# Axios: what changed from 0 to 1

- Product: Axios (https://whatsnew.fyi/product/axios)
- Vendor: Axios
- Range: changelog entries numbered after v0.33.0 up to and including v1.20.0, stable releases only
- Entries below: 9 releases (newest first)
- Resolved: 0 is v0.33.0 and 1 is v1.20.0, the newest stable release of each major we track
- Carrying security changes: 8 · CVEs mentioned: 0 · Mentioning breaking changes: 1 · Removing or deprecating something: 2
- Page: https://whatsnew.fyi/product/axios/compare/0...1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (111 changes, grouped by kind)

### Added

#### v1.20.0 (2026-08-24)

- Add RFC 9110 status-code aliases ContentTooLarge (413) and UnprocessableContent (422)

#### v1.19.0 (2026-07-26)

- Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers
- Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing
- Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status code and matching ESM/CJS declarations

#### v1.18.0 (2026-06-13)

- Add transitional.validateStatusUndefinedResolves option so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status

#### v1.17.0 (2026-06-03)

- Add Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding

#### v1.16.0 (2026-05-02)

- Support for the QUERY HTTP method across adapters and type definitions
- ECONNREFUSED error constant exposed on AxiosError for matching connection-refused failures
- Export the internal encode helper from buildURL for userland param serializers

#### v1.15.2 (2026-04-21)

- Add allowedSocketPaths config option to allowlist Unix domain socket paths used by the Node http adapter

#### v1.15.1 (2026-04-19)

- Add initial scaffold for AI-assisted translations of the documentation site
- Add `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests

### Changed

#### v1.18.1 (2026-06-21)

- Documented sensitive headers and status transition behaviour

#### v1.16.1 (2026-05-13)

- Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures
- Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path
- Bumped @commitlint/cli from 20.5.0 to 20.5.2

#### v1.16.0 (2026-05-02)

- Proxy requests now preserve user-supplied Host headers
- Basic auth credentials embedded in URLs are now URL-decoded
- parseProtocol now strictly requires a colon in the protocol separator
- Replaced deprecated unescape() with modern UTF-8 encoding for non-ASCII URL handling

### Fixed

#### v1.20.0 (2026-08-24)

- Prevent unbounded handler-array growth by trimming trailing ejected interceptors
- Keep interceptor operations safe when the public handlers field is nullish
- Prevent custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError
- Make navigation-canceled XHR requests reject with ECONNABORTED instead of resolving with status 0
- Flush successful XHR downloads' final progress callback during the live loadend dispatch
- Remove request-context retention from per-socket error listeners to prevent completed response data from being pinned for the lifetime of pooled keep-alive sockets
- Prevent structural method-header buckets from leaking into outgoing headers
- Standardize invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE
- Correct the timeoutErrorMessage merge strategy

#### v1.19.0 (2026-07-26)

- Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys
- Removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills
- Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching
- Honored * entries within comma- or space-separated bypass lists in NO_PROXY matching
- Propagated already-aborted input signals immediately when composing abort signals
- Preserved empty first values for duplicate singleton headers
- Made AxiosHeaders#getSetCookie() consistently return arrays for present values
- Included normalized, safely redacted offending URLs in malformed-protocol errors
- Removed repeated trailing slashes when combining base URLs
- Clamped malformed negative progress values to zero
- Ensured final Node.js download progress events are delivered before streamed responses close
- Serialized Set values as arrays in JSON-compatible snapshots
- Synthesized useful AxiosError messages from otherwise-empty AggregateError instances
- Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters
- Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully

#### v1.18.1 (2026-06-21)

- Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes
- Guarded socket.setKeepAlive for proxy agent streams in Node HTTP adapter
- Accepted path-only URLs when socketPath is configured in Node HTTP adapter
- Deferred environment proxy handling to Node in HTTP adapter
- Explicitly passed maxBodyLength through to follow-redirects in Node HTTP adapter
- Fixed runtime crashes and type definition mismatches in runtime and type correctness
- Fixed incorrect error handling paths
- Switched AxiosURLSearchParams encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly

