Update dependency axios to v1.21.1 #128
No reviewers
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
MobiusReactor/TicTacToeV2!128
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/axios-1.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.18.1→1.21.1Release Notes
axios/axios (axios)
v1.21.1Compare Source
v1.21.1 — November 9, 2026
This release raises the minimum
follow-redirectsversion to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects thegetAdaptertypings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.🔒 Security Fixes
follow-redirectsrange from^1.16.0to^1.16.2to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions,sensitiveHeadersarrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)🐛 Bug Fixes
dispatchRequestnow measuresresponse.durationwithperformance.now()and usesDate.now()only whenperformance.now()isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejectsDate.now()while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)getAdapternow accepts an optionalconfig?: AxiosRequestConfiginindex.d.tsandindex.d.cts, matching what it does at runtime. You can now callgetAdapter('fetch', { env: { fetch: myFetch } })without a cast. (#11404)🔧 Maintenance & Chores
Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:
transformRequestruns for every method, and transformers receive(data, headers, status).responseTypeandContent-Typehave no default value.AxiosHeaders#getand#normalizeare described correctly.axios.isAxiosError(), not byname.ECONNREFUSEDandERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit thatmaxDepthdoesn't change.redactdoesn't scan, which adapters enforcemaxContentLength/maxBodyLength, and howformToJSON()handles field name collisions.(#11374, #11373, #11389, #11419, #11429, #11430)
Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)
Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover
AbortSignal,CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests forno_proxyedge cases inshouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#11396)
Dependencies: Updated development and tooling dependencies, including
vitestand@vitest/*(to 5.x at the root),typescript(7.x at the root),vite,rollup,eslint,playwright,@commitlint/*,@rollup/plugin-alias,@rollup/plugin-terser,body-parser,multer,serialize-javascript,fast-uri,qs,zizmorcore/zizmor-action, andfollow-redirectsin/docs. (#11383, #11375, #11372, #11345, #11392, #11387, #11386, #11385, #11391, #11388, #11395, #11421, #11422, #11426)Release: Prepared the 1.21.1 release. (#11435)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog
v1.21.0Compare Source
This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.
v1.20.0Compare Source
v1.20.0 — August 19, 2026
This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.
⚠️ Breaking Changes & Deprecations
🔒 Security Fixes
🐛 Bug Fixes
🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog (https://github.com/axios/axios/compare/v1.19.0...v1.20.0)
v1.19.0Compare Source
This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
1ca27fc00dto1565e419f7Update dependency axios to v1.19.0to Update dependency axios to v1.20.01565e419f7tob11c528b2eUpdate dependency axios to v1.20.0to Update dependency axios to v1.21.0b11c528b2etod69bac0586Update dependency axios to v1.21.0to Update dependency axios to v1.21.1View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.