build(deps): bump the patch-and-minor group across 1 directory with 22 updates

[dependabot]

Bumps the patch-and-minor group with 22 updates in the /web directory:

Package	From	To
@ant-design/icons	6.2.2	6.3.2
@ant-design/x	2.7.0	2.9.0
@ant-design/x-markdown	2.7.0	2.9.0
@ant-design/x-sdk	2.7.0	2.9.0
antd	6.3.7	6.5.3
axios	1.16.0	1.19.0
casdoor-js-sdk	0.19.0	0.20.0
i18next	26.0.8	26.3.6
react	19.2.5	19.2.8
@types/react	19.2.14	19.2.18
react-dom	19.2.5	19.2.8
@types/react-dom	19.2.3	19.2.4
react-i18next	17.0.6	17.0.11
react-router-dom	7.14.2	7.18.2
zustand	5.0.12	5.0.14
@vitejs/plugin-react	6.0.1	6.0.5
eslint	10.3.0	10.8.0
eslint-plugin-react-refresh	0.5.2	0.5.3
globals	17.6.0	17.8.0
typescript-eslint	8.59.1	8.65.0
vite	8.0.10	8.2.0
vitest	4.1.5	4.1.10

Updates @ant-design/icons from 6.2.2 to 6.3.2

Commits

• See full diff in compare view

Updates @ant-design/x from 2.7.0 to 2.9.0

Changelog

Sourced from @​ant-design/x's changelog.

2.9.0

2026-07-23

@​ant-design/x

• 🆕 Added useMobile hook, providing an SSR-safe way to detect mobile devices. #1945 by Mickey
• 🆕 Think and ThoughtChain add a destroyOnHidden prop to automatically destroy the DOM node when content is hidden. #1985 by wryyyds7
• 💄 Actions Feedback no longer renders Tooltip on mobile devices to avoid interaction interference. #1945 by Mickey
• 💄 Conversations now always shows the menu icon on mobile devices (no hover state on mobile). #1945 by Mickey
• 🐛 Improved click responsiveness for Actions, Conversations and other components on mobile by adding touch-action: manipulation to eliminate the 300ms click delay. #1945 by Mickey
• 🐛 Fix Sources CarouselCard not syncing its carousel index when the controlled activeKey changes; the left/right buttons now jump precisely via goTo and edge-button no-ops are fixed. #1945 by Mickey
• 🐛 Fix Sender speech input (useSpeech) not cleaning up SpeechRecognition on unmount, which caused state updates on an unmounted component. #1945 by Mickey
• 🐛 Fix CodeHighlighter not calling registerLanguage after async language loading, which prevented syntax highlighting from working; also fix the code block background not stretching fully during horizontal scroll. #1945 by Mickey
• 🐛 Fix Sender still showing the outer outline on focus in borderless mode. #1963 by QDyanbing
• 🐛 Fix Sender content type slots bypassing formatResult; all slot types (including content) now honor formatResult uniformly, with the DOM text used as the input value for content slots. #1986 by wenzeyu8888-rgb
• 🐛 Fix Suggestion popup not scrolling when there are many options; the popup now scrolls internally (overflow-y: auto) once content exceeds the max height (256px). #1983 by wenzeyu8888-rgb
• 🐛 Fix Sender agent tag label wrapping in agent mode; it now renders inline. #1990 by cc-hearts

@​ant-design/x-markdown

• 🐛 Fix XMarkdown performing an O(N²) code-block scan during streaming that froze the page on long content. #1972 by Div627

@​ant-design/x-sdk

• 🐛 Fix XStream not releasing the reader lock or canceling the underlying stream on early exit (loop break / incomplete read), avoiding resource leaks and dangling read requests. #1970 by Mickey

@​ant-design/x-skill

• 🐛 Fix the x-skill ora spinner (loader) failing to load in CJS environments; the loader instance is now cached and loaded via dynamic import, avoiding duplicate loads and initialization errors. #1980 by jay666mnj

Others

• 📖 Improve site page title composition: separate subtitle and title with a space to avoid concatenated wording. #1959 by Mickey
• 📖 Add a note in the FAQ recommending Antdv Next X for Vue users. #1966 by QDyanbing
• 📖 Unify the semantic DOM heading wording on the Chinese site. #1877 by Rain120
• 🛠 Hide the focus outline on the Component Overview search box. #1987 by QDyanbing

