False
        

Тригерний текст Ігнорований текст Блокуючий текст

    Skip to content

      Navigation Menu

            Sign in Appearance settings
                * Platform
                        + AI CODE CREATION
                            o GitHub Copilot Write better code with AI
                            o GitHub Copilot app Direct agents from issue to merge
                            o MCP Registry Integrate external tools
                        + DEVELOPER WORKFLOWS
                            o Actions Automate any workflow
                            o Codespaces Instant dev environments
                            o Issues Plan and track work
                            o Code Review Manage code changes
                            o Code Quality Enforce quality at merge
                        + APPLICATION SECURITY
                            o GitHub Advanced Security Find and fix vulnerabilities
                            o Code security Secure your code as you build
                            o Secret protection Stop leaks before they start
                        + EXPLORE
                            o Why GitHub
                            o Documentation
                            o Blog
                            o Changelog
                            o Marketplace
                      View all features
                * Solutions
                        + BY COMPANY SIZE
                            o Enterprises
                            o Small and medium teams
                            o Startups
                            o Nonprofits
                        + BY USE CASE
                            o App Modernization
                            o DevSecOps
                            o DevOps
                            o CI/CD
                            o View all use cases
                        + BY INDUSTRY
                            o Healthcare
                            o Financial services
                            o Manufacturing
                            o Government
                            o View all industries
                      View all solutions
                * Resources
                        + EXPLORE BY TOPIC
                            o AI
                            o Software Development
                            o DevOps
                            o Security
                            o View all topics
                        + EXPLORE BY TYPE
                            o Customer stories
                            o Events & webinars
                            o Ebooks & reports
                            o Business insights
                            o GitHub Skills
                        + SUPPORT & SERVICES
                            o Documentation
                            o Customer support
                            o Community forum
                            o Trust center
                            o Partners
                      View all resources
                * Open Source
                        + COMMUNITY
                            o GitHub Sponsors Fund open source developers
                        + PROGRAMS
                            o Security Lab
                            o Maintainer Community
                            o Accelerator
                            o GitHub Stars
                            o Archive Program
                        + REPOSITORIES
                            o Topics
                            o Trending
                            o Collections
                * Enterprise
                        + ENTERPRISE SOLUTIONS
                            o Enterprise platform AI-powered developer platform
                        + AVAILABLE ADD-ONS
                            o GitHub Advanced Security Enterprise-grade security features
                            o Copilot for Business Enterprise-grade AI features
                            o Premium Support Enterprise-grade 24/7 support
              * Pricing
                Type / to search
                Sign in
              Sign up Appearance settings
      You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert

              Uh oh!

              There was an error while loading. Please reload this page.

              axios / axios Public

                      * Uh oh!

                        There was an error while loading. Please reload this page.

              * Notifications You must be signed in to change notification settings
              * Fork 11.8k
                * Star 109k
          * Code
          * Issues 47
          * Pull requests 19
          * Discussions
          * Actions
          * Security and quality 39
          * Insights
          Additional navigation options
                  * Code
                  * Issues
                  * Pull requests
                  * Discussions
                  * Actions
                  * Security and quality
                  * Insights

        Releases: axios/axios

              Releases Tags
            Releases · axios/axios

                Release list

                    * v1.19.0
                    * v1.18.1
                    * v1.18.0
                    * v0.33.0
                    * v1.17.0
                    * v1.16.1
                    * v0.32.0
                    * v1.16.0
                    * v1.15.2
                    * v1.15.1
                    Previous Next
                Jump to release
                        * v1.19.0
                        * v1.18.1
                        * v1.18.0
                        * v0.33.0
                        * v1.17.0
                        * v1.16.1
                        * v0.32.0
                        * v1.16.0
                        * v1.15.2
                        * v1.15.1
                    Previous Next

                v1.19.0

                              v1.19.0 Latest
                              Latest
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 26 Jul 14:13
                              Immutable release. Only release title and notes can be modified.
                              v1.19.0
                              311fcc5
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v1.19.0 - July 22, 2026

