# What changed in axios

> 204 changes in axios 0.31 to 1 from its official release notes, upgrade guides and advisories: 29 breaking, 61 security, 17 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/axios/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## axios 1

### Breaking changes

- Invalid DNS lookup and httpVersion failures are now standardized as AxiosError.ERR_BAD_OPTION_VALUE. (1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.20.0)
- XHR requests canceled by navigation now reject with ECONNABORTED instead of resolving with status 0. (1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.20.0)
- Inherited properties no longer influence serializer options, default methods, interceptor-returned headers, or redirect hooks; required values must be own properties. (0.34.0, 1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0), [security advisory](https://github.com/advisories/GHSA-9FR6-4GFG-395G)
- getSetCookie() now consistently returns arrays for present values. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- The dependency floor is now ^4.0.6 to prevent fresh installations from resolving versions affected by a CRLF injection vulnerability. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Path splitting now recognizes only dot and bracket notation, preserving literal punctuation in keys. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Requests are not dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- The Node HTTP adapter strips caller-specified sensitive headers on cross-origin redirects to prevent credentials such as API keys from leaking. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Malformed http: and https: URLs without // are rejected with ERR_INVALID_URL. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Form serialisation now enforces bounded depth checks. (0.33.0, 1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.33.0), [security advisory](https://github.com/advisories/GHSA-42H9-826W-CGV3)
- Passing a URL object as config.url is no longer supported because of regressions. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- The fetch adapter now enforces maxBodyLength, providing protection against accidental large uploads and related denial-of-service risks. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Merged config and header objects now have null prototypes, requiring explicit own-property checks and avoiding implicit string coercion. (0.32.0, 1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0), [security advisory](https://github.com/advisories/GHSA-898C-Q2CR-XWHG)
- Protocol parsing now requires a colon in the protocol separator, so loosely matching strings may no longer be recognized. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- The Node HTTP adapter strips Proxy-Authorization when no proxy is in use. (0.32.0, 1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0), [security advisory](https://github.com/advisories/GHSA-J5F8-GRM9-P9FC)
- Rejects non-string socketPath values and disallowed paths with AxiosError ERR_BAD_OPTION_VALUE. (1.15.2) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.2)
- URL encoding no longer converts %00 into a null byte, preventing null-byte injection in query strings. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-XHJH-PMCV-23JW)
- Exceeding FormData or params recursion depth now throws AxiosError with this code. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-62HF-57XW-28J9)
- FormData detection now rejects plain or null-prototype objects and requires append. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-6CHQ-WFR3-2HJ9)
- maxBodyLength is now enforced for streamed uploads using native http or https with maxRedirects set to 0. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-5C9X-8GCM-MPGX)
- maxContentLength is now enforced for responseType stream responses. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-VF2M-468P-8V99)
- Truthy non-boolean values now short-circuit XSRF token handling, preventing ambiguous configuration from leaking tokens cross-origin. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Only an own boolean true value now enables cross-origin XSRF headers. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-XX6V-RP6X-Q39C)

