Comparing axios@1.18.0...axios@1.18.1 • npm-diff.app 📦🔃

     rewrite?: boolean | AxiosHeaderMatcher
   ): AxiosHeaders;
   set(headers?: axios.RawAxiosHeaders | AxiosHeaders | string, rewrite?: boolean): AxiosHeaders;
+  set(headers?: Iterable<[string, axios.AxiosHeaderValue]>, rewrite?: boolean): AxiosHeaders;
   get(headerName: string, parser: RegExp): RegExpExecArray | null;
   get(headerName: string, matcher?: true | AxiosHeaderParser): axios.AxiosHeaderValue;
   getSetCookie(): string[];
+  toString(): string;
   [Symbol.iterator](): IterableIterator<[string, axios.AxiosHeaderValue]>;
 }
 }
 declare class CanceledError<T> extends AxiosError<T> {
+  constructor(message?: string, config?: axios.InternalAxiosRequestConfig, request?: any);
   readonly name: 'CanceledError';
+  __CANCEL__?: boolean;
 }
 declare class Axios {
   LoopDetected = 508,
   NotExtended = 510,
   NetworkAuthenticationRequired = 511,
+  WebServerIsDown = 521,
+  ConnectionTimedOut = 522,
+  OriginIsUnreachable = 523,
+  TimeoutOccurred = 524,
+  SslHandshakeFailed = 525,
+  InvalidSslCertificate = 526,
 }
 type InternalAxiosError<T = unknown, D = any> = AxiosError<T, D>;
     dots?: boolean;
     metaTokens?: boolean;
     indexes?: boolean | null;
+    maxDepth?: number;
+    Blob?: { new (...args: any[]): any };
   }
   // tslint:disable-next-line
     promise: Promise<Cancel>;
     reason?: Cancel;
     throwIfRequested(): void;
+    subscribe(listener: (cancel: Cancel | any) => void): void;
+    unsubscribe(listener: (cancel: Cancel | any) => void): void;
+    toAbortSignal(): AbortSignal;
   }
   interface CancelTokenSource {
   }
   interface AxiosStatic extends AxiosInstance {
-    Cancel: CancelStatic;
+    Cancel: typeof CanceledError;
     CancelToken: CancelTokenStatic;
     Axios: typeof Axios;
     AxiosError: typeof AxiosError;

@@ -107,7 +107,7 @@
107		107
108	throw new AxiosError(	108	throw new AxiosError(
109	`There is no suitable adapter to dispatch the request ` + s,	109	`There is no suitable adapter to dispatch the request ` + s,
110	'ERR_NOT_SUPPORT'	110	AxiosError.ERR_NOT_SUPPORT
111	);	111	);
112	}	112	}
113		113

 class AxiosError extends Error {
   static from(error, code, config, request, response, customProps) {
     const axiosError = new AxiosError(error.message, code || error.code, config, request, response);
+    // Match native `Error` `cause` semantics: non-enumerable. The wrapped
+    // error often carries circular internals (sockets, requests, agents), so
+    // an enumerable `cause` makes structured loggers (pino/winston) and any
+    // own-property walk throw "Converting circular structure to JSON".
+    // Regression from #6982; see #7205. `__proto__: null` mirrors the
+    // `message` descriptor below (prototype-pollution-safe descriptor).
+    Object.defineProperty(axiosError, 'cause', {
+      __proto__: null,
+      value: error,
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
     axiosError.name = error.name;
     // Preserve status from the original error if not already set from response

 prototype.toString = function toString(encoder) {
   const _encode = encoder
+    ? function (value) {
+        return encoder.call(this, value, encode);
+    ? (value) => encoder.call(this, value, encode)
     : encode;
   return this._pairs

@@ -32,6 +32,7 @@
32	if (!params) {	32	if (!params) {
33	return url;	33	return url;
34	}	34	}
		35	url = url \|\| '';
35		36
36	const _options = utils.isFunction(options)	37	const _options = utils.isFunction(options)
37	? {	38	? {

@@ -45,7 +45,7 @@
45	signals = null;	45	signals = null;
46	};	46	};
47		47
48	signals.forEach((signal) => signal.addEventListener('abort', onabort));	48	signals.forEach((signal) => signal.addEventListener('abort', onabort, { once: true }));
49		49
50	const { signal } = controller;	50	const { signal } = controller;
51		51

@@ -40,7 +40,11 @@
40	const cookie = cookies[i].replace(/^\s+/, '');	40	const cookie = cookies[i].replace(/^\s+/, '');
41	const eq = cookie.indexOf('=');	41	const eq = cookie.indexOf('=');
42	if (eq !== -1 && cookie.slice(0, eq) === name) {	42	if (eq !== -1 && cookie.slice(0, eq) === name) {
43	return decodeURIComponent(cookie.slice(eq + 1));	43	try {
		44	return decodeURIComponent(cookie.slice(eq + 1));
		45	} catch (e) {
		46	return cookie.slice(eq + 1);
		47	}
44	}	48	}
45	}	49	}
46	return null;	50	return null;