                          This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

                          🔒 Security Fixes

                            * Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

                          🚀 New Features

                            * Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
                              adapters, and serializers. (#11043, #11081)
                            * Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
                            * HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

                          🐛 Bug Fixes

                            * Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
                            * Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
                            * Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
                            * Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
                            * URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
                            * Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
                            * Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
                            * Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
                            * Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

                          🔧 Maintenance & Chores

                            * Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
                            * Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
                            * Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
                            * Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
                            * Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
                            * Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

                          🌟 New Contributors

                          We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

                            * @afonsojramos (#11028)
                            * @MahinAnowar (#11006)
                            * @yassertawfik4 (#11024)
                            * @AnandSundar (#11029)
                            * @lin-hongkuan (#11035)
                            * @Wali007-lab (#11054)
                            * @magicdawn (#11043)
                            * @andrewkernel (#11053)
                            * @Sagargupta16 (#11059)
                            * @Rpaudel379 (#11078)
                            * @kobihikri (#11076)
                            * @spokodev (#11061)
                            * @shaedrich (#11081)
                            * @QodeXcli (#11062)
                            * @akahoshi1421 (#11067)
                            * @TheHonoredOne914 (#11071)
                            * @Ahsan1Murtaza (#11073)

                          Full Changelog (v1.18.1...v1.19.0)

                          Contributors

                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            magicdawn, kobihikri, and 15 other contributors
                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 8 softy2k, kra8, dmitryshostak, akahoshi1421, smarthomesven, Denisskas, Brainbox911, and sajorahasan reacted with thumbs up emoji 🎉 4 methbkts, Denisskas, sajorahasan, and michaelhazan reacted with hooray emoji ❤️ 3 HamoBoker, Denisskas, and sajorahasan reacted with heart emoji
                                All reactions
                                  * 👍 8 reactions
                                  * 🎉 4 reactions
                                  * ❤️ 3 reactions
                              11 people reacted

                v1.18.1

                              v1.18.1
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 21 Jun 17:25
                              Immutable release. Only release title and notes can be modified.
                              v1.18.1
                              a209bfb
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v1.18.1 — June 21, 2026

                          This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

                          🐛 Bug Fixes

                            * AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
                            * Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
                            * Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
                            * AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

                          🔧 Maintenance & Chores

                            * Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

                            * Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

                          🌟 New Contributors

                          We are thrilled to welcome our new contributors. Thank you for helping improve axios:

                            * @webdevelopersrinu (#10913)
                            * @sijie-Z (#10993)
                            * @bartlomieju (#11023)
                            * @JSap0914 (#11019)

                          Full Changelog

                          Contributors

                            * 
                            * 
                            * 
                            * 
                            bartlomieju, JSap0914, and 2 other contributors
                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 6 softy2k, sschmeck, sefinek, jordankkk, richmondb, and sajorahasan reacted with thumbs up emoji 🎉 1 methbkts reacted with hooray emoji ❤️ 3 HamoBoker, sefinek, and sajorahasan reacted with heart emoji
                                All reactions
                                  * 👍 6 reactions
                                  * 🎉 1 reaction
                                  * ❤️ 3 reactions
                              8 people reacted

                v1.18.0

                              v1.18.0
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 13 Jun 12:00
                              Immutable release. Only release title and notes can be modified.
                              v1.18.0
                              2d06f96
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v1.18.0 — June 13, 2026

                          This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

                          🔒 Security Fixes

                            * Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

                            * URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

                          🐛 Bug Fixes

                            * Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

                          🔧 Maintenance & Chores

                            * Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

                            * Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

                            * Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

                          🌟 New Contributors

                          We are thrilled to welcome our new contributors. Thank you for helping improve axios:

                            * @drori12 (#10984)
                            * @eyupcanakman (#10899)
                            * @Adi-Beker (#10995)