### Security

- Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges (1.20.0) — [security advisory](https://github.com/advisories/GHSA-44G4-M2MJ-WPVX)
- Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization (1.20.0) — [security advisory](https://github.com/advisories/GHSA-542G-H47M-68V8)
- Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders (1.20.0) — [security advisory](https://github.com/advisories/GHSA-4HQW-QXG8-JXX2)
- Axios: Header Injection via Inherited headers After Minimal Interceptor (1.20.0) — [security advisory](https://github.com/advisories/GHSA-J8RH-479H-CP32)
- Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls (1.20.0) — [security advisory](https://github.com/advisories/GHSA-3PQ3-5FJ3-CG6V)
- Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF (1.20.0) — [security advisory](https://github.com/advisories/GHSA-R4GJ-5M52-G5WH)
- Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection (1.20.0) — [security advisory](https://github.com/advisories/GHSA-M8M8-QJ5V-23W3)
- Axios: Prototype Pollution Gadget in axios toFormData Options (0.34.0, 1.20.0) — [security advisory](https://github.com/advisories/GHSA-X97P-JQ2G-JP4F)
- Axios: Prototype pollution gadget in fetch adapter can alter outbound requests (1.20.0) — [security advisory](https://github.com/advisories/GHSA-VH66-26GQ-Q6X8)
- Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (1.20.0) — [security advisory](https://github.com/advisories/GHSA-C29M-XWM3-CM6R)
- Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (1.20.0) — [security advisory](https://github.com/advisories/GHSA-MGHH-PGCX-3JJJ)
- Hardened behavioral configuration reads against prototype pollution and normalized unsafe interceptor replacement objects. (1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.20.0)
- Malformed-protocol errors now include normalized, safely redacted offending URLs. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- 0.0.0.0 is now treated as local for proxy bypass decisions. (0.33.0, 1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.33.0), [security advisory](https://github.com/advisories/GHSA-F4GW-2P7V-4548)
- Axios: Deep formToJSON Key Recursion Can Cause Denial of Service (0.33.0, 1.18.0) — [security advisory](https://github.com/advisories/GHSA-PMV8-RQ9R-6J72)
- Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` (1.18.0) — [security advisory](https://github.com/advisories/GHSA-JQH4-M9W3-8HP9)
- Axios form serializer maxDepth bypass via {} metatoken (0.33.0, 1.18.0) — [security advisory](https://github.com/advisories/GHSA-HCPX-6FM6-WX23)
- Axios: HTTP/2 streamed uploads bypass `maxBodyLength` (1.18.0) — [security advisory](https://github.com/advisories/GHSA-MWF2-3PR3-8698)
- Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning (0.33.0, 1.18.0) — [security advisory](https://github.com/advisories/GHSA-GCFJ-64VW-6MP9)
- Axios: Prototype pollution auth subfields can inject Basic auth (1.18.0) — [security advisory](https://github.com/advisories/GHSA-XJ6Q-8X83-JV6G)
- Axios: Prototype pollution gadgets can alter axios request construction (0.33.0, 1.18.0) — [security advisory](https://github.com/advisories/GHSA-MMX7-HFXF-JPPX)
- FormData depth handling is tightened. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Local NO_PROXY matching is tightened. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Configuration reads are hardened against prototype pollution. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Nested request options now use own-property reads for auth, params, proxy, and data handling. (0.33.0, 1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.33.0), [security advisory](https://github.com/advisories/GHSA-7Q8Q-RJ6J-MHJQ)
- Stream size handling is tightened to improve request and response safety. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Reads are guarded with own-property checks so inherited prototype values cannot affect request behavior. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Reads are guarded with own-property checks so inherited prototype values cannot affect request behavior. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Reads are guarded with own-property checks so inherited prototype values cannot affect request behavior, including SSRF-sensitive paths. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Own-property traversal prevents attacker-controlled keys inherited from a poisoned prototype from propagating through deserialization. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- HTTPS request data is no longer transmitted in cleartext to an HTTP proxy under affected configurations. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- Allocation of Resources Without Limits or Throttling in Axios (1.16.0) — [security advisory](https://github.com/advisories/GHSA-777C-7FJR-54VF)
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix (1.16.0) — [security advisory](https://github.com/advisories/GHSA-654M-C8P4-X5FP)
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter (0.32.0, 1.16.0) — [security advisory](https://github.com/advisories/GHSA-P92Q-9VQR-4J8V)
- axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` (1.16.0) — [security advisory](https://github.com/advisories/GHSA-35JP-WW65-95WH)
- The fetch adapter now enforces maxContentLength, providing protection against oversized responses. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Proxy bypass matching now supports canonical IPv4-mapped IPv6 forms. (0.32.0, 1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0), [security advisory](https://github.com/advisories/GHSA-PJWM-PJ3P-43MV)
- Cookie names are read literally, and XSRF-token evaluation respects only own properties. (0.32.0, 1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0), [security advisory](https://github.com/advisories/GHSA-HFXV-24RG-XRQF)
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking (1.15.2) — [security advisory](https://github.com/advisories/GHSA-Q8QP-CVCW-X6JJ)
- Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` (1.15.2) — [security advisory](https://github.com/advisories/GHSA-3W6X-2G7M-8V23)
- Configuration processing now ignores inherited polluted properties, preventing sensitive request settings from being altered. (1.15.2) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.2)
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy (0.31.1, 1.15.1) — [security advisory](https://github.com/advisories/GHSA-W9J2-PVGH-6H63)
- Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream (1.15.1) — [security advisory](https://github.com/advisories/GHSA-445Q-VR5W-6Q77)
- Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 (0.31.1, 1.15.1) — [security advisory](https://github.com/advisories/GHSA-PMWG-CVHR-8VH7)
- Axios: no_proxy bypass via IP alias allows SSRF (0.31.1, 1.15.1) — [security advisory](https://github.com/advisories/GHSA-M7PR-HJQH-92CM)
- Multipart header values now strip CR/LF characters to prevent injection through field names and filenames. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- An earlier incomplete CVE fix is completed to fully close the regression window. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- The Node HTTP adapter no longer merges inherited getHeaders values, blocking injected headers from polluted prototypes. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-6CHQ-WFR3-2HJ9)
- Configuration checks no longer rely on unsafe in checks, preventing authentication bypass through prototype pollution. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Request header construction now validates and sanitises values more strictly to close the header-injection attack surface. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Request body limits are enforced even when maxRedirects is set to 0, closing an oversized-body bypass. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Streamed responses now enforce maxContentLength instead of bypassing the configured cap. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Config merging uses own-property checks and returns null-prototype objects, preventing polluted prototypes from hijacking requests. (0.31.1, 1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1), [security advisory](https://github.com/advisories/GHSA-3G43-6GMG-66JW), [security advisory](https://github.com/advisories/GHSA-PF86-5X62-JRWF)
- Fixed a vulnerability that could exfiltrate cloud metadata through a header injection chain. (0.31.0, 1.15.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.0), [security advisory](https://github.com/advisories/GHSA-FVCV-3M26-PCQX)
- Fixed hostname normalisation bypass handling that could enable Server-Side Request Forgery. (0.31.0, 1.15.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.0), [security advisory](https://github.com/advisories/GHSA-3P68-RC4W-QGX5)
- Axios restricts merging the __proto__ key to prevent prototype pollution and Denial of Service during configuration merging. (0.30.3, 1.13.5) — [release notes](https://github.com/axios/axios/releases/tag/v0.30.3), [security advisory](https://github.com/advisories/GHSA-43FC-JF86-J433), [release notes](https://github.com/axios/axios/releases/tag/v1.13.5)
- Axios HTTP/2 Session Cleanup State Corruption Vulnerability (1.13.2) — [security advisory](https://github.com/advisories/GHSA-QJ83-CQ47-W5F8)

