dependabot[bot]
46138a086c
chore(deps): bump axios from 1.14.0 to 1.15.0 in /docs
...
Bumps [axios](https://github.com/axios/axios ) from 1.14.0 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.14.0...v1.15.0 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.15.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-10 05:30:02 +00:00
Jay
c7a76ddbf2
fix(types): make response headers case insensative ( #10677 )
2026-04-09 18:49:52 +02:00
Eve
914bc2605a
fix(progress): clamp loaded to total for computable upload/download events ( #7458 )
...
* fix(progress): clamp loaded value to total in progress reducer
* test(progress): cover out-of-order events in reducer clamp case
* fix(progress): keep bytesNotified monotonic for out-of-order events
---------
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-09 17:40:50 +02:00
Jay
0912bde937
fix: support multiselect in form data ( #10676 )
2026-04-09 17:31:39 +02:00
Raashish Aggarwal
8b68491d04
fix(http): handle socket-only request errors without leaking keep-alive listeners ( #10576 )
...
* fix(http): handle request socket-only errors
* test(http): cover socket-only error handling cleanup
---------
Co-authored-by: Jason Saayman <jasonsaayman@gmail.com>
2026-04-08 22:03:30 +02:00
Darwin ❤️❤️❤️
62f6281660
fix(fetch): remove Content-Type without boundary for FormData ( #7314 )
...
* fix(fetch): remove Content-Type without boundary for FormData
When using the fetch adapter with FormData and manually setting
Content-Type to 'multipart/form-data' (without boundary), the
request would fail because the boundary is required.
This fix detects when Content-Type is set to multipart/form-data
without a boundary and removes it, allowing fetch to automatically
set the correct Content-Type header with the proper boundary.
Fixes #7054
* chore: update fixes
---------
Co-authored-by: Jason Saayman <jasonsaayman@gmail.com>
2026-04-08 21:07:51 +02:00
Ilya
c44f4d728b
refactor(types): use TypeScript utils to transform duplicated literals ( #7520 )
...
* refactor(types): use TypeScript utils to transform Method literals
* refactor(types): use TypeScript utils to transform responseEncoding literals
* refactor: revert added export for responseEncoding
---------
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-08 19:42:34 +02:00
Jay
34d137cbae
docs: update hopper secuirty ( #10672 )
2026-04-08 10:14:57 +02:00
techcodie
9f992a8eb9
fix(types): align runWhen type with runtime behavior in InterceptorManager ( #7529 )
...
The `runWhen` property in `AxiosInterceptorOptions` and
`AxiosInterceptorHandler` had type inconsistencies that caused
TypeScript build failures when upgrading from axios 1.13.2 to 1.13.5+.
Issues fixed:
1. `AxiosInterceptorOptions.runWhen` did not allow `null`, but
`InterceptorManager.use()` explicitly sets it to `null` when no
options are provided (`runWhen: options ? options.runWhen : null`).
2. `AxiosInterceptorHandler.runWhen` used `AxiosRequestConfig` instead
of `InternalAxiosRequestConfig`, creating a type mismatch with
`AxiosInterceptorOptions` which uses `InternalAxiosRequestConfig`.
3. In `index.d.ts`, the `AxiosInterceptorHandler.runWhen` type was
`(config: AxiosRequestConfig) => boolean | null` — the `| null`
was incorrectly placed as part of the return type rather than making
the entire function type nullable.
4. `AxiosInterceptorHandler.runWhen` is now optional (`?`) to also
allow `undefined`, matching the runtime case where options are
passed without a `runWhen` property (i.e. `options.runWhen` is
`undefined`).
Fixes #7404
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 20:58:30 +02:00
Gabriel Quaresma
9df2cd3df7
chore: add Location to CommonRequestHeadersList types ( #7528 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 19:55:58 +02:00
Nitya Jain
f53ebf2198
fix(core): use strict equality in buildFullPath check ( #7252 )
...
