Update dependency axios to v1.17.0 #37

Merged

spacebot merged 1 commit from renovate/axios-1.x-lockfile into main

2026-06-03 14:18:18 +02:00

spacebot commented

2026-06-03 09:16:52 +02:00

Owner

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.16.1` → `1.17.0`

Release Notes

axios/axios (axios)

`v1.17.0`

Compare Source

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@BasixKOR (#6792)
@carladams1299-lab (#10861)
@LaplaceYoung (#10812)
@JamieMagee (#10939)
@RonGamzu (#10905)
@sapirbaruch (#10891)
@nezukoagent (#10901)
@devareddy05 (#10929)
@Mohammad-Faiz-Cloud-Engineer (#10922)
@azandabot (#10931)
@niksy (#10896)

Full Changelog

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [axios](https://axios-http.com) ([source](https://github.com/axios/axios)) | [`1.16.1` → `1.17.0`](https://renovatebot.com/diffs/npm/axios/1.16.1/1.17.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/axios/1.17.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/axios/1.16.1/1.17.0?slim=true) | --- ### Release Notes <details> <summary>axios/axios (axios)</summary> ### [`v1.17.0`](https://github.com/axios/axios/releases/tag/v1.17.0) [Compare Source](https://github.com/axios/axios/compare/v1.16.1...v1.17.0) #### v1.17.0 — June 1, 2026 This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions. #### 🔒 Security Fixes - **Config Hardening:** Guarded `socketPath`, `params`, and `paramsSerializer` reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (**[#10901](https://github.com/axios/axios/issues/10901)**, **[#10922](https://github.com/axios/axios/issues/10922)**) - **Release Publishing:** Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (**[#10926](https://github.com/axios/axios/issues/10926)**) #### 🚀 New Features - **HTTP Compression:** Added Node HTTP adapter support for zstd response decompression, with `transitional.advertiseZstdAcceptEncoding` controlling whether `zstd` is advertised in `Accept-Encoding`. (**[#6792](https://github.com/axios/axios/issues/6792)**, **[#10920](https://github.com/axios/axios/issues/10920)**) #### 🐛 Bug Fixes - **Authentication Handling:** Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (**[#10929](https://github.com/axios/axios/issues/10929)**, **[#10896](https://github.com/axios/axios/issues/10896)**) - **Proxy TLS:** Preserved user `httpsAgent` TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (**[#10957](https://github.com/axios/axios/issues/10957)**) - **React Native FormData:** Cleared default `Content-Type` for React Native `FormData` so multipart boundaries can be generated correctly. (**[#10898](https://github.com/axios/axios/issues/10898)**) - **Headers:** Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (**[#10875](https://github.com/axios/axios/issues/10875)**) - **Request Data Merging:** Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (**[#10812](https://github.com/axios/axios/issues/10812)**) - **Bundler Compatibility:** Converted `resolveConfig` from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (**[#10891](https://github.com/axios/axios/issues/10891)**) - **Types:** Corrected `AxiosHeaders.toJSON()` return types and updated CommonJS `isCancel` typings to narrow to `CanceledError<T>`. (**[#10956](https://github.com/axios/axios/issues/10956)**, **[#10952](https://github.com/axios/axios/issues/10952)**) - **Build Tooling:** Avoided emitting a null `Authorization` header from the GitHub build helper when `GITHUB_TOKEN` is unset. (**[#10931](https://github.com/axios/axios/issues/10931)**) #### 🔧 Maintenance & Chores - **HTTP/2 Internals:** Extracted `Http2Sessions` into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (**[#10861](https://github.com/axios/axios/issues/10861)**) - **Package Publishing:** Reduced published package size by switching to a `files` allowlist and dropping unneeded unminified bundle source