2.8.0

2026-06-08

@​ant-design/x

• 🆕 Folder component adds a right-click context menu. #1919 by Mickey
• 🐛 Fix FileCard.List scroll button state not refreshing when items update. #1914 by Ryker_Feng
• 🐛 Fix Sender runtime-inserted slots being cleared when the slotConfig ref changes. #1900 by pikanohup
• 🐛 Fix design token type coercion before arithmetic operations. #1910 by Div627

@​ant-design/x-markdown

... (truncated)

Commits

• 13afbf4 Merge pull request #1991 from ant-design/chore/changelog-2.9.0
• 5892920 test: update demo snapshots
• b22ee17 Merge branch 'main' into chore/changelog-2.9.0
• 002ec52 chore: bump version to 2.9.0
• d6c6808 chore: merge unreleased 2.8.1 changelog into 2.9.0
• 018276b chore: set 2.9.0 release date to 2026-07-23
• 93c44e1 chore: add newly merged PRs to 2.9.0 changelog
• f17d4ec Merge pull request #1980 from jay666mnj/fix-x-skill-ora-cjs
• 3f1aa9f Merge pull request #1877 from Rain120/feature/docs-unified_semantic
• b6cdd2b Merge branch 'main' into fix-x-skill-ora-cjs
• Additional commits viewable in compare view

Updates @ant-design/x-markdown from 2.7.0 to 2.9.0

Changelog

Sourced from @​ant-design/x-markdown's changelog.

2.9.0

2026-07-23

@​ant-design/x

• 🆕 Added useMobile hook, providing an SSR-safe way to detect mobile devices. #1945 by Mickey
• 🆕 Think and ThoughtChain add a destroyOnHidden prop to automatically destroy the DOM node when content is hidden. #1985 by wryyyds7
• 💄 Actions Feedback no longer renders Tooltip on mobile devices to avoid interaction interference. #1945 by Mickey
• 💄 Conversations now always shows the menu icon on mobile devices (no hover state on mobile). #1945 by Mickey
• 🐛 Improved click responsiveness for Actions, Conversations and other components on mobile by adding touch-action: manipulation to eliminate the 300ms click delay. #1945 by Mickey
• 🐛 Fix Sources CarouselCard not syncing its carousel index when the controlled activeKey changes; the left/right buttons now jump precisely via goTo and edge-button no-ops are fixed. #1945 by Mickey
• 🐛 Fix Sender speech input (useSpeech) not cleaning up SpeechRecognition on unmount, which caused state updates on an unmounted component. #1945 by Mickey
• 🐛 Fix CodeHighlighter not calling registerLanguage after async language loading, which prevented syntax highlighting from working; also fix the code block background not stretching fully during horizontal scroll. #1945 by Mickey
• 🐛 Fix Sender still showing the outer outline on focus in borderless mode. #1963 by QDyanbing
• 🐛 Fix Sender content type slots bypassing formatResult; all slot types (including content) now honor formatResult uniformly, with the DOM text used as the input value for content slots. #1986 by wenzeyu8888-rgb
• 🐛 Fix Suggestion popup not scrolling when there are many options; the popup now scrolls internally (overflow-y: auto) once content exceeds the max height (256px). #1983 by wenzeyu8888-rgb
• 🐛 Fix Sender agent tag label wrapping in agent mode; it now renders inline. #1990 by cc-hearts

@​ant-design/x-markdown

• 🐛 Fix XMarkdown performing an O(N²) code-block scan during streaming that froze the page on long content. #1972 by Div627

@​ant-design/x-sdk

• 🐛 Fix XStream not releasing the reader lock or canceling the underlying stream on early exit (loop break / incomplete read), avoiding resource leaks and dangling read requests. #1970 by Mickey

@​ant-design/x-skill

• 🐛 Fix the x-skill ora spinner (loader) failing to load in CJS environments; the loader instance is now cached and loaded via dynamic import, avoiding duplicate loads and initialization errors. #1980 by jay666mnj

Others

• 📖 Improve site page title composition: separate subtitle and title with a space to avoid concatenated wording. #1959 by Mickey
• 📖 Add a note in the FAQ recommending Antdv Next X for Vue users. #1966 by QDyanbing
• 📖 Unify the semantic DOM heading wording on the Chinese site. #1877 by Rain120
• 🛠 Hide the focus outline on the Component Overview search box. #1987 by QDyanbing