Replace loose equality (==) with strict equality (===)
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 19:48:21 +02:00
github-actions[bot]
772a4e54ec
chore(release): prepare release 1.15.0 ( #10671 )
...
* 1.15.0
* chore(release): prepare release 1.15.0
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: jasonsaayman <4814473+jasonsaayman@users.noreply.github.com>
2026-04-07 18:03:51 +02:00
dependabot[bot]
4b071371be
chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm ( #10663 )
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) from 8.0.0 to 8.0.5.
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite )
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 17:11:41 +02:00
dependabot[bot]
51e57b39db
chore(deps-dev): bump vite from 8.0.2 to 8.0.5 ( #10664 )
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) from 8.0.2 to 8.0.5.
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite )
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 16:50:20 +02:00
dependabot[bot]
fba1a77930
chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm ( #10665 )
...
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) from 8.0.2 to 8.0.5.
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite )
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 16:34:00 +02:00
dependabot[bot]
0bf6e28eac
chore(deps): bump denoland/setup-deno in the github-actions group ( #10669 )
...
Bumps the github-actions group with 1 update: [denoland/setup-deno](https://github.com/denoland/setup-deno ).
Updates `denoland/setup-deno` from 2.0.3 to 2.0.4
- [Release notes](https://github.com/denoland/setup-deno/releases )
- [Commits](e95548e56d...667a34cdef
2026-04-07 15:40:09 +02:00
dependabot[bot]
8107157c57
chore(deps-dev): bump the development_dependencies group with 4 updates ( #10670 )
...
Bumps the development_dependencies group with 4 updates: [@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser ), [@vitest/browser-playwright](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright ), [rollup](https://github.com/rollup/rollup ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `@vitest/browser` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/browser )
Updates `@vitest/browser-playwright` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/browser-playwright )
Updates `rollup` from 4.60.0 to 4.60.1
- [Release notes](https://github.com/rollup/rollup/releases )
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rollup/rollup/compare/v4.60.0...v4.60.1 )
Updates `vitest` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest )
---
updated-dependencies:
- dependency-name: "@vitest/browser"
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: development_dependencies
- dependency-name: "@vitest/browser-playwright"
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: development_dependencies
- dependency-name: rollup
dependency-version: 4.60.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: development_dependencies
- dependency-name: vitest
dependency-version: 4.1.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: development_dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 15:31:33 +02:00
Shaan Majid
e66530e330
ci: require npm-publish environment for releases ( #10666 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-07 13:17:32 +02:00
github-actions[bot]
49f23cbfe4
chore(sponsor): update sponsor block ( #10668 )
...
Co-authored-by: jasonsaayman <4814473+jasonsaayman@users.noreply.github.com>
2026-04-07 08:25:39 +02:00
Jay
363185461b
fix: unrestricted cloud metadata exfiltration via header injection chain ( #10660 )
...
* fix: unrestricted cloud metadata exfiltration via header injection chain
* fix: address pattern issue highlighted by cubic
* fix: code ql feedback
* fix: code ql feedback
2026-04-06 14:01:54 +02:00
Jay
fb3befb6da
fix: no_proxy hostname normalization bypass leads to ssrf ( #10661 )
2026-04-06 13:47:03 +02:00
Jay
8023035109
docs: fix for platinum sponsors ( #10659 )
2026-04-06 12:46:43 +02:00
ashstrc
36bebd1c88
docs: clarify HTTP/2 support and unsupported httpVersion option ( #10644 )
...