#### v1.17.0 (2026-06-03)

- Restore Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and align the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth
- Preserve user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies
- Clear default Content-Type for React Native FormData so multipart boundaries can be generated correctly
- Silently skip empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes
- Preserve enumerable symbol keys when cloning plain request data through axios merge logic
- Convert resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures
- Correct AxiosHeaders.toJSON() return types and update CommonJS isCancel typings to narrow to CanceledError<T>
- Avoid emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset

#### v1.16.1 (2026-05-13)

- Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling
- Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch
- Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid
- Fixed an unexpected token error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users
- Made parseReviver context.source optional in the type definitions to align with the ES2023 specification

#### v1.16.0 (2026-05-02)

- HTTP adapter cleared stale headers when a redirect targets a no-proxy host
- HTTP adapter fixed the redirect listener chain to prevent stacking across hops
- HTTP adapter restored the missing requestDetails argument on beforeRedirect
- HTTP adapter preserved partial response object on AxiosError when a stream is aborted after headers arrive
- HTTP adapter honoured the timeout option during the connect phase when redirects are disabled
- HTTP adapter resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0
- Fetch adapter set the User-Agent header to match the HTTP adapter
- Fetch adapter preserved the original abort reason instead of replacing it with a generic error
- Fetch adapter deferred global access so importing the module no longer throws a TypeError in restricted environments
- XHR adapter unsubscribed cancelToken and AbortSignal listeners on error, timeout, and abort code paths to prevent leaked subscriptions
- Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest

#### v1.15.2 (2026-04-21)

- Install a single per-socket error listener tracking the active request via kAxiosSocketListener and kAxiosCurrentReq, eliminating per-request listener accumulation and linear heap growth under concurrent or long-running keep-alive workloads

#### v1.15.1 (2026-04-19)

- Remove `Content-Type` when no boundary is present on `FormData` fetch requests
- Support multi-select fields in FormData handling
- Cancel `request.body` instead of the source stream on fetch abort
- Fix recursion bug in form-data serialisation
- Handle socket-only request errors without leaking keep-alive listeners in HTTP adapter
- Clamp `loaded` to `total` for computable upload/download progress events
- Align `runWhen` type with the runtime behaviour in `InterceptorManager`
- Make response header keys case-insensitive
- Use strict equality in the `buildFullPath` base/relative URL check
- Improve the regex used for `AxiosURLSearchParams` param serialisation to avoid edge-case mismatches
- Parse out header/config values instead of throwing on malformed input

### Removed

#### v1.16.1 (2026-05-13)

- Reverted support for passing a URL object as config.url due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed

### Deprecated

#### v1.20.0 (2026-08-24)

- Deprecate PayloadTooLarge and UnprocessableEntity status-code aliases in favor of ContentTooLarge and UnprocessableContent

### Security

#### v1.20.0 (2026-08-24)

- Harden behavioral configuration reads against shared and foreign prototype pollution and normalize unsafe interceptor replacement objects
- Clarify Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection

#### v1.19.0 (2026-07-26)

- Raised the form-data dependency floor to ^4.0.6 to prevent fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx

#### v1.18.0 (2026-06-13)

- Add Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects to prevent custom auth headers such as API keys from leaking to another origin
- Reject malformed http: and https: URLs that omit // with ERR_INVALID_URL, and tighten prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching

#### v1.17.0 (2026-06-03)

- Guard socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths
- Switch the publish workflow to npm staged publishing for safer, auditable package releases with provenance

#### v1.16.1 (2026-05-13)

- Hardened formDataToJSON against prototype pollution by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization
- Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations
- Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline

#### v1.16.0 (2026-05-02)

- Fetch adapter now enforces maxBodyLength and maxContentLength limits

#### v1.15.2 (2026-04-21)

- Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests
- Reject non-string socketPath values and add an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch
- Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md and THREATMODEL.md with provenance verification, 60-day resolution policy, and maintainer incident-response runbook

#### v1.15.1 (2026-04-19)

- Tightened validation and sanitisation across request header construction to close the header-injection attack surface
- Correctly strip CR/LF from multipart header values to prevent injection via field names and filenames
- Replace unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects
- Short-circuit `withXSRFToken` on any truthy non-boolean value to prevent silent leakage of XSRF token cross-origin
- Enforce `maxBodyLength` even when `maxRedirects` is set to 0
- Apply `maxContentLength` to streamed responses that previously bypassed the cap
- Complete an earlier incomplete CVE fix to fully close the regression window