2.8.0

2026-06-08

@​ant-design/x

• 🆕 Folder component adds a right-click context menu. #1919 by Mickey
• 🐛 Fix FileCard.List scroll button state not refreshing when items update. #1914 by Ryker_Feng
• 🐛 Fix Sender runtime-inserted slots being cleared when the slotConfig ref changes. #1900 by pikanohup
• 🐛 Fix design token type coercion before arithmetic operations. #1910 by Div627

@​ant-design/x-markdown

... (truncated)

Commits

• 13afbf4 Merge pull request #1991 from ant-design/chore/changelog-2.9.0
• 5892920 test: update demo snapshots
• b22ee17 Merge branch 'main' into chore/changelog-2.9.0
• 002ec52 chore: bump version to 2.9.0
• d6c6808 chore: merge unreleased 2.8.1 changelog into 2.9.0
• 018276b chore: set 2.9.0 release date to 2026-07-23
• 93c44e1 chore: add newly merged PRs to 2.9.0 changelog
• f17d4ec Merge pull request #1980 from jay666mnj/fix-x-skill-ora-cjs
• 3f1aa9f Merge pull request #1877 from Rain120/feature/docs-unified_semantic
• b6cdd2b Merge branch 'main' into fix-x-skill-ora-cjs
• Additional commits viewable in compare view

Updates @ant-design/x-sdk from 2.7.0 to 2.9.0

Changelog

Sourced from @​ant-design/x-sdk's changelog.

2.9.0

2026-07-23

@​ant-design/x

• 🆕 Added useMobile hook, providing an SSR-safe way to detect mobile devices. #1945 by Mickey
• 🆕 Think and ThoughtChain add a destroyOnHidden prop to automatically destroy the DOM node when content is hidden. #1985 by wryyyds7
• 💄 Actions Feedback no longer renders Tooltip on mobile devices to avoid interaction interference. #1945 by Mickey
• 💄 Conversations now always shows the menu icon on mobile devices (no hover state on mobile). #1945 by Mickey
• 🐛 Improved click responsiveness for Actions, Conversations and other components on mobile by adding touch-action: manipulation to eliminate the 300ms click delay. #1945 by Mickey
• 🐛 Fix Sources CarouselCard not syncing its carousel index when the controlled activeKey changes; the left/right buttons now jump precisely via goTo and edge-button no-ops are fixed. #1945 by Mickey
• 🐛 Fix Sender speech input (useSpeech) not cleaning up SpeechRecognition on unmount, which caused state updates on an unmounted component. #1945 by Mickey
• 🐛 Fix CodeHighlighter not calling registerLanguage after async language loading, which prevented syntax highlighting from working; also fix the code block background not stretching fully during horizontal scroll. #1945 by Mickey
• 🐛 Fix Sender still showing the outer outline on focus in borderless mode. #1963 by QDyanbing
• 🐛 Fix Sender content type slots bypassing formatResult; all slot types (including content) now honor formatResult uniformly, with the DOM text used as the input value for content slots. #1986 by wenzeyu8888-rgb
• 🐛 Fix Suggestion popup not scrolling when there are many options; the popup now scrolls internally (overflow-y: auto) once content exceeds the max height (256px). #1983 by wenzeyu8888-rgb
• 🐛 Fix Sender agent tag label wrapping in agent mode; it now renders inline. #1990 by cc-hearts

@​ant-design/x-markdown

• 🐛 Fix XMarkdown performing an O(N²) code-block scan during streaming that froze the page on long content. #1972 by Div627

@​ant-design/x-sdk

• 🐛 Fix XStream not releasing the reader lock or canceling the underlying stream on early exit (loop break / incomplete read), avoiding resource leaks and dangling read requests. #1970 by Mickey

@​ant-design/x-skill

• 🐛 Fix the x-skill ora spinner (loader) failing to load in CJS environments; the loader instance is now cached and loaded via dynamic import, avoiding duplicate loads and initialization errors. #1980 by jay666mnj