* docs: improve beforeRedirect example with HTTPS check and security note
* resolve merge conflict using upstream version
* docs: clarify HTTP/2 support and unsupported httpVersion option
* docs: fix conflicting HTTP/2 documentation
* docs: remove httpVersion and http2Options from example
* docs: clarify HTTP/2 support limitations and environment dependencies
* docs: clarify HTTP/2 support and remove conflicting guidance
* docs: clarify HTTP/2 support and remove conflicting guidance
* docs: clarify HTTP/2 support based on adapter and environment
* docs: clarify HTTP/2 support and remove incorrect statement
---------
Co-authored-by: ashstrc <ashmitkstrc2004@gmail.com>
2026-04-06 12:27:46 +02:00
Jay
e52994ff40
docs: add docs for header case presevation ( #10654 )
...
* docs: update readme with documented work around
* docs: update docs site with documented work around
2026-04-05 21:00:34 +02:00
nthbotast
173efa3b8d
docs: clarify async/await timeout error handling ( #7471 )
...
Co-authored-by: Nathanael BOT <nathanaelbot@minidenathanael.home>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-05 20:48:54 +02:00
theamodhshetty
923ae8f9c5
docs(readme): clarify withCredentials and withXSRFToken behavior ( #7452 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-05 20:37:47 +02:00
Jay
71f14b7fdc
docs: bun deno changes ( #10653 )
...
* docs: update deno and bun support
* docs: improve responsiveness
* docs: improve deno to better match conventions
2026-04-05 17:55:45 +02:00
Jay
2f52f6b13b
feat: add checks to support deno and bun ( #10652 )
...
* feat: added smoke tests for deno
* feat: added bun smoke tests
* chore: added workflows for deno and bun
* chore: swap workflow implementation
* chore: apply ai suggestion
* chore: test alt install of bun deps
* chore: deno install
* chore: map bun file install
* chore: try a different approach for bun
* chore: unpack and then install for bun
* chore: remove un-needed step
* chore: try with tgx again for bun
* chore: alternative zip approach
* ci: full ci added back
2026-04-05 14:37:16 +02:00
Jay
23fcd5f278
chore: fix docs deploy ( #10650 )
2026-04-04 20:37:42 +02:00
Jay
054c1f30fd
feat: unify docs to main repo ( #10649 )
...
* ci: set hardened --ignore-scripts for all ci actions
* docs: adds new docs platform
* chore: remove un-needed ignore
* chore: add sponsors data. adjust package.json to be of type module
* fix: inconsistency between the docs and readme
* fix: docs inconsistency
* docs: update language and phrasing
* style: fix issues with card styling
* docs: update security.md with latest changes
* docs: remove un-needed code
* docs: fix inconsistencies with actual library function
* ci: added deployment for docs
* chore: added axios as dep for docs
* docs: fix batch of errors
* fix: bump esbuild as the version included is a risk
2026-04-04 20:25:41 +02:00
Abhijeet Abhi
395a1604be
docs: fix various typos in comments and documentation ( #10589 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-03 13:29:34 +02:00
ashstrc
64d02a195a
docs: improve beforeRedirect example to prevent credential leakage ( #10624 )
...
* docs: fix formatting and clarify beforeRedirect security note
* docs: fix code block formatting for beforeRedirect example
* docs: fix code block formatting for beforeRedirect example
* docs: fix code block formatting for beforeRedirect example
* docs: fix code block formatting for beforeRedirect example
---------
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-03 13:21:42 +02:00
Shaan Majid
3ca13062ee
ci: narrow workflow permissions to least privilege ( #10637 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-03 13:13:11 +02:00
Shaan Majid
e4bd759def
ci: prevent sponsor block workflow from running on forks ( #10641 )
2026-04-03 13:07:33 +02:00
github-actions[bot]
26f8e5796a
chore(sponsor): update sponsor block ( #10640 )
...
Co-authored-by: jasonsaayman <4814473+jasonsaayman@users.noreply.github.com>
2026-04-03 05:55:34 +03:00
Kai Lee
947f7091d8
Fixes #10610 Deprecation Warning : url.parse() is deprecated in Node.… ( #10625 )
...
