};
453	454	formDataHeaderPolicy?: 'legacy' \| 'content-only';
454	455	redact?: string[];
	456	sensitiveHeaders?: string[];
455	457	}
456	458
457	459	// Alias

@@ -284,6 +284,7 @@
284	284	clarifyTimeoutError?: boolean;
285	285	legacyInterceptorReqResOrdering?: boolean;
286	286	advertiseZstdAcceptEncoding?: boolean;
	287	validateStatusUndefinedResolves?: boolean;
287	288	}
288	289
289	290	export interface GenericAbortSignal {
@@ -452,6 +453,7 @@
452	453	};
453	454	formDataHeaderPolicy?: 'legacy' \| 'content-only';
454	455	redact?: string[];
	456	sensitiveHeaders?: string[];
455	457	}
456	458
457	459	// Alias

 # Changelog
+## v1.17.0 — June 1, 2026
+This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
+## 🔒 Security Fixes
+* **Config Hardening:** Guarded `socketPath`, `params`, and `paramsSerializer` reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (__#10901__, __#10922__)
+* **Release Publishing:** Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (__#10926__)
+## 🚀 New Features
+* **HTTP Compression:** Added Node HTTP adapter support for zstd response decompression, with `transitional.advertiseZstdAcceptEncoding` controlling whether `zstd` is advertised in `Accept-Encoding`. (__#6792__, __#10920__)
+## 🐛 Bug Fixes
+* **Authentication Handling:** Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (__#10929__, __#10896__)
+* **Proxy TLS:** Preserved user `httpsAgent` TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (__#10957__)
+* **React Native FormData:** Cleared default `Content-Type` for React Native `FormData` so multipart boundaries can be generated correctly. (__#10898__)
+* **Headers:** Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (__#10875__)
+* **Request Data Merging:** Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (__#10812__)
+* **Bundler Compatibility:** Converted `resolveConfig` from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (__#10891__)
+* **Types:** Corrected `AxiosHeaders.toJSON()` return types and updated CommonJS `isCancel` typings to narrow to `CanceledError<T>`. (__#10956__, __#10952__)
+* **Build Tooling:** Avoided emitting a null `Authorization` header from the GitHub build helper when `GITHUB_TOKEN` is unset. (__#10931__)
+## 🔧 Maintenance & Chores
+* **HTTP/2 Internals:** Extracted `Http2Sessions` into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (__#10861__)
+* **Package Publishing:** Reduced published package size by switching to a `files` allowlist and dropping unneeded unminified bundle source maps. (__#10939__)
+* **CI and Release Automation:** Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (__#10907__, __#10911__, __#10916__, __#10927__, __#10935__, __#10983__)
+* **Developer Workflow:** Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (__#10925__, __#10914__, __#10958__)
+* **Documentation and Policy:** Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (__#10890__, __#10889__, __#10921__, __#10945__, __#10905__, __#10933__, __#10915__, __#10887__, __#10955__)
+* **Dependencies:** Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, `fs-extra`, `qs`, docs dependencies, and GitHub Actions dependencies including `actions/dependency-review-action` and `zizmorcore/zizmor-action`. (__#10871__, __#10879__, __#10918__, __#10919__, __#10934__, __#10947__, __#10954__, __#10960__)
+## 🌟 New Contributors
+We are thrilled to welcome our new contributors. Thank you for helping improve axios:
+* __@BasixKOR__ (__#6792__)
+* __@carladams1299-lab__ (__#10861__)
+* __@LaplaceYoung__ (__#10812__)
+* __@JamieMagee__ (__#10939__)
+* __@RonGamzu__ (__#10905__)
+* __@sapirbaruch__ (__#10891__)
+* __@nezukoagent__ (__#10901__)
+* __@devareddy05__ (__#10929__)
+* __@Mohammad-Faiz-Cloud-Engineer__ (__#10922__)
+* __@azandabot__ (__#10931__)
+* __@niksy__ (__#10896__)
+[Full Changelog](https://github.com/axios/axios/compare/v1.16.1...v1.17.0)
 ## v1.16.1 — May 13, 2026
 This release ships a defence-in-depth fix for prototype pollution in `formDataToJSON`, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.
 - fix: improve AxiosHeaders class [#5224](https://github.com/axios/axios/pull/5224)
 - fix: TypeScript type definitions for commonjs [#5196](https://github.com/axios/axios/pull/5196)
+- fix: type definition of use method on AxiosInterceptorManager to match the the README [#5071](https://github.com/axios/axios/pull/5071)
+- fix: type definition of use method on AxiosInterceptorManager to match the README [#5071](https://github.com/axios/axios/pull/5071)
 - fix: \_\_dirname is not defined in the sandbox [#5269](https://github.com/axios/axios/pull/5269)
 - fix: AxiosError.toJSON method to avoid circular references [#5247](https://github.com/axios/axios/pull/5247)
 - fix: Z_BUF_ERROR when content-encoding is set but the response body is empty [#5250](https://github.com/axios/axios/pull/5250)