## Release notes

### v1.20.0

- Date: 2026-08-24
- Version: v1.20.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.20.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.20.0

- **added** — Add RFC 9110 status-code aliases ContentTooLarge (413) and UnprocessableContent (422)
- **security** — Harden behavioral configuration reads against shared and foreign prototype pollution and normalize unsafe interceptor replacement objects
- **security** — Clarify Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection
- **fixed** — Prevent unbounded handler-array growth by trimming trailing ejected interceptors
- **fixed** — Keep interceptor operations safe when the public handlers field is nullish
- **fixed** — Prevent custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError
- **fixed** — Make navigation-canceled XHR requests reject with ECONNABORTED instead of resolving with status 0
- **fixed** — Flush successful XHR downloads' final progress callback during the live loadend dispatch
- **fixed** — Remove request-context retention from per-socket error listeners to prevent completed response data from being pinned for the lifetime of pooled keep-alive sockets
- **fixed** — Prevent structural method-header buckets from leaking into outgoing headers
- **fixed** — Standardize invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE
- **fixed** — Correct the timeoutErrorMessage merge strategy
- **deprecated** — Deprecate PayloadTooLarge and UnprocessableEntity status-code aliases in favor of ContentTooLarge and UnprocessableContent

##### v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

##### ⚠️ Breaking Changes & Deprecations

- HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

##### 🔒 Security Fixes

- Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

##### 🐛 Bug Fixes

- Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
- Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
- XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
- Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
- Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

##### 🔧 Maintenance & Chores

- Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
- Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
- Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
- CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

- @yens1 (#11109)
- @Sasireddy001 (#11113)
- @ari-token-security (#11094)
- @timothyokooboh (#11097)
- @gi9439041-png (#11119)
- @Hashim1999164 (#11082)
- @v-dev-cl (#11091)
- @r0h1tb (#11118)
- @ostapondo (#11121)

Full Changelog (https://github.com/axios/axios/compare/v1.19.0...v1.20.0)

### v1.19.0

- Date: 2026-07-26
- Version: v1.19.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.19.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.19.0

- **security** — Raised the form-data dependency floor to ^4.0.6 to prevent fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx
- **added** — Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers
- **added** — Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing
- **added** — Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status code and matching ESM/CJS declarations
- **fixed** — Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys
- **fixed** — Removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills
- **fixed** — Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching
- **fixed** — Honored * entries within comma- or space-separated bypass lists in NO_PROXY matching
- **fixed** — Propagated already-aborted input signals immediately when composing abort signals
- **fixed** — Preserved empty first values for duplicate singleton headers
- **fixed** — Made AxiosHeaders#getSetCookie() consistently return arrays for present values
- **fixed** — Included normalized, safely redacted offending URLs in malformed-protocol errors
- **fixed** — Removed repeated trailing slashes when combining base URLs
- **fixed** — Clamped malformed negative progress values to zero
- **fixed** — Ensured final Node.js download progress events are delivered before streamed responses close
- **fixed** — Serialized Set values as arrays in JSON-compatible snapshots
- **fixed** — Synthesized useful AxiosError messages from otherwise-empty AggregateError instances
- **fixed** — Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters
- **fixed** — Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully

##### v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

##### 🔒 Security Fixes

- Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (https://github.com/advisories/GHSA-hmw2-7cc7-3qxx). (#11028)

##### 🚀 New Features

- Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
  adapters, and serializers. (#11043, #11081)
- Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
- HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

##### 🐛 Bug Fixes

- Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
- Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
- Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
- Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
- URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
- Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
- Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
- Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
- Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

##### 🔧 Maintenance & Chores

- Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
- Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
- Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
- Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
- Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
- Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

##### 🌟 New Contributors

We are thrilled to welcome our new contrib

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.19.0]_

### v1.18.1

- Date: 2026-06-21
- Version: v1.18.1
- Original notes: https://github.com/axios/axios/releases/tag/v1.18.1
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.18.1