Others

• 📖 Improve site page title composition: separate subtitle and title with a space to avoid concatenated wording. #1959 by Mickey
• 📖 Add a note in the FAQ recommending Antdv Next X for Vue users. #1966 by QDyanbing
• 📖 Unify the semantic DOM heading wording on the Chinese site. #1877 by Rain120
• 🛠 Hide the focus outline on the Component Overview search box. #1987 by QDyanbing

2.8.0

2026-06-08

@​ant-design/x

• 🆕 Folder component adds a right-click context menu. #1919 by Mickey
• 🐛 Fix FileCard.List scroll button state not refreshing when items update. #1914 by Ryker_Feng
• 🐛 Fix Sender runtime-inserted slots being cleared when the slotConfig ref changes. #1900 by pikanohup
• 🐛 Fix design token type coercion before arithmetic operations. #1910 by Div627

@​ant-design/x-markdown

... (truncated)

Commits

• 13afbf4 Merge pull request #1991 from ant-design/chore/changelog-2.9.0
• 5892920 test: update demo snapshots
• b22ee17 Merge branch 'main' into chore/changelog-2.9.0
• 002ec52 chore: bump version to 2.9.0
• d6c6808 chore: merge unreleased 2.8.1 changelog into 2.9.0
• 018276b chore: set 2.9.0 release date to 2026-07-23
• 93c44e1 chore: add newly merged PRs to 2.9.0 changelog
• f17d4ec Merge pull request #1980 from jay666mnj/fix-x-skill-ora-cjs
• 3f1aa9f Merge pull request #1877 from Rain120/feature/docs-unified_semantic
• b6cdd2b Merge branch 'main' into fix-x-skill-ora-cjs
• Additional commits viewable in compare view

Updates antd from 6.3.7 to 6.5.3

Release notes

Sourced from antd's releases.

6.5.3

• Input
  • 🐞 Fix Input.OTP using type="text" when mask is a string while preserving explicit type values. #58835 @​QDyanbing
  • 🐞 Fix Input.OTP displaying the original value when mask is true. #58805 @​cyphercodes
  • 💄 Fix Input.TextArea resize handle rendering as a dot on touch devices. #58812 @​pupuking723
• Typography
  • ⚡️ Improve Typography ellipsis tooltip performance in large lists. #58806 @​lkxdsb
  • 🐞 Fix Typography editable textarea font size not matching the edited content. #58551 @​gaurav0107
• 🐞 Fix DatePicker.RangePicker submitting unconfirmed partial values on blur when using showTime and allowEmpty. #58803 @​zombieJ
• 🐞 Fix Form.Item useStatus returning stale errors and warnings when the validation status remains unchanged. #58815 @​afc163
• 🐞 Fix Slider triggering onFocus and onBlur callbacks multiple times. #58711 @​QDyanbing
• 🐞 Fix Spin standalone indicators being mispositioned when nested in another Spin. #58801 @​QDyanbing
• 🐞 Fix Table controlled filter dropdown selections not updating while open. #58816 @​afc163
• 🐞 Fix Upload default download links allowing newly opened tabs to access the opener page. #58817 @​afc163
• 💄 Fix incomplete Icon base styles when theme.zeroRuntime or CSS layers are enabled. #58763 @​QDyanbing
• 💄 Fix Select suffix icons and selected content overlapping the clear icon with custom theme colors. #58581 @​QDyanbing
• 💄 Fix Tabs third-party <svg> icons not vertically aligning with labels. #58847 @​mohamedkhaled4053