### New APIs and options

- Added the RFC 9110 status-code alias ContentTooLarge for HTTP 413 responses. (1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.20.0)
- Added opt-in quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Public TypeScript declarations now support a generic params type across APIs, responses, errors, adapters, and serializers. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Applications can opt in to treating validateStatus: undefined like an omitted option, while null still accepts every status. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Controls whether zstd is advertised in the Accept-Encoding header. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- The Node HTTP adapter now supports zstd response decompression. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Exposed ECONNREFUSED as a constant so callers can match connection-refused failures without comparing string literals. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Re-exported create from the package index. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Exported the internal encode helper from buildURL so userland parameter serializers can reuse axios encoding logic. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Added support for the QUERY HTTP method across adapters and type definitions. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Adds an opt-in allowlist for Unix domain socket paths used by the Node HTTP adapter. (1.15.2) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.2)
- Axios now supports React Native Blob objects, improving integrations that send or handle Blob data. (1.13.6) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.6)
- AxiosRequestConfig now accepts undefined as a value. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- Adds HTTP2 support to Axios HTTP requests. (1.13.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.0)

### Performance

- Removed browser-facing Buffer.from usage to avoid unnecessary polyfills. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)

### Behavior and default changes

- Set values are serialized as arrays in JSON-compatible snapshots. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Environment proxy handling is deferred to Node. (1.18.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.1)
- Data URL sizing is tightened. (1.18.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.0)
- Empty or whitespace-only header names are silently skipped instead of throwing. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Proxy requests now preserve user-supplied Host headers, enabling virtual-host-style routing through a proxy. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- FormData handling now supports multi-select fields. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Response header key types are now case-insensitive. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- HTTPS connections now use port 443 by default. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)

### Tooling

- CommonJS typings now narrow isCancel to CanceledError<T>. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- TypeScript IntelliSense now provides suggestions for string literals in widened unions. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)

