Skip to content

build(deps): bump axios from 1.15.0 to 1.17.0 in /src-admin#3496

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/src-admin/axios-1.17.0
Closed

build(deps): bump axios from 1.15.0 to 1.17.0 in /src-admin#3496
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/src-admin/axios-1.17.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps axios from 1.15.0 to 1.17.0.

Release notes

Sourced from axios's releases.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Changelog

Sourced from axios's changelog.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 5, 2026
@dependabot dependabot Bot mentioned this pull request Jun 5, 2026
Closed
@github-actions

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

❌ Automerge Failed

Reason for attempting merge: Default rule for package-lock: Minor and patch updates are merged
Error: 3 of 4 required status checks are expected.
Status: mergeable_state=blocked, mergeable=true

Dependabot Information:

  • Package name(s): axios
  • Update type: minor
  • Dependency type: package-lock
  • Previous version: 1.15.0
  • New version: 1.17.0

Modified Files:

  • src-admin/package-lock.json

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src-admin/axios-1.17.0 branch from 8968989 to 0a14a94 Compare June 7, 2026 22:02
@github-actions

github-actions Bot commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

❌ Automerge Failed

Reason for attempting merge: Default rule for package-lock: Minor and patch updates are merged
Error: 3 of 4 required status checks are expected.
Status: mergeable_state=blocked, mergeable=true

Dependabot Information:

  • Package name(s): axios
  • Update type: minor
  • Dependency type: package-lock
  • Previous version: 1.15.0
  • New version: 1.17.0

Modified Files:

  • src-admin/package-lock.json

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src-admin/axios-1.17.0 branch from 0a14a94 to ecfc3a0 Compare June 9, 2026 14:04
@github-actions

github-actions Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

❌ Automerge Failed

Reason for attempting merge: Default rule for package-lock: Minor and patch updates are merged
Error: 3 of 4 required status checks are expected.
Status: mergeable_state=blocked, mergeable=true

Dependabot Information:

  • Package name(s): axios
  • Update type: minor
  • Dependency type: package-lock
  • Previous version: 1.15.0
  • New version: 1.17.0

Modified Files:

  • src-admin/package-lock.json

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src-admin/axios-1.17.0 branch from ecfc3a0 to 17b58e8 Compare June 11, 2026 05:19
@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

❌ Automerge Failed

Reason for attempting merge: Default rule for package-lock: Minor and patch updates are merged
Error: 3 of 4 required status checks are expected.
Status: mergeable_state=blocked, mergeable=true

Dependabot Information:

  • Package name(s): axios
  • Update type: minor
  • Dependency type: package-lock
  • Previous version: 1.15.0
  • New version: 1.17.0

Modified Files:

  • src-admin/package-lock.json

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src-admin/axios-1.17.0 branch 2 times, most recently from 6540487 to 670c66f Compare June 12, 2026 20:21
@dependabot
build(deps): bump axios from 1.15.0 to 1.17.0 in /src-admin
e844fe0 
Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.17.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.17.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.17.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump axios from 1.15.0 to 1.17.0 in /src-admin build(deps): bump axios from 1.15.0 to 1.17.0 in /src-admin Jun 12, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src-admin/axios-1.17.0 branch from 670c66f to e844fe0 Compare June 12, 2026 20:38
@github-actions

github-actions Bot commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

❌ Automerge Failed

Reason for attempting merge: Default rule for package-lock: Minor and patch updates are merged
Error: 3 of 4 required status checks are expected.
Status: mergeable_state=blocked, mergeable=true

Dependabot Information:

  • Package name(s): axios
  • Update type: minor
  • Dependency type: package-lock
  • Previous version: 1.15.0
  • New version: 1.17.0

Modified Files:

  • src-admin/package-lock.json

@dependabot @github

dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/src-admin/axios-1.17.0 branch June 29, 2026 13:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@GermanBluefox