- **fixed** — Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes
- **fixed** — Guarded socket.setKeepAlive for proxy agent streams in Node HTTP adapter
- **fixed** — Accepted path-only URLs when socketPath is configured in Node HTTP adapter
- **fixed** — Deferred environment proxy handling to Node in HTTP adapter
- **fixed** — Explicitly passed maxBodyLength through to follow-redirects in Node HTTP adapter
- **fixed** — Fixed runtime crashes and type definition mismatches in runtime and type correctness
- **fixed** — Fixed incorrect error handling paths
- **fixed** — Switched AxiosURLSearchParams encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly
- **changed** — Documented sensitive headers and status transition behaviour

##### v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

##### 🐛 Bug Fixes

- AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
- Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
- Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
- AxiosURLSearchParams: Switched the encoder callback to an arrow function so `encoder.call(this)` receives the `AxiosURLSearchParams` instance correctly. (#11019)

##### 🔧 Maintenance & Chores

- Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

- Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

- @webdevelopersrinu (#10913)
- @sijie-Z (#10993)
- @bartlomieju (#11023)
- @JSap0914 (#11019)

[Full Changelog](https://github.com/axios/axios/compare/v1.18.0...v1.18.1)

### v1.18.0

- Date: 2026-06-13
- Version: v1.18.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.18.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.18.0

- **security** — Add Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects to prevent custom auth headers such as API keys from leaking to another origin
- **security** — Reject malformed http: and https: URLs that omit // with ERR_INVALID_URL, and tighten prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching
- **added** — Add transitional.validateStatusUndefinedResolves option so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status

##### v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

##### 🔒 Security Fixes

* **Redirect Header Safety:** Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (__#10892__)

* **URL And Request Hardening:** Rejects malformed `http:` and `https:` URLs that omit `//` with `ERR_INVALID_URL`, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local `NO_PROXY` matching. (__#11000__)

##### 🐛 Bug Fixes

* **Status Validation:** Added `transitional.validateStatusUndefinedResolves` so applications can opt in to treating `validateStatus: undefined` like the option was omitted, while `validateStatus: null` remains the explicit way to accept every status. (__#10899__)

##### 🔧 Maintenance & Chores

* **Documentation:** Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the `proxy` request config as Node.js-only in the advanced docs. (__#10984__, __#10988__, __#10992__, __#10995__)

* **Dependencies:** Bumped `@babel/core`, `@babel/preset-env`, `@commitlint/cli`, `@commitlint/config-conventional`, `@rollup/plugin-babel`, `@rollup/plugin-commonjs`, `@vitest/browser`, `@vitest/browser-playwright`, `eslint`, `lint-staged`, `rollup`, `vitest`, and `actions/checkout`. (__#10989__, __#10996__, __#10997__)

* **Release Metadata:** Prepared the 1.18.0 release by updating package metadata and the runtime `VERSION` value. (__#11003__)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

* __@drori12__ (__#10984__)
* __@eyupcanakman__ (__#10899__)
* __@Adi-Beker__ (__#10995__)

[Full Changelog](https://github.com/axios/axios/compare/v1.17.0...v1.18.0)

### v1.17.0

- Date: 2026-06-03
- Version: v1.17.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.17.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.17.0

- **security** — Guard socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths
- **security** — Switch the publish workflow to npm staged publishing for safer, auditable package releases with provenance
- **added** — Add Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding
- **fixed** — Restore Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and align the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth
- **fixed** — Preserve user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies
- **fixed** — Clear default Content-Type for React Native FormData so multipart boundaries can be generated correctly
- **fixed** — Silently skip empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes
- **fixed** — Preserve enumerable symbol keys when cloning plain request data through axios merge logic
- **fixed** — Convert resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures
- **fixed** — Correct AxiosHeaders.toJSON() return types and update CommonJS isCancel typings to narrow to CanceledError<T>
- **fixed** — Avoid emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset

##### v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

##### 🔒 Security Fixes

* **Config Hardening:** Guarded `socketPath`, `params`, and `paramsSerializer` reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (__#10901__, __#10922__)
* **Release Publishing:** Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (__#10926__)

##### 🚀 New Features

* **HTTP Compression:** Added Node HTTP adapter support for zstd response decompression, with `transitional.advertiseZstdAcceptEncoding` controlling whether `zstd` is advertised in `Accept-Encoding`. (__#6792__, __#10920__)