* Fixes #10610 Deprecation Warning : url.parse() is deprecated in Node.js v22 (via follow-redirects)
* Fixes #10610 Deprecation Warning : fixed again
* Apply suggestion from @cubic-dev-ai[bot]
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: tona jose <tona00jose@gmail.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2026-04-02 09:02:58 +02:00
Shaan Majid
a04dd96dbb
fix(ci): add zizmor scanner and fix workflow security findings ( #10618 )
...
* ci: add zizmor GitHub Actions security scanner
* fix(ci): prevent script injection via env vars
* fix(ci): set persist-credentials: false across workflows
2026-04-02 08:42:08 +02:00
Jay
e9a1db9d9b
ci: pin versions of actions and review to be certain these are correct ( #10627 )
2026-04-01 20:08:07 +02:00
Shaan Majid
ebf3036932
fix(ci): use OIDC for npm publish instead of token auth ( #10619 )
...
* fix(ci): use OIDC for npm publish instead of token auth
* Change permissions from write to read for contents
---------
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-01 15:50:33 +02:00
Shaan Majid
a5881813d3
chore(deps): add 7-day cooldown period to dependabot ( #10616 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-04-01 13:50:19 +02:00
Shaan Majid
a40f8d3398
revert: "chore(ci): add deprecate action; ( #10591 )" ( #10617 )
...
This reverts commit e2bed7f84d
2026-04-01 12:54:13 +02:00
Dmitriy Mozgovoy
e2bed7f84d
chore(ci): add deprecate action; ( #10591 )
2026-03-31 04:42:15 +03:00
Jay
a7f41f5bb5
chore: remove all old and un-needed files ( #10584 )
...
* chore: remove all old and un-needed files
* chore: fix missing file
* chore: fix ref error
* chore: add back missing file
* chore: incorrect folder location
* chore: ignore ts issues
2026-03-30 20:15:15 +02:00
Jay
2d14d8a300
feat: update sponsors script and how this works for more consistency ( #10583 )
2026-03-30 16:56:40 +02:00
Jay
4950ff6017
feat: update sponsors script and how this works for more consistency ( #10582 )
2026-03-30 12:52:55 +02:00
Raashish Aggarwal
7173706380
test: add coverage for content-type header casing ( #10573 )
...
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-03-29 19:23:38 +02:00
dependabot[bot]
3ec6858bd4
chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 in /tests/module/cjs ( #10564 )
...
Bumps [picomatch](https://github.com/micromatch/picomatch ) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases )
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md )
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2 )
---
updated-dependencies:
- dependency-name: picomatch
dependency-version: 2.3.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-03-29 15:31:13 +02:00
dependabot[bot]
391ed22d01
chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 in /tests/smoke/cjs ( #10565 )
...
Bumps [picomatch](https://github.com/micromatch/picomatch ) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases )
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md )
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2 )
---
updated-dependencies:
- dependency-name: picomatch
dependency-version: 2.3.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-03-29 12:19:37 +02:00
dependabot[bot]
53fa6fe03c
chore(deps-dev): bump picomatch from 4.0.3 to 4.0.4 in /tests/smoke/esm ( #10567 )
...
Bumps [picomatch](https://github.com/micromatch/picomatch ) from 4.0.3 to 4.0.4.
- [Release notes](https://github.com/micromatch/picomatch/releases )
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md )
- [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4 )
---
updated-dependencies:
- dependency-name: picomatch
dependency-version: 4.0.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-03-28 11:32:56 +02:00
dependabot[bot]
0902502fd5
chore(deps): bump picomatch from 4.0.3 to 4.0.4 ( #10568 )
...
Bumps [picomatch](https://github.com/micromatch/picomatch ) from 4.0.3 to 4.0.4.
- [Release notes](https://github.com/micromatch/picomatch/releases )
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md )
- [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4 )
---
updated-dependencies:
- dependency-name: picomatch
dependency-version: 4.0.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jay <jasonsaayman@gmail.com>
2026-03-28 11:28:28 +02:00