                          Full Changelog

                          Contributors

                            * 
                            * 
                            * 
                            eyupcanakman, drori12, and Adi-Beker
                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 7 sajorahasan, smarthomesven, elite-richmond, TY-LIU, Denisskas, maximilianschmid, and ayushvyas-dev reacted with thumbs up emoji 🎉 3 justedlev, qwuik, and methbkts reacted with hooray emoji
                                All reactions
                                  * 👍 7 reactions
                                  * 🎉 3 reactions
                              10 people reacted

                v0.33.0

                              v0.33.0
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 13 Jun 11:53
                              Immutable release. Only release title and notes can be modified.
                              v0.33.0
                              d998cc9
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v0.33.0 — June 13, 2026

                          This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

                          🔒 Security Fixes

                            * Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats 0.0.0.0 as local for proxy bypass. (#11001)

                          🚀 New Features

                            * Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#10937)

                          🔧 Maintenance & Chores

                            * Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#10936, #10943)
                            * Changelog: Backfills missing v0.x changelog entries for prior releases. (#10842)
                            * Release Metadata: Bumps package and internal version metadata for v0.33.0. (#11002)

                          Full Changelog

                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                                All reactions

                v1.17.0

                              v1.17.0
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 03 Jun 06:14
                              Immutable release. Only release title and notes can be modified.
                              v1.17.0
                              4306df2
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v1.17.0 — June 1, 2026

                          This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

                          🔒 Security Fixes

                            * Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
                            * Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

                          🚀 New Features

                            * HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

                          🐛 Bug Fixes

                            * Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
                            * Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
                            * React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
                            * Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
                            * Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
                            * Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
                            * Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
                            * Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

                          🔧 Maintenance & Chores

                            * HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
                            * Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
                            * CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
                            * Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
                            * Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
                            * Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

                          🌟 New Contributors

                          We are thrilled to welcome our new contributors. Thank you for helping improve axios:

                            * @BasixKOR (#6792)
                            * @carladams1299-lab (#10861)
                            * @LaplaceYoung (#10812)
                            * @JamieMagee (#10939)
                            * @RonGamzu (#10905)
                            * @sapirbaruch (#10891)
                            * @nezukoagent (#10901)
                            * @devareddy05 (#10929)
                            * @Mohammad-Faiz-Cloud-Engineer (#10922)
                            * @azandabot (#10931)
                            * @niksy (#10896)

                          Full Changelog

                          Contributors

                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            niksy, JamieMagee, and 9 other contributors
                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 7 softy2k, elite-richmond, sajorahasan, maximilianschmid, thangtv-3206, Denisskas, and Gigoland reacted with thumbs up emoji 🎉 4 methbkts, elite-richmond, sajorahasan, and Denisskas reacted with hooray emoji ❤️ 2 justedlev and Denisskas reacted with heart emoji
                                All reactions
                                  * 👍 7 reactions
                                  * 🎉 4 reactions
                                  * ❤️ 2 reactions
                              9 people reacted

                v1.16.1

                              v1.16.1
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 13 May 16:19
                              Immutable release. Only release title and notes can be modified.
                              v1.16.1
                              1337d6b
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v1.16.1 — May 13, 2026

                          This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

                          🔒 Security Fixes

                            * Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
                            * Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
                            * CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

                          🐛 Bug Fixes

                            * Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
                            * Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
                            * XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
                            * Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
                            * Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
                            * URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

                          🔧 Maintenance & Chores

                            * Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
                            * composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
                            * AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
                            * Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
                            * Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
                            * Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

                          🌟 New Contributors

                          We are thrilled to welcome our new contributors. Thank you for helping improve axios:

                            * @hpinmetaverse (#10836)
                            * @tommyhgunz14 (#7413)
                            * @abhu85 (#10829)
                            * @divyanshuraj1095 (#10853)
                            * @sagodi97 (#10856)
                            * @rkdfx (#10868)
                            * @Liuwei1125 (#10866)

