chore(deps): bump axios from 1.16.1 to 1.18.1 - #6072
Conversation
Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.18.1. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.1...v1.18.1) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-08-01 01:39 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6072 — axios 1.16.1 → 1.18.1 (manifest ^1.15.2 → ^1.18.1). Minor bump of a production frontend dependency. CI passing (frontend tests, browser smoke test, frontend build, lint; Python jobs correctly skipped by path filter).
Breaking changes: none. Deprecations: none. New peer dependencies: none — axios' own dep set is unchanged.
Security fixes (v1.17.0 / v1.18.0):
- Own-property guards on
socketPath,params,paramsSerializeragainst prototype-pollution/SSRF gadgets (#10901, #10922) - Node adapter strips caller-specified sensitive headers on cross-origin redirects (#10892)
- Rejects
http:/https:URLs missing//withERR_INVALID_URL; tighter stream size limits, FormData depth, data-URL sizing,NO_PROXYmatching (#11000)
Behavioral changes worth knowing:
- v1.18.0 adds
transitional.validateStatusUndefinedResolves, defaulting totrue(legacy behaviour);mergeConfig.jsonly diverges when it is explicitlyfalse. Moot here —validateStatusappears nowhere in the repo. - Stricter
buildFullPathURL validation. No impact: all request URLs come fromwindow.Urls.*and are root-relative. - v1.18.1 makes
AxiosError#causenon-enumerable (#10913), which helpsshared/client.js:95— itJSON.stringifys an own-property walk over the error for the Sentry attachment, and an enumerablecausecarrying sockets/agents can throw on circular structures.
Compatibility: axios is imported in exactly two places (shared/client.js:2, shared/vuex/connectionPlugin/connectionModule.js:1), both browser-only, so only the XHR adapter is in play. Diffing the published tarballs' lib/ between the two versions, the browser-reachable changes are all fixes/hardening (cookie decode try/catch, { once: true } abort listener, a missing done() on an xhr error path, AxiosURLSearchParams encoder this binding — the last bypassed anyway since client.js supplies paramsSerializer.serialize). No code changes required.
Lockfile notes (nitpick, no action): form-data 4.0.5 → 4.0.6 and the dropped follow-redirects 1.15.11 are axios-tree churn. react-is 19.2.7 → 19.2.8 is unrelated drift — it resolves under pretty-format's jest alias, so dev-only and harmless. Separately, latest on npm is already 1.19.0; .github/dependabot.yml's 7-day cooldown explains why this targets 1.18.1, and the next run will pick it up.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
1 participant
Bumps axios from 1.16.1 to 1.18.1.
Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
a209bfbchore(release): prepare release 1.18.1 (#11027)fa6a55echore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)40e7be8docs: clarifies that request data is request-specific in axios (#11025)a446b39fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...cf1306adocs: add Deno to install instructions (#11023)b32880afix: incorrect use of error (#11021)1792edafix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)30499d6fix: various runtime crashes and type definition mismatches (#10959)20ce9c4fix(http): defer env proxy handling to Node (#10942)e64bcf9chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)