---

• Input
  • 🐞 修复 Input.OTP 使用字符串 mask 时仍采用 type="text" 的问题，并保留显式 type 配置。#58835 @​QDyanbing
  • 🐞 修复 Input.OTP 的 mask 为 true 时仍显示原始值的问题。#58805 @​cyphercodes
  • 💄 修复 Input.TextArea 调整大小手柄在触摸设备上显示为小圆点的问题。#58812 @​pupuking723
• Typography
  • ⚡️ 优化 Typography 省略提示在大列表中的渲染性能。#58806 @​lkxdsb
  • 🐞 修复 Typography 可编辑文本框字号与被编辑内容不一致的问题。#58551 @​gaurav0107
• 🐞 修复 DatePicker.RangePicker 使用 showTime 和 allowEmpty 时失焦会提交未确认部分值的问题。#58803 @​zombieJ
• 🐞 修复 Form.Item useStatus 在校验状态未变化时返回旧错误和警告内容的问题。#58815 @​afc163
• 🐞 修复 Slider 的 onFocus 和 onBlur 回调被重复触发的问题。#58711 @​QDyanbing
• 🐞 修复 Spin 独立加载指示器嵌套使用时定位错乱的问题。#58801 @​QDyanbing
• 🐞 修复 Table 受控筛选面板保持打开时选中项未同步更新的问题。#58816 @​afc163
• 🐞 修复 Upload 默认下载打开的新页面可访问来源页面的问题。#58817 @​afc163
• 💄 修复启用 theme.zeroRuntime 或 CSS layer 时 Icon 基础样式不完整的问题。#58763 @​QDyanbing
• 💄 修复 Select 自定义主题色下后缀图标或选中内容与清除图标重叠的问题。#58581 @​QDyanbing
• 💄 修复 Tabs 中第三方 <svg> 图标与标签文字垂直方向未对齐的问题。#58847 @​mohamedkhaled4053

6.5.2

• 💄 Fix Button, Collapse, ColorPicker, Layout, Select, Space.Addon, Tree, and Typography borders not respecting the global lineWidth and lineType Design Tokens. #58740 #58741 #58742 #58743 #58745 #58755 @​li-jia-nan @​QDyanbing
• 🐞 Fix BorderBeam, Checkbox, and Switch reduced-motion styles causing Lightning CSS minification failures. #58707 @​QDyanbing
• Tag
  • 💄 Fix Tag missing spacing and incorrect vertical alignment for bare <svg> icons from third-party icon libraries. #58723 @​mohamedkhaled4053
  • 🐞 Fix Tag navigation being triggered when clicking the close icon with both href and closable set. #58720 @​QDyanbing
• 🐞 Fix Input.OTP dropping root DOM event handlers including onPointerDown, onAnimationEnd, onTransitionEnd, and onScrollEnd. #58697 react-component/util#794 @​aojunhao123
• 🐞 Fix Form triggering a hook-order warning in React 19 when using the UMD development build. #58417 @​biubiukam
• 💄 Fix Table missing the top border when a bordered nested table is wrapped by Tabs or custom content. #58746 @​QDyanbing
• 🐞 Fix Input.Search custom enterButton not respecting the component's disabled and loading states. #58726 @​QDyanbing
• 🐞 Fix Transfer custom action buttons passed through actions not preserving their own disabled state. #58718 @​QDyanbing
• 🐞 Fix Tree rootStyle being ignored, and deprecate it in favor of styles.root. #58709 @​QDyanbing
• 🐞 Fix Grid Col ignoring numeric 0 for the flex prop in regular and responsive configurations. #58719 @​QDyanbing
• 🐞 Fix InputNumber not displaying suffix when Form feedback is enabled. #58703 @​QDyanbing
• ⌨️ Fix Splitter percentage-based aria-valuemin and aria-valuemax values before container measurement, and prevent lazy drag previews from exceeding bounds next to zero-sized panels. #58702 @​QDyanbing

... (truncated)

Changelog

Sourced from antd's changelog.

6.5.3

2026-07-31

• Input
  • 🐞 Fix Input.OTP using type="text" when mask is a string while preserving explicit type values. #58835 @​QDyanbing
  • 🐞 Fix Input.OTP displaying the original value when mask is true. #58805 @​cyphercodes
  • 💄 Fix Input.TextArea resize handle rendering as a dot on touch devices. #58812 @​pupuking723
• Typography
  • ⚡️ Improve Typography ellipsis tooltip performance in large lists. #58806 @​lkxdsb
  • 🐞 Fix Typography editable textarea font size not matching the edited content. #58551 @​gaurav0107
• 🐞 Fix DatePicker.RangePicker submitting unconfirmed partial values on blur when using showTime and allowEmpty. #58803 @​zombieJ
• 🐞 Fix Form.Item useStatus returning stale errors and warnings when the validation status remains unchanged. #58815 @​afc163
• 🐞 Fix Slider triggering onFocus and onBlur callbacks multiple times. #58711 @​QDyanbing
• 🐞 Fix Spin standalone indicators being mispositioned when nested in another Spin. #58801 @​QDyanbing
• 🐞 Fix Table controlled filter dropdown selections not updating while open. #58816 @​afc163
• 🐞 Fix Upload default download links allowing newly opened tabs to access the opener page. #58817 @​afc163
• 💄 Fix incomplete Icon base styles when theme.zeroRuntime or CSS layers are enabled. #58763 @​QDyanbing
• 💄 Fix Select suffix icons and selected content overlapping the clear icon with custom theme colors. #58581 @​QDyanbing
• 💄 Fix Tabs third-party <svg> icons not vertically aligning with labels. #58847 @​mohamedkhaled4053