                          Full Changelog

                          Contributors

                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            rkdfx, sagodi97, and 5 other contributors
                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 7 HamoBoker, Leftyx, maximilianschmid, richmondb, lastzero, justinetobithe, and Brainbox911 reacted with thumbs up emoji 🎉 2 lastzero and justinetobithe reacted with hooray emoji ❤️ 2 lastzero and bestdevguy50-ops reacted with heart emoji 🚀 2 lastzero and bestdevguy50-ops reacted with rocket emoji
                                All reactions
                                  * 👍 7 reactions
                                  * 🎉 2 reactions
                                  * ❤️ 2 reactions
                                  * 🚀 2 reactions
                              8 people reacted

                v0.32.0

                              v0.32.0
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 04 May 17:15
                              Immutable release. Only release title and notes can be modified.
                              v0.32.0
                              8db2d44
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v0.32.0 — May 4, 2026

                          This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

                          ⚠️ Breaking Changes & Deprecations

                            * Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

                          🔒 Security Fixes

                            * Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
                            * Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
                            * Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
                            * Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
                            * Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
                            * URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
                            * Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

                          🔧 Maintenance & Chores

                            * Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

                          Full Changelog

                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 3 ShaneLee-9, lyudommuny13, and rognales reacted with thumbs up emoji
                                All reactions
                                  * 👍 3 reactions
                              3 people reacted

                v1.16.0

                              v1.16.0
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 02 May 12:31
                              Immutable release. Only release title and notes can be modified.
                              v1.16.0
                              df53d7d
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          v1.16.0 — May 2, 2026

                          This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

                          ⚠️ Notable Changes

                          A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

                            * Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)
                            * Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)
                            * Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)
                            * parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)
                            * Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)
                            * transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

                          🚀 New Features

                            * QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)
                            * ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)
                            * Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

                          🐛 Bug Fixes

                            * HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)
                            * HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)
                            * Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)
                            * XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)
                            * Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)
                            * Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)
                            * UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)
                            * Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

                          🔧 Maintenance & Chores

                            * Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)
                            * Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)
                            * Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)
                            * Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)
                            * Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)
                            * Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

                          🌟 New Contributors

                          We are thrilled to welcome our new contributors. Thank you for helping improve axios:

                            * @singhankit001 (#10588)
                            * @cuiweixie (#7419)
                            * @iruizsalinas (#10787)
                            * @MarcosNocetti (#10680)
                            * @deepview-autofix (#10729)
                            * @atharvasingh7007 (#10745)
                            * @OfekDanny (#10772)
                            * @mnahkies (#7414)
                            * @tboyila (#10759)
                            * @Kingo64 (#6897)
                            * @ramram1048 (#6389)
                            * @FLNacif (#6460)
                            * @zozo123 (#10806)
                            * @pierluigilenoci (#10802)
                            * @afurm (#10708)
                            * @karan-lrn (#7378)
                            * @ebeigarts (#7149)
                            * @Raymondo97 (#10782)
                            * @mixelburg (#10821)
                            * @ashishkr96 (#10822)
                            * @cyphercodes (#10819)
                            * @Jye10032 (#7260)
                            * @VeerShah41 (#7276)

                          Full Changelog

                          Contributors

                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            * 
                            ebeigarts, zozo123, and 21 other contributors
                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 8 softy2k, yunusemreaksu, DEV-DIBSTER, Denisskas, rojadesign, maximilianschmid, patrykszwed, and MOHAMEDHAMLV reacted with thumbs up emoji
                                All reactions
                                  * 👍 8 reactions
                              8 people reacted

                v1.15.2

                              v1.15.2
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 21 Apr 17:51
                              Immutable release. Only release title and notes can be modified.
                              v1.15.2
                              5829343
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

                          🔒 Security Fixes

                            * Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
                            * SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
                            * Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

                          🚀 New Features

                            * allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

                          🐛 Bug Fixes

                            * Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

                          🔧 Maintenance & Chores

                            * Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

                          Full Changelog

                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 13 ghiscoding, xinglongjizi, sajorahasan, BluDood, rojadesign, rafael-piovesan, anultravioletaurora, abdorayden, Denisskas, iguit0, and 3 more reacted with thumbs up emoji 🎉 2 qwuik and Denisskas reacted with hooray emoji
                                All reactions
                                  * 👍 13 reactions
                                  * 🎉 2 reactions
                              14 people reacted

                v1.15.1

                              v1.15.1
                            Compare

                                  Choose a tag to compare

                                      Sorry, something went wrong.