##### 🐛 Bug Fixes

* **Authentication Handling:** Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (__#10929__, __#10896__)
* **Proxy TLS:** Preserved user `httpsAgent` TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (__#10957__)
* **React Native FormData:** Cleared default `Content-Type` for React Native `FormData` so multipart boundaries can be generated correctly. (__#10898__)
* **Headers:** Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (__#10875__)
* **Request Data Merging:** Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (__#10812__)
* **Bundler Compatibility:** Converted `resolveConfig` from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (__#10891__)
* **Types:** Corrected `AxiosHeaders.toJSON()` return types and updated CommonJS `isCancel` typings to narrow to `CanceledError<T>`. (__#10956__, __#10952__)
* **Build Tooling:** Avoided emitting a null `Authorization` header from the GitHub build helper when `GITHUB_TOKEN` is unset. (__#10931__)

##### 🔧 Maintenance & Chores

* **HTTP/2 Internals:** Extracted `Http2Sessions` into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (__#10861__)
* **Package Publishing:** Reduced published package size by switching to a `files` allowlist and dropping unneeded unminified bundle source maps. (__#10939__)
* **CI and Release Automation:** Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (__#10907__, __#10911__, __#10916__, __#10927__, __#10935__, __#10983__)
* **Developer Workflow:** Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (__#10925__, __#10914__, __#10958__)
* **Documentation and Policy:** Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (__#10890__, __#10889__, __#10921__, __#10945__, __#10905__, __#10933__, __#10915__, __#10887__, __#10955__)
* **Dependencies:** Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, `fs-extra`, `qs`, docs dependencies, and GitHub Actions dependencies including `actions/dependency-review-action` and `zizmorcore/zizmor-action`. (__#10871__, __#10879__, __#10918__, __#10919__, __#10934__, __#10947__, __#10954__, __#10960__)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

* __@BasixKOR__ (__#6792__)
* __@carladams1299-lab__ (__#10861__)
* __@LaplaceYoung__ (__#10812__)
* __@JamieMagee__ (__#10939__)
* __@RonGamzu__ (__#10905__)
* __@sapirbaruch__ (_

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.17.0]_

### v1.16.1

- Date: 2026-05-13
- Version: v1.16.1
- Original notes: https://github.com/axios/axios/releases/tag/v1.16.1
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.16.1

- **security** — Hardened formDataToJSON against prototype pollution by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization
- **security** — Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations
- **security** — Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline
- **fixed** — Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling
- **fixed** — Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch
- **fixed** — Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid
- **fixed** — Fixed an unexpected token error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users
- **fixed** — Made parseReviver context.source optional in the type definitions to align with the ES2023 specification
- **removed** — Reverted support for passing a URL object as config.url due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed
- **changed** — Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures
- **changed** — Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path
- **changed** — Bumped @commitlint/cli from 20.5.0 to 20.5.2

##### v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in `formDataToJSON`, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

##### 🔒 Security Fixes

* **Prototype Pollution Defence-in-Depth:** Hardened `formDataToJSON` against already-polluted `Object.prototype` by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (__#7413__)
* **Proxy Cleartext Leak:** Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (__#10858__)
* **CI Cache Removal:** Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (__#10882__)

##### 🐛 Bug Fixes

* **Data URI Parsing:** Updated the `fromDataURI` regex to match RFC 2397 more strictly, fixing edge cases in `data:` URL handling. (__#10829__)
* **Unicode Headers:** Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (__#10850__)
* **XHR Upload Progress:** Guarded against malformed `ProgressEvent` payloads emitted by some environments during XHR upload, preventing crashes when `loaded` / `total` are missing or invalid. (__#10868__)
* **Webpack 4 Fetch Adapter:** Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (__#10864__)
* **Type Definitions:** Made `parseReviver` `context.source` optional in the type definitions to align with the ES2023 specification. (__#10837__)
* **URL Object Support Reverted:** Reverted the change that allowed passing a `URL` object as `config.url` (originally __#10866__) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (__#10874__)