@@ -1,1 +1,1 @@
1	export const VERSION = "1.18.0";	1	export const VERSION = "1.18.1";

         const canceledError = composedSignal.reason;
         canceledError.config = config;
         request && (canceledError.request = request);
+        if (err !== canceledError) {
+          // Non-enumerable to match native Error `cause` semantics so loggers
+          // don't recurse into circular fetch internals (see #7205).
+          Object.defineProperty(canceledError, 'cause', {
+            __proto__: null,
+            value: err,
+            writable: true,
+            enumerable: false,
+            configurable: true,
+          });
+        }
         throw canceledError;
+      }
+      }
       if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) {
+        throw Object.assign(
+          new AxiosError(
+            'Network Error',
+            AxiosError.ERR_NETWORK,
+            config,
+            request,
+            err && err.response
+          ),
+          {
+            cause: err.cause || err,
+        const networkError = new AxiosError(
+          'Network Error',
+          AxiosError.ERR_NETWORK,
+          config,
+          request,
+          err && err.response
         );
+        // Non-enumerable to match native Error `cause` semantics so loggers
+        // don't recurse into circular fetch internals (see #7205).
+        Object.defineProperty(networkError, 'cause', {
+          __proto__: null,
+          value: err.cause || err,
+          writable: true,
+          enumerable: false,
+          configurable: true,
+        });
+        throw networkError;
+      }
       throw AxiosError.from(err, err && err.code, config, request, err && err.response);

     // RFC 2397 section 3: default mediatype is text/plain;charset=US-ASCII
     // Bare `data:,` leaves mime undefined; Blob normalises that to "" per spec.
-    let mime;
+    let mime = '';
     if (type) {
       mime = params ? type + params : type;
     } else if (params) {
       mime = 'text/plain' + params;
     }
-    const buffer = Buffer.from(decodeURIComponent(body), encoding);
+    const buffer = encoding === 'base64'
+      ? Buffer.from(body, 'base64')
+      : Buffer.from(decodeURIComponent(body), encoding);
     if (asBlob) {
       if (!_Blob) {

@@ -16,6 +16,7 @@
16	*/	16	*/
17	export default function mergeConfig(config1, config2) {	17	export default function mergeConfig(config1, config2) {
18	// eslint-disable-next-line no-param-reassign	18	// eslint-disable-next-line no-param-reassign
		19	config1 = config1 \|\| {};
19	config2 = config2 \|\| {};	20	config2 = config2 \|\| {};
20		21
21	// Use a null-prototype object so that downstream reads such as `config.auth`	22	// Use a null-prototype object so that downstream reads such as `config.auth`

 import platform from '../platform/index.js';
 import utils from '../utils.js';
+import AxiosError from '../core/AxiosError.js';
 import isURLSameOrigin from './isURLSameOrigin.js';
 import cookies from './cookies.js';
 import buildFullPath from '../core/buildFullPath.js';
     return;
+  }
+  Object.entries(formHeaders || {}).forEach(([key, val]) => {
     if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) {
       headers.set(key, val);
+    }
     const username = utils.getSafeProp(auth, 'username') || '';
     const password = utils.getSafeProp(auth, 'password') || '';
+    headers.set(
+      'Authorization',
+      'Basic ' + btoa(username + ':' + (password ? encodeUTF8(password) : ''))
+    try {
+      headers.set(
+        'Authorization',
+        'Basic ' + btoa(username + ':' + (password ? encodeUTF8(password) : ''))
+      );
+    } catch (e) {
+      throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);
+    }
+  }
   if (utils.isFormData(data)) {

@@ -143,7 +143,13 @@
143	}	143	}
144		144
145	if (utils.isArrayBuffer(value) \|\| utils.isTypedArray(value)) {	145	if (utils.isArrayBuffer(value) \|\| utils.isTypedArray(value)) {
146	return useBlob && typeof Blob === 'function' ? new Blob([value]) : Buffer.from(value);	146	if (useBlob && typeof _Blob === 'function') {
		147	return new _Blob([value]);
		148	}
		149	if (typeof Buffer !== 'undefined') {
		150	return Buffer.from(value);
		151	}
		152	throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT);
147	}	153	}
148		154
149	return value;	155	return value;

@@ -79,7 +79,7 @@
79	*/	79	*/
80		80
81	function assertOptions(options, schema, allowUnknown) {	81	function assertOptions(options, schema, allowUnknown) {
82	if (typeof options !== 'object') {	82	if (typeof options !== 'object' \|\| options === null) {
83	throw new AxiosError('options must be an object', AxiosError.ERR_BAD_OPTION_VALUE);	83	throw new AxiosError('options must be an object', AxiosError.ERR_BAD_OPTION_VALUE);
84	}	84	}
85	const keys = Object.keys(options);	85	const keys = Object.keys(options);