                                Filter
                                  Loading

                                        Sorry, something went wrong.

                                          Uh oh!

                                          There was an error while loading. Please reload this page.

                                  No results found

                                View all tags
                              jasonsaayman released this 19 Apr 17:06
                              Immutable release. Only release title and notes can be modified.
                              v1.15.1
                              ac42446
                                      This commit was created on GitHub.com and signed with GitHub’s verified signature.
                                    GPG key ID: B5690EEEBB952194
                                      Verified
                                    Learn about vigilant mode.

                          This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

                          🔒 Security Fixes

                            * Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
                            * CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
                            * Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
                            * withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
                            * maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
                            * Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
                            * Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

                          🚀 New Features

                            * AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
                            * Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

                          🐛 Bug Fixes

                            * FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
                            * HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
                            * Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
                            * Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
                            * buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
                            * AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
                            * Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)
                            * Docs Artefact Cleanup: Removes the docs content that was incorrectly committed. (#10727)

                          🔧 Maintenance & Chores

                            * Threat Model & Security Docs: Ongoing refinement of THREATMODEL.md, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (#10672, #10715, #10718, #10722, #10763, #10765)
                            * Test Coverage & Migration: Expanded shouldBypassProxy coverage for wildcard/IPv6/edge cases, documented and tested AxiosError.status, and migrated progressEventReducer tests to Vitest. (#10723, #10725, #10741)
                            * Type Refactor: Uses TypeScript utility types to deduplicate literal unions. (#7520)
                            * Repo & CI: Adds CODEOWNERS, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (#10739, #10738, #10746)
                            * Changelog Backfill: Added missing version entries to the changelog. (#10704)
                            * Dependencies: Bumped follow-redirects (1.15.11 → 1.16.0) in root and docs, axios (1.14.0 → 1.15.0) in docs, and a group of 5 development dependencies. (#10717, #10716, #10684, #10709)

                          🌟 New Contributors

                          We are thrilled to welcome our new contributors. Thank you for helping improve axios:

                            * @curiouscoder-cmd (#7252)
                            * @tryonelove (#7520)
                            * @darwin808 (#7314)
                            * @zoontek (#10702)
                            * @AKIB473 (#10725)

                          Full Changelog

                          Contributors

                            * 
                            * 
                            * 
                            * 
                            * 
                            zoontek, tryonelove, and 3 other contributors
                          Assets 3
                            Loading

                                    Uh oh!

                                    There was an error while loading. Please reload this page.

                              👍 5 HamoBoker, sajorahasan, ryota-murakami, migueldaipre, and maximilianschmid reacted with thumbs up emoji 😄 1 ShaneLee-9 reacted with laugh emoji 🎉 3 sajorahasan, ryota-murakami, and migueldaipre reacted with hooray emoji ❤️ 3 sajorahasan, ryota-murakami, and migueldaipre reacted with heart emoji 🚀 6 RikoDEV, HamoBoker, sajorahasan, Ryuno-Ki, ryota-murakami, and rivajunior reacted with rocket emoji
                                All reactions
                                  * 👍 5 reactions
                                  * 😄 1 reaction
                                  * 🎉 3 reactions
                                  * ❤️ 3 reactions
                                  * 🚀 6 reactions
                              9 people reacted
                Previous 1 2 3 4 5 … 12 13 Next
                Previous Next

  Footer

      © 2026 GitHub, Inc.

    Footer navigation

      * Terms
      * Privacy
      * Security
      * Status
      * Community
      * Docs
      * Contact
      * Manage cookies
      * Do not share my personal information
    You can’t perform that action at this time.