##### 🔧 Maintenance & Chores

* **Cycle Detection Refactor:** Replaced the array-based cycle tracker in `toJSONObject` with a `WeakSet`, improving performance and memory behaviour on large nested structures. (__#10832__)
* **composeSignals Cleanup:** Refactored `composeSignals` to use a clearer early-return structure, simplifying the cancellation/abort composition path. (__#10844__)
* **AI Readiness & Repo Docs:** Added `AGENTS.md` and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (__#10835__, __#10841__)
* **Docs Improvements:** Clarified the GET request example, fixed the interceptor `eject` example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (__#10836__, __#10853__, __#10856__)
* **Sponsorship Tooling:** Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (__#10843__, __#10859__, __#10869__)
* **Dependencies:** Bumped `@commitlint/cli` from 20.5.0 to 20.5.2. (__#10846__)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

* __@hpinmetaverse__ (__#10836__)
* __@tommyhgunz14__ (__#7413__)
* __@abhu85__ (__#10829__)
* __@divyanshuraj1095__ (__#10853__)
* __@sagodi97__ (__#10856__)
* __@rkdfx__ (__#10868__)
* __@Liuwei1125__ (__#10866__)

[Full Changelog](https://github.com/axios/axios/compare/v1.16.0...v1.16.1)

### v1.16.0

- Date: 2026-05-02
- Version: v1.16.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.16.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.16.0

- **added** — Support for the QUERY HTTP method across adapters and type definitions
- **added** — ECONNREFUSED error constant exposed on AxiosError for matching connection-refused failures
- **added** — Export the internal encode helper from buildURL for userland param serializers
- **security** — Fetch adapter now enforces maxBodyLength and maxContentLength limits
- **changed** — Proxy requests now preserve user-supplied Host headers
- **changed** — Basic auth credentials embedded in URLs are now URL-decoded
- **changed** — parseProtocol now strictly requires a colon in the protocol separator
- **changed** — Replaced deprecated unescape() with modern UTF-8 encoding for non-ASCII URL handling
- **fixed** — HTTP adapter cleared stale headers when a redirect targets a no-proxy host
- **fixed** — HTTP adapter fixed the redirect listener chain to prevent stacking across hops
- **fixed** — HTTP adapter restored the missing requestDetails argument on beforeRedirect
- **fixed** — HTTP adapter preserved partial response object on AxiosError when a stream is aborted after headers arrive
- **fixed** — HTTP adapter honoured the timeout option during the connect phase when redirects are disabled
- **fixed** — HTTP adapter resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0
- **fixed** — Fetch adapter set the User-Agent header to match the HTTP adapter
- **fixed** — Fetch adapter preserved the original abort reason instead of replacing it with a generic error
- **fixed** — Fetch adapter deferred global access so importing the module no longer throws a TypeError in restricted environments
- **fixed** — XHR adapter unsubscribed cancelToken and AbortSignal listeners on error, timeout, and abort code paths to prevent leaked subscriptions
- **fixed** — Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest

##### v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new `ECONNREFUSED` error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

##### ⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

- **Fetch adapter now enforces `maxBodyLength` and `maxContentLength`.** These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (**#10795**)
- **Proxy requests now preserve user-supplied `Host` headers.** Previously, the proxy path could overwrite a custom `Host`. Virtual-host-style routing through a proxy will now behave correctly. (**#10822**)
- **Basic auth credentials embedded in URLs are now URL-decoded.** If you have percent-encoded credentials in a URL (e.g. `https://user:p%40ss@host`), the decoded value is what now goes on the wire. (**#10825**)
- **`parseProtocol` now strictly requires a colon in the protocol separator.** Strings that loosely parsed as protocols before may no longer match. (**#10729**)
- **Deprecated `unescape()` replaced with modern UTF-8 encoding.** Non-ASCII URL handling is now spec-correct; consumers depending on legacy `unescape()` quirks may see different output bytes. (**#7378**)
- **`transformRequest` input typing change was reverted.** The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (**#10745**, **#10810**)

##### 🚀 New Features

- **QUERY HTTP Method:** Added support for the QUERY HTTP method across adapters and type definitions. (**#10802**)
- **ECONNREFUSED Error Constant:** Exposed `ECONNREFUSED` as a constant on `AxiosError` so callers can match connection-refused failures without comparing string literals (closes #6485). (**#10680**)
- **Encode Helper Export:** Exported the internal `encode` helper from `buildURL` so userland param serializers can reuse the same encoding logic that axios uses internally. (**#6897**)