@@ -218,6 +218,7 @@
218	config	218	config
219	)	219	)
220	);	220	);
		221	done();
221	return;	222	return;
222	}	223	}
223		224

 {
   "name": "axios",
-  "version": "1.18.0",
+  "version": "1.18.1",
   "description": "Promise based HTTP client for the browser and node.js",
   "main": "./dist/node/axios.cjs",
   "module": "./index.js",
     "Martti Laine (https://github.com/codeclown)",
     "Xianming Zhong (https://github.com/chinesedfan)",
     "Shaan Majid (https://github.com/shaanmajid)",
+    "Remco Haszing (https://github.com/remcohaszing)",
     "Willian Agostini (https://github.com/WillianAgostini)",
-    "Remco Haszing (https://github.com/remcohaszing)",
     "Rikki Gibson (https://github.com/RikkiGibson)"
   ],
   "sideEffects": false,

 # Changelog
+## v1.18.0 — June 13, 2026
+This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.
+## 🔒 Security Fixes
+* **Redirect Header Safety:** Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (__#10892__)
+* **URL And Request Hardening:** Rejects malformed `http:` and `https:` URLs that omit `//` with `ERR_INVALID_URL`, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local `NO_PROXY` matching. (__#11000__)
+## 🐛 Bug Fixes
+* **Status Validation:** Added `transitional.validateStatusUndefinedResolves` so applications can opt in to treating `validateStatus: undefined` like the option was omitted, while `validateStatus: null` remains the explicit way to accept every status. (__#10899__)
+## 🔧 Maintenance & Chores
+* **Documentation:** Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the `proxy` request config as Node.js-only in the advanced docs. (__#10984__, __#10988__, __#10992__, __#10995__)
+* **Dependencies:** Bumped `@babel/core`, `@babel/preset-env`, `@commitlint/cli`, `@commitlint/config-conventional`, `@rollup/plugin-babel`, `@rollup/plugin-commonjs`, `@vitest/browser`, `@vitest/browser-playwright`, `eslint`, `lint-staged`, `rollup`, `vitest`, and `actions/checkout`. (__#10989__, __#10996__, __#10997__)
+* **Release Metadata:** Prepared the 1.18.0 release by updating package metadata and the runtime `VERSION` value. (__#11003__)
+## 🌟 New Contributors
+We are thrilled to welcome our new contributors. Thank you for helping improve axios:
+* __@drori12__ (__#10984__)
+* __@eyupcanakman__ (__#10899__)
+* __@Adi-Beker__ (__#10995__)
+[Full Changelog](https://github.com/axios/axios/compare/v1.17.0...v1.18.0)
 ## v1.17.0 — June 1, 2026
 This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

Comparingaxios@1.18.0

Comparingaxios@1.18.0

Source

Source

npm diff

Options

Bundlephobia

Bundlephobia

Packagephobia

Packagephobia

dist/browser/axios.cjs +++70---28

dist/node/axios.cjs +++123---33

index.d.cts +++17---1

lib/adapters/adapters.js +++1---1

dist/axios.js +++64---15

dist/esm/axios.js +++70---28

lib/core/AxiosError.js +++13---1

lib/helpers/AxiosURLSearchParams.js +++1---3

lib/helpers/buildURL.js +++1---0

lib/helpers/composeSignals.js +++1---1

lib/helpers/cookies.js +++5---1

lib/env/data.js +++1---1

lib/adapters/fetch.js +++27---12

lib/helpers/fromDataURI.js +++4---2

lib/adapters/http.js +++88---16

lib/core/mergeConfig.js +++1---0

lib/helpers/resolveConfig.js +++10---5

lib/helpers/toFormData.js +++7---1

lib/helpers/validator.js +++1---1

lib/adapters/xhr.js +++1---0

package.json +++2---2

CHANGELOG.md +++32---0

README.md +++128---23

index.d.ts +++17---1

+++0---0

Packagephobia

Bundlephobia

dist/browser/axios.cjs +++70---28

dist/node/axios.cjs +++123---33

index.d.cts +++17---1

lib/adapters/adapters.js +++1---1

dist/axios.js +++64---15

dist/esm/axios.js +++70---28

lib/core/AxiosError.js +++13---1

lib/helpers/AxiosURLSearchParams.js +++1---3

lib/helpers/buildURL.js +++1---0

lib/helpers/composeSignals.js +++1---1

lib/helpers/cookies.js +++5---1

lib/env/data.js +++1---1

lib/adapters/fetch.js +++27---12

lib/helpers/fromDataURI.js +++4---2

lib/adapters/http.js +++88---16

lib/core/mergeConfig.js +++1---0

lib/helpers/resolveConfig.js +++10---5

lib/helpers/toFormData.js +++7---1

lib/helpers/validator.js +++1---1

lib/adapters/xhr.js +++1---0

package.json +++2---2

CHANGELOG.md +++32---0

README.md +++128---23

index.d.ts +++17---1

Source

Source

Comparing
`axios@1.18.0`

Comparing
`axios@1.18.0`