Skip to content

chore(deps): bump axios from 1.16.0 to 1.18.1#6479

Merged
antonis merged 2 commits into
mainfrom
dependabot/npm_and_yarn/axios-1.18.1
Jul 21, 2026
Merged

chore(deps): bump axios from 1.16.0 to 1.18.1#6479
antonis merged 2 commits into
mainfrom
dependabot/npm_and_yarn/axios-1.18.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps axios from 1.16.0 to 1.18.1.

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

  • AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
  • Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
  • Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
  • AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

  • Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

  • Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

  • Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

  • URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

  • Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

  • Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

  • Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

  • Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

  • Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

  • URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

  • Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

  • Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

  • Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

  • Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

... (truncated)

Commits
  • a209bfb chore(release): prepare release 1.18.1 (#11027)
  • fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
  • 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
  • a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
  • cf1306a docs: add Deno to install instructions (#11023)
  • b32880a fix: incorrect use of error (#11021)
  • 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
  • 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
  • 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
  • e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [axios](https://github.com/axios/axios) from 1.16.0 to 1.18.1.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.18.1)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 20, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).


  • chore(deps): bump axios from 1.16.0 to 1.18.1 by dependabot[bot] in #6479
  • chore(deps): bump actions/setup-java from 5.5.0 to 5.6.0 by dependabot in #6476

🤖 This preview updates automatically when you update the PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@antonis antonis added the ready-to-merge Triggers the full CI test suite label Jul 21, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Android (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 439.27 ms 476.53 ms 37.26 ms
Size 49.74 MiB 55.33 MiB 5.58 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
f3215d3+dirty 411.11 ms 454.38 ms 43.27 ms
d2eadf8+dirty 414.64 ms 454.56 ms 39.92 ms
b0d3373+dirty 557.66 ms 579.42 ms 21.76 ms
27d9693+dirty 419.08 ms 469.12 ms 50.04 ms
4e0b819+dirty 420.56 ms 470.08 ms 49.52 ms
9474ead+dirty 411.45 ms 446.80 ms 35.35 ms
0bd8916+dirty 412.77 ms 451.31 ms 38.54 ms
f9c1ed4+dirty 431.00 ms 466.22 ms 35.22 ms
3d536d1+dirty 524.34 ms 547.32 ms 22.98 ms
04207c4+dirty 459.19 ms 518.54 ms 59.35 ms

App size

Revision Plain With Sentry Diff
f3215d3+dirty 48.30 MiB 53.49 MiB 5.19 MiB
d2eadf8+dirty 48.30 MiB 53.48 MiB 5.18 MiB
b0d3373+dirty 48.30 MiB 53.58 MiB 5.28 MiB
27d9693+dirty 49.74 MiB 55.09 MiB 5.34 MiB
4e0b819+dirty 49.74 MiB 54.81 MiB 5.07 MiB
9474ead+dirty 48.30 MiB 53.61 MiB 5.30 MiB
0bd8916+dirty 48.30 MiB 53.57 MiB 5.26 MiB
f9c1ed4+dirty 49.74 MiB 54.86 MiB 5.12 MiB
3d536d1+dirty 49.74 MiB 55.26 MiB 5.52 MiB
04207c4+dirty 43.75 MiB 48.12 MiB 4.37 MiB

@github-actions

Copy link
Copy Markdown
Contributor

Android (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 416.70 ms 473.08 ms 56.39 ms
Size 49.74 MiB 55.33 MiB 5.58 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
a50b33d+dirty 353.21 ms 398.48 ms 45.27 ms
d038a14+dirty 405.08 ms 444.36 ms 39.28 ms
68672fc+dirty 407.55 ms 442.96 ms 35.41 ms
ad66da3+dirty 411.49 ms 449.38 ms 37.89 ms
f170ec3+dirty 505.96 ms 551.88 ms 45.92 ms
27d9693+dirty 438.63 ms 514.08 ms 75.46 ms
41d6254+dirty 406.20 ms 445.52 ms 39.32 ms
68ae91b+dirty 515.04 ms 578.08 ms 63.04 ms
5ee78d6+dirty 411.18 ms 437.83 ms 26.65 ms
ae37560+dirty 428.96 ms 456.86 ms 27.90 ms

App size

Revision Plain With Sentry Diff
a50b33d+dirty 43.94 MiB 48.94 MiB 5.00 MiB
d038a14+dirty 48.30 MiB 53.49 MiB 5.19 MiB
68672fc+dirty 48.30 MiB 53.61 MiB 5.31 MiB
ad66da3+dirty 48.30 MiB 53.49 MiB 5.19 MiB
f170ec3+dirty 48.30 MiB 53.57 MiB 5.26 MiB
27d9693+dirty 49.74 MiB 55.09 MiB 5.34 MiB
41d6254+dirty 48.30 MiB 53.60 MiB 5.30 MiB
68ae91b+dirty 49.74 MiB 54.79 MiB 5.05 MiB
5ee78d6+dirty 48.30 MiB 53.58 MiB 5.28 MiB
ae37560+dirty 48.30 MiB 53.60 MiB 5.29 MiB

@antonis
antonis enabled auto-merge (squash) July 21, 2026 08:07
@antonis
antonis merged commit ef1472b into main Jul 21, 2026
119 of 130 checks passed
@antonis
antonis deleted the dependabot/npm_and_yarn/axios-1.18.1 branch July 21, 2026 08:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code ready-to-merge Triggers the full CI test suite

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant