# Axios v1.17.0

- Product: Axios (https://whatsnew.fyi/product/axios)
- Vendor: Axios
- Date: 2026-06-03
- Version: v1.17.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.17.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.17.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Guard socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths
- **security** — Switch the publish workflow to npm staged publishing for safer, auditable package releases with provenance
- **added** — Add Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding
- **fixed** — Restore Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and align the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth
- **fixed** — Preserve user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies
- **fixed** — Clear default Content-Type for React Native FormData so multipart boundaries can be generated correctly
- **fixed** — Silently skip empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes
- **fixed** — Preserve enumerable symbol keys when cloning plain request data through axios merge logic
- **fixed** — Convert resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures
- **fixed** — Correct AxiosHeaders.toJSON() return types and update CommonJS isCancel typings to narrow to CanceledError<T>
- **fixed** — Avoid emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset

##### v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

##### 🔒 Security Fixes

* **Config Hardening:** Guarded `socketPath`, `params`, and `paramsSerializer` reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (__#10901__, __#10922__)
* **Release Publishing:** Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (__#10926__)

##### 🚀 New Features

* **HTTP Compression:** Added Node HTTP adapter support for zstd response decompression, with `transitional.advertiseZstdAcceptEncoding` controlling whether `zstd` is advertised in `Accept-Encoding`. (__#6792__, __#10920__)

##### 🐛 Bug Fixes

* **Authentication Handling:** Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (__#10929__, __#10896__)
* **Proxy TLS:** Preserved user `httpsAgent` TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (__#10957__)
* **React Native FormData:** Cleared default `Content-Type` for React Native `FormData` so multipart boundaries can be generated correctly. (__#10898__)
* **Headers:** Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (__#10875__)
* **Request Data Merging:** Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (__#10812__)
* **Bundler Compatibility:** Converted `resolveConfig` from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (__#10891__)
* **Types:** Corrected `AxiosHeaders.toJSON()` return types and updated CommonJS `isCancel` typings to narrow to `CanceledError<T>`. (__#10956__, __#10952__)
* **Build Tooling:** Avoided emitting a null `Authorization` header from the GitHub build helper when `GITHUB_TOKEN` is unset. (__#10931__)

##### 🔧 Maintenance & Chores

* **HTTP/2 Internals:** Extracted `Http2Sessions` into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (__#10861__)
* **Package Publishing:** Reduced published package size by switching to a `files` allowlist and dropping unneeded unminified bundle source maps. (__#10939__)
* **CI and Release Automation:** Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (__#10907__, __#10911__, __#10916__, __#10927__, __#10935__, __#10983__)
* **Developer Workflow:** Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (__#10925__, __#10914__, __#10958__)
* **Documentation and Policy:** Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (__#10890__, __#10889__, __#10921__, __#10945__, __#10905__, __#10933__, __#10915__, __#10887__, __#10955__)
* **Dependencies:** Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, `fs-extra`, `qs`, docs dependencies, and GitHub Actions dependencies including `actions/dependency-review-action` and `zizmorcore/zizmor-action`. (__#10871__, __#10879__, __#10918__, __#10919__, __#10934__, __#10947__, __#10954__, __#10960__)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

* __@BasixKOR__ (__#6792__)
* __@carladams1299-lab__ (__#10861__)
* __@LaplaceYoung__ (__#10812__)
* __@JamieMagee__ (__#10939__)
* __@RonGamzu__ (__#10905__)
* __@sapirbaruch__ (_

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.17.0]_