##### 🐛 Bug Fixes

- **HTTP Adapter — Redirects & Headers:** Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing `requestDetails` argument on `beforeRedirect`, preserved user-supplied `Host` headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (**#10794**, **#10800**, **#6241**, **#10822**, **#10825**)
- **HTTP Adapter — Streams & Timeouts:** Preserved the partial response object on `AxiosError` when a stream is aborted after headers arrive, honoured the `timeout` option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and `maxRedirects: 0`. (**#10708**, **#10819**, **#7149**)
- **Fetch Adapter:** Enforced `maxBodyLength` / `maxContentLength` in the fetch adapter, set the `User-Agent` header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a `TypeError` in restricted environments. (**#10795**, **#10772**, **#10806**, **#7260**)
- **XHR Adapter:** Unsubscribed the `cancelToken` and `AbortSignal` listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (**#10787**)
- **Error Handling:** Attached the parsed response to `AxiosError` when `JSON.parse` fails inside `dispatchRequest`, prevented `settle` from emitting `undefined` error codes, and tightened the `parseProtocol` regex to require a colon in the protocol separator. (**#10724**, **#7276**, **#10729**)
- **Types & Exports:** Aligned the CommonJS `CancelToken` typings with the ESM build

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.16.0]_

### v1.15.2

- Date: 2026-04-21
- Version: v1.15.2
- Original notes: https://github.com/axios/axios/releases/tag/v1.15.2
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.15.2

- **security** — Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests
- **security** — Reject non-string socketPath values and add an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch
- **security** — Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md and THREATMODEL.md with provenance verification, 60-day resolution policy, and maintainer incident-response runbook
- **added** — Add allowedSocketPaths config option to allowlist Unix domain socket paths used by the Node http adapter
- **fixed** — Install a single per-socket error listener tracking the active request via kAxiosSocketListener and kAxiosCurrentReq, eliminating per-request listener accumulation and linear heap growth under concurrent or long-running keep-alive workloads

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in `allowedSocketPaths` allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

##### 🔒 Security Fixes

- **Prototype Pollution Hardening (HTTP Adapter):** Hardened the Node HTTP adapter and `resolveConfig`/`mergeConfig`/validator paths to read only own properties and use null-prototype config objects, preventing polluted `auth`, `baseURL`, `socketPath`, `beforeRedirect`, and `insecureHTTPParser` from influencing requests. (**#10779**)
- **SSRF via `socketPath`:** Rejects non-string `socketPath` values and adds an opt-in `allowedSocketPaths` config option to restrict permitted Unix domain socket paths, returning `AxiosError` `ERR_BAD_OPTION_VALUE` on mismatch. (**#10777**)
- **Supply-chain Hardening:** Added `.npmrc` with `ignore-scripts=true`, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded `SECURITY.md`/`THREATMODEL.md` with provenance verification (`npm audit signatures`), 60-day resolution policy, and maintainer incident-response runbook. (**#10776**)

##### 🚀 New Features

- **`allowedSocketPaths` Config Option:** New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (**#10777**)

##### 🐛 Bug Fixes

- **Keep-alive Socket Memory Leak:** Installs a single per-socket `error` listener tracking the active request via `kAxiosSocketListener`/`kAxiosCurrentReq`, eliminating per-request listener accumulation, `MaxListenersExceededWarning`, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (**#10788**)

##### 🔧 Maintenance & Chores

- **Changelog:** Updated `CHANGELOG.md` with v1.15.1 release notes. (**#10781**)

[Full Changelog](https://github.com/axios/axios/compare/v1.15.1...v1.15.2)

### v1.15.1

- Date: 2026-04-19
- Version: v1.15.1
- Original notes: https://github.com/axios/axios/releases/tag/v1.15.1
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.15.1