   // When no `transformRequest` is set, it must be of one of the following types:
   // - string, plain object, ArrayBuffer, ArrayBufferView, URLSearchParams
   // - Browser only: FormData, File, Blob
+  // - React Native: FormData
   // - Node only: Stream, Buffer, FormData (form-data package)
   data: {
     firstName: 'Fred'
     // Do whatever you want with the Axios progress event
   },
+  // `maxContentLength` defines the max size of the http response content in bytes allowed in node.js
+  // `maxContentLength` defines the max size of the response content in bytes.
+  // It is enforced by the Node.js HTTP adapter and the fetch adapter.
   maxContentLength: 2000,
+  // `maxBodyLength` (Node only option) defines the max size of the http request content in bytes allowed
+  // `maxBodyLength` defines the max size of the request content in bytes.
+  // It is enforced by the Node.js HTTP adapter and the fetch adapter when the body length can be determined.
   maxBodyLength: 2000,
   // `redact` masks matching config keys when AxiosError#toJSON() is called.
   // If set to 0, Axios follows no redirects.
   maxRedirects: 21, // default
+  // `sensitiveHeaders` (Node only option) lists custom secret-bearing headers
+  // to remove from cross-origin redirects. Matching is case-insensitive.
+  // Same-origin redirects keep these headers. If `maxRedirects` is 0, this
+  // option is not used.
+  sensitiveHeaders: ['X-API-Key'],
   // `beforeRedirect` defines a function that Axios calls before redirect.
   // Use this to adjust the request options upon redirecting,
   // to inspect the latest response headers,
 To send data as `multipart/form-data`, pass a FormData instance as the payload.
 You do not need to set the `Content-Type` header. Axios detects it from the payload type.
+For browser, web worker, and React Native `FormData`, leave `Content-Type` unset so the runtime can add the multipart boundary.
 ```js
 const formData = new FormData();
 The option can also accept a user-defined function that determines whether to overwrite the value.
+Empty or whitespace-only header names are ignored.
 Returns `this`.
 ### AxiosHeaders#get(header)
 The adapter supports the same features as the `xhr` adapter, including upload and download progress capturing.
 It also supports response types such as `stream` and `formdata` when the environment supports them.
+When `auth` is omitted, the fetch adapter can read HTTP Basic auth credentials from the request URL, for example `https://user:pass@example.com`. Percent-encoded URL credentials are decoded before the `Authorization` header is generated, and `auth` takes precedence over URL-embedded credentials.
 ### Custom fetch
 Since `v1.12.0`, you can configure the fetch adapter to use a custom fetch API instead of environment globals.
+}
 ```
+Use `axios.isCancel<T>()` to narrow cancellation errors to `CanceledError<T>`:
+```typescript
+const controller = new AbortController();
+try {
+  await axios.get<User>('/user?ID=12345', { signal: controller.signal });
+} catch (error) {
+  if (axios.isCancel<User>(error)) {
+    handleCancellation(error);
+  }
+}
+```
 Because axios publishes an ESM default export and a CJS `module.exports`, TypeScript has a few caveats.
 The recommended setting is `"moduleResolution": "node16"`, which is implied by `"module": "node16"`. This requires TypeScript 4.7 or greater.
 If you use ESM, your settings should be fine.

Comparingaxios@1.17.0

Comparingaxios@1.17.0

Source

Source

npm diff

Options

Bundlephobia

Bundlephobia

Packagephobia

Packagephobia

dist/browser/axios.cjs +++355---90

dist/node/axios.cjs +++399---104

index.d.cts +++2---0

dist/axios.js +++350---134

dist/esm/axios.js +++355---90

lib/core/Axios.js +++3---2

lib/core/AxiosHeaders.js +++10---7

lib/core/buildFullPath.js +++29---1

lib/helpers/buildURL.js +++5---3

lib/env/data.js +++1---1

lib/helpers/estimateDataURLDecodedBytes.js +++16---11

lib/adapters/fetch.js +++113---37

lib/helpers/formDataToJSON.js +++25---3

lib/adapters/http.js +++132---43

lib/core/mergeConfig.js +++34---0

lib/helpers/resolveConfig.js +++5---3

lib/helpers/shouldBypassProxy.js +++33---1

lib/helpers/toFormData.js +++40---10

lib/defaults/transitional.js +++1---0

lib/utils.js +++75---11

package.json +++1---1

CHANGELOG.md +++52---1

README.md +++30---2

index.d.ts +++2---0

+++0---0

Packagephobia

Bundlephobia

dist/browser/axios.cjs +++355---90

dist/node/axios.cjs +++399---104

index.d.cts +++2---0

dist/axios.js +++350---134

dist/esm/axios.js +++355---90

lib/core/Axios.js +++3---2

lib/core/AxiosHeaders.js +++10---7

lib/core/buildFullPath.js +++29---1

lib/helpers/buildURL.js +++5---3

lib/env/data.js +++1---1

lib/helpers/estimateDataURLDecodedBytes.js +++16---11

lib/adapters/fetch.js +++113---37

lib/helpers/formDataToJSON.js +++25---3

lib/adapters/http.js +++132---43

lib/core/mergeConfig.js +++34---0

lib/helpers/resolveConfig.js +++5---3

lib/helpers/shouldBypassProxy.js +++33---1

lib/helpers/toFormData.js +++40---10

lib/defaults/transitional.js +++1---0

lib/utils.js +++75---11

package.json +++1---1

CHANGELOG.md +++52---1

README.md +++30---2

index.d.ts +++2---0

Source

Source

Comparing
`axios@1.17.0`

Comparing
`axios@1.17.0`