6.5.2

2026-07-24

• 💄 Fix Button, Collapse, ColorPicker, Layout, Select, Space.Addon, Tree, and Typography borders not respecting the global lineWidth and lineType Design Tokens. #58740 #58741 #58742 #58743 #58745 #58755 @​li-jia-nan @​QDyanbing
• 🐞 Fix BorderBeam, Checkbox, and Switch reduced-motion styles causing Lightning CSS minification failures. #58707 @​QDyanbing
• Tag
  • 💄 Fix Tag missing spacing and incorrect vertical alignment for bare <svg> icons from third-party icon libraries. #58723 @​mohamedkhaled4053
  • 🐞 Fix Tag navigation being triggered when clicking the close icon with both href and closable set. #58720 @​QDyanbing
• 🐞 Fix Input.OTP dropping root DOM event handlers including onPointerDown, onAnimationEnd, onTransitionEnd, and onScrollEnd. #58697 react-component/util#794 @​aojunhao123
• 🐞 Fix Form triggering a hook-order warning in React 19 when using the UMD development build. #58417 @​biubiukam
• 💄 Fix Table missing the top border when a bordered nested table is wrapped by Tabs or custom content. #58746 @​QDyanbing
• 🐞 Fix Input.Search custom enterButton not respecting the component's disabled and loading states. #58726 @​QDyanbing
• 🐞 Fix Transfer custom action buttons passed through actions not preserving their own disabled state. #58718 @​QDyanbing
• 🐞 Fix Tree rootStyle being ignored, and deprecate it in favor of styles.root. #58709 @​QDyanbing
• 🐞 Fix Grid Col ignoring numeric 0 for the flex prop in regular and responsive configurations. #58719 @​QDyanbing
• 🐞 Fix InputNumber not displaying suffix when Form feedback is enabled. #58703 @​QDyanbing
• ⌨️ Fix Splitter percentage-based aria-valuemin and aria-valuemax values before container measurement, and prevent lazy drag previews from exceeding bounds next to zero-sized panels. #58702 @​QDyanbing
• 📖 Fix the ant.design homepage theme preview resetting the selected theme during rerenders. #58687 @​meet-student
• 📝 Correct Anchor offsetTop default value to 0 in the Chinese documentation. #58710 @​dogledogle

6.5.1

2026-07-13

• 💄 Fix AutoComplete custom input background color being applied twice in the filled variant. #58669 @​QDyanbing
• 🐞 Fix Avatar, List, Pagination, Steps, and Table not responding to breakpoint changes after responsive configuration is enabled dynamically. #58654 @​li-jia-nan
• ⌨️ Fix Button, Checkbox, Switch, Splitter, and BorderBeam pseudo-element transitions and animations so they respect prefers-reduced-motion. #58685 @​li-jia-nan
• 🐞 Fix Button icon vertical alignment when used in Card extra. #58584 @​zombieJ

... (truncated)

Commits

• 5bf6ee5 docs: changelog for 6.5.3 (#58855)
• 209142c docs(Tabs): clarify global configuration for more icon (#58854)
• 6b6160d fix(Tabs): center bare \<svg> icons at any size (#58847)
• 393cc77 docs: fix Chinese demo locale redirect (#58846)
• 8780544 fix(table): sync controlled filter selections (#58816)
• 534579c fix(form): refresh status context values (#58815)
• dae6efe fix(Input): handle OTP mask input types consistently (#58835)
• 4924d63 fix: mask OTP values when mask is true (#58805)
• 27b6fe7 perf(Typography): defer native ellipsis measurement until hover (#58806)
• 8f55f60 fix(Slider): prevent duplicate focus and blur callbacks (#58711)
• Additional commits viewable in compare view

Updates axios from 1.16.0 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)
• @​Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and syn...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.