- **security** — Tightened validation and sanitisation across request header construction to close the header-injection attack surface
- **security** — Correctly strip CR/LF from multipart header values to prevent injection via field names and filenames
- **security** — Replace unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects
- **security** — Short-circuit `withXSRFToken` on any truthy non-boolean value to prevent silent leakage of XSRF token cross-origin
- **security** — Enforce `maxBodyLength` even when `maxRedirects` is set to 0
- **security** — Apply `maxContentLength` to streamed responses that previously bypassed the cap
- **security** — Complete an earlier incomplete CVE fix to fully close the regression window
- **added** — Add initial scaffold for AI-assisted translations of the documentation site
- **added** — Add `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests
- **fixed** — Remove `Content-Type` when no boundary is present on `FormData` fetch requests
- **fixed** — Support multi-select fields in FormData handling
- **fixed** — Cancel `request.body` instead of the source stream on fetch abort
- **fixed** — Fix recursion bug in form-data serialisation
- **fixed** — Handle socket-only request errors without leaking keep-alive listeners in HTTP adapter
- **fixed** — Clamp `loaded` to `total` for computable upload/download progress events
- **fixed** — Align `runWhen` type with the runtime behaviour in `InterceptorManager`
- **fixed** — Make response header keys case-insensitive
- **fixed** — Use strict equality in the `buildFullPath` base/relative URL check
- **fixed** — Improve the regex used for `AxiosURLSearchParams` param serialisation to avoid edge-case mismatches
- **fixed** — Parse out header/config values instead of throwing on malformed input

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

##### 🔒 Security Fixes

* **Header Injection Hardening:** Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (__#10749__)
* **CRLF Stripping in Multipart Headers:** Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (__#10758__)
* **Prototype Pollution / Auth Bypass:** Replaced unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (__#10761__, __#10760__)
* **`withXSRFToken` Truthy Bypass:** Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (__#10762__)
* **`maxBodyLength` With Zero Redirects:** Enforces `maxBodyLength` even when `maxRedirects` is set to `0`, closing a bypass path for oversized request bodies. (__#10753__)
* **Streamed Response `maxContentLength` Bypass:** Applies `maxContentLength` to streamed responses that previously bypassed the cap. (__#10754__)
* **Follow-up CVE Completion:** Completes an earlier incomplete CVE fix to fully close the regression window. (__#10755__)

##### 🚀 New Features

* **AI-Based Docs Translations:** Initial scaffold for AI-assisted translations of the documentation site. (__#10705__)
* **`Location` Request Header Type:** Adds `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests. (__#7528__)

##### 🐛 Bug Fixes

* **FormData Handling:** Removes `Content-Type` when no boundary is present on `FormData` fetch requests, supports multi-select fields, cancels `request.body` instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (__#7314__, __#10676__, __#10702__, __#10726__)
* **HTTP Adapter:** Handles socket-only request errors without leaking keep-alive listeners. (__#10576__)
* **Progress Events:** Clamps `loaded` to `total` for computable upload/download progress events. (__#7458__)
* **Types:** Aligns `runWhen` type with the runtime behaviour in `InterceptorManager` and makes response header keys case-insensitive. (__#7529__, __#10677__)
* **`buildFullPath`:** Uses strict equality in the base/relative URL check. (__#7252__)
* **`AxiosURLSearchParams` Regex:** Improves the regex used for param serialisation to avoid edge-case mismatches. (__#10736__)
* **Resilient Value Parsing:** Parses out header/config values instead of throwing on malformed input. (__#10687__)
* **Docs Artefact Cleanup:** Removes the docs content that was incorrectly committed. (__#10727__)

##### 🔧 Maintenance & Chores

* **Threat Model & Security Docs:** Ongoing refinement of `THREATMODEL.md`, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (__#10672__, __#10715__, __#10718__, __#10722__, __#10763__, __#10765__)
* **Test Coverage & Migration:** Expanded `shouldBypassProxy` coverage for wildcard/IPv6/edge cases, documented and tested `AxiosError.status`, and migrated `progressEventReducer` tests to Vitest. (__#10723__, __#10725__, __#10741__)
* **Type Refactor:** Uses TypeScript utility types to deduplicate literal unions. (__#7520__)
* **Repo & CI:** Adds `CODEOWNERS`, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (__#10739__, __#10738__, __#10746__)
* **Changelog Backfill:** Added missing version entries to the changelog. (__#10704__)
* **Dependencies:** Bumped `follow-redirects` (`1.15.11` → `1.16.0`) in root and docs, `axios` (`1.14.0` → `1.15.0`) in docs, and a group of 5 development dependencies. (__#10717__, __#10716__, _

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.15.1]_