maps. (**[#10939](https://github.com/axios/axios/issues/10939)**) - **CI and Release Automation:** Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (**[#10907](https://github.com/axios/axios/issues/10907)**, **[#10911](https://github.com/axios/axios/issues/10911)**, **[#10916](https://github.com/axios/axios/issues/10916)**, **[#10927](https://github.com/axios/axios/issues/10927)**, **[#10935](https://github.com/axios/axios/issues/10935)**, **[#10983](https://github.com/axios/axios/issues/10983)**) - **Developer Workflow:** Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (**[#10925](https://github.com/axios/axios/issues/10925)**, **[#10914](https://github.com/axios/axios/issues/10914)**, **[#10958](https://github.com/axios/axios/issues/10958)**) - **Documentation and Policy:** Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (**[#10890](https://github.com/axios/axios/issues/10890)**, **[#10889](https://github.com/axios/axios/issues/10889)**, **[#10921](https://github.com/axios/axios/issues/10921)**, **[#10945](https://github.com/axios/axios/issues/10945)**, **[#10905](https://github.com/axios/axios/issues/10905)**, **[#10933](https://github.com/axios/axios/issues/10933)**, **[#10915](https://github.com/axios/axios/issues/10915)**, **[#10887](https://github.com/axios/axios/issues/10887)**, **[#10955](https://github.com/axios/axios/issues/10955)**) - **Dependencies:** Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, `fs-extra`, `qs`, docs dependencies, and GitHub Actions dependencies including `actions/dependency-review-action` and `zizmorcore/zizmor-action`. (**[#10871](https://github.com/axios/axios/issues/10871)**, **[#10879](https://github.com/axios/axios/issues/10879)**, **[#10918](https://github.com/axios/axios/issues/10918)**, **[#10919](https://github.com/axios/axios/issues/10919)**, **[#10934](https://github.com/axios/axios/issues/10934)**, **[#10947](https://github.com/axios/axios/issues/10947)**, **[#10954](https://github.com/axios/axios/issues/10954)**, **[#10960](https://github.com/axios/axios/issues/10960)**) #### 🌟 New Contributors We are thrilled to welcome our new contributors. Thank you for helping improve axios: - **[@BasixKOR](https://github.com/BasixKOR)** (**[#6792](https://github.com/axios/axios/issues/6792)**) - **[@carladams1299-lab](https://github.com/carladams1299-lab)** (**[#10861](https://github.com/axios/axios/issues/10861)**) - **[@LaplaceYoung](https://github.com/LaplaceYoung)** (**[#10812](https://github.com/axios/axios/issues/10812)**) - **[@JamieMagee](https://github.com/JamieMagee)** (**[#10939](https://github.com/axios/axios/issues/10939)**) - **[@RonGamzu](https://github.com/RonGamzu)** (**[#10905](https://github.com/axios/axios/issues/10905)**) - **[@sapirbaruch](https://github.com/sapirbaruch)** (**[#10891](https://github.com/axios/axios/issues/10891)**) - **[@nezukoagent](https://github.com/nezukoagent)** (**[#10901](https://github.com/axios/axios/issues/10901)**) - **[@devareddy05](https://github.com/devareddy05)** (**[#10929](https://github.com/axios/axios/issues/10929)**) - **[@Mohammad-Faiz-Cloud-Engineer](https://github.com/Mohammad-Faiz-Cloud-Engineer)** (**[#10922](https://github.com/axios/axios/issues/10922)**) - **[@azandabot](https://github.com/azandabot)** (**[#10931](https://github.com/axios/axios/issues/10931)**) - **[@niksy](https://github.com/niksy)** (**[#10896](https://github.com/axios/axios/issues/10896)**) [Full Changelog](https://github.com/axios/axios/compare/v1.16.1...v1.17.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

spacebot added 1 commit

2026-06-03 09:16:52 +02:00

chore(deps): update dependency axios to v1.17.0

backend / splatnet (push) Successful in 2m36s

Details

e378a2cdb5

spacebot force-pushed renovate/axios-1.x-lockfile from e378a2cdb5

backend / splatnet (push) Successful in 2m36s

Details

to c410aa4074

backend / docker (push) Successful in 3m57s

Details