### Fixes and other changes

- Interceptor handler arrays no longer grow unbounded after ejections, and nullish public handlers remain safe to operate on. (1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.20.0)
- Successful XHR downloads now flush their final progress callback during the live loadend dispatch. (1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.20.0)
- Corrected how timeoutErrorMessage is merged into request configuration. (1.20.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.20.0)
- Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Already-aborted input signals are propagated immediately when abort signals are composed. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Useful AxiosError messages are synthesized from otherwise-empty AggregateError instances. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Combining base URLs now removes repeated trailing slashes. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Empty first values are preserved for duplicate singleton headers. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Base64 data URL size estimation is corrected so maxContentLength is enforced consistently by HTTP and Fetch adapters. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Own-enumerable symbol-keyed fields are preserved through configuration merging. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Proxy bypass matching now canonicalizes IPv4 shorthand, octal, and hexadecimal forms. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Wildcard entries are now honored within comma- or space-separated proxy bypass lists. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Final Node.js download progress events are delivered before streamed responses close. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- Malformed negative progress values are clamped to zero. (1.19.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.19.0)
- AxiosError#cause is now non-enumerable, preventing circular JSON serialization failures when errors include nested causes. (1.18.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.1)
- The encoder callback now receives the AxiosURLSearchParams instance as this. (1.18.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.1)
- maxBodyLength is explicitly passed through to follow-redirects. (1.18.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.1)
- Several runtime crashes, type definition mismatches, and incorrect error handling paths were fixed. (1.18.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.1)
- Socket keep-alive handling is guarded for proxy agent streams, avoiding failures with those streams. (1.18.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.1)
- Path-only URLs are accepted when socketPath is configured. (1.18.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.18.1)
- Corrected the return types of AxiosHeaders.toJSON(). (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Basic auth is restored on same-origin Node redirects, while credentials continue to be stripped cross-origin. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- React Native FormData no longer receives a default Content-Type, allowing multipart boundaries to be generated correctly. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- The fetch adapter now matches HTTP adapter behavior for URL-embedded Basic auth. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- User TLS options are preserved when tunneling HTTPS requests through HTTP CONNECT proxies. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Cloning plain request data now preserves enumerable symbol keys through axios merge logic. (1.17.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.17.0)
- Stricter RFC 2397 matching fixes edge cases in data: URL handling. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- The context.source type is now optional to align with the ES2023 specification. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- Non-ASCII header content remains intact when requests pass through interceptors. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- The fetch adapter no longer uses syntax Webpack 4 cannot parse, restoring compatibility for legacy bundler users. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- Malformed ProgressEvent payloads no longer crash uploads when loaded or total are missing or invalid. (1.16.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.1)
- The fetch adapter now preserves the original abort reason instead of replacing it with a generic error. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- The parsed response is now attached to AxiosError when JSON.parse fails inside dispatchRequest. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Aborted streams now preserve the partial response object on AxiosError when headers have already arrived. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Credentials embedded in URLs are now URL-decoded before being sent on the wire. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Global access is deferred so importing the fetch adapter no longer throws a TypeError in restricted environments. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- settle no longer emits errors with undefined error codes. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- The timeout option is now honored during the connect phase when redirects are disabled. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- The fetch adapter now sets the User-Agent header to match the HTTP adapter. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- URL encoding now uses modern UTF-8 encoding instead of deprecated unescape(), making non-ASCII URL handling spec-correct. (1.16.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.16.0)
- Parameter serialisation uses an improved regex to avoid edge-case mismatches. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- The base and relative URL check now uses strict equality. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Fetch FormData requests now omit Content-Type when no boundary is present. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Form-data serialisation no longer recurses incorrectly. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Malformed header and configuration values are parsed out instead of causing exceptions. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Socket-only request errors no longer leak keep-alive listeners. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Computable upload and download progress events now clamp loaded to total. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- CommonRequestHeadersList now includes Location for accurate typing of redirect-aware requests. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Fetch abort handling now cancels request.body instead of the source stream. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- The runWhen type now matches InterceptorManager runtime behavior. (1.15.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.1)
- Added compatibility checks and documentation for running Axios in Deno and Bun environments. (1.15.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.0)
- Usage was replaced to address Node.js deprecation warnings in recent Node.js versions. (1.15.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.15.0)
- Environment-based proxy handling is fixed for proxy-from-env v2 usage. (1.14.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.14.0)
- Detached HTTP/2 sessions are closed on timeout to avoid lingering sessions. (1.14.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.14.0)
- The package main entry regression affecting CommonJS consumers is fixed. (1.14.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.14.0)
- Trailing CRLF is trimmed from normalised header values. (1.14.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.14.0)
- ReadableStream instances created during request-stream capability probing are cancelled to prevent async resource leaks. (1.14.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.14.0)
- AxiosError.message is now enumerable, making it visible during property enumeration. (1.13.6) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.6)
- AxiosError.from now copies status from the source error, improving error propagation. (1.13.6) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.6)
- FormData detection is now safe in the WeChat Mini Program environment. (1.13.6) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.6)
- Module exports now work correctly in React Native and Browserify environments. (1.13.6) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.6)
- Ensures AxiosError includes the status field on and after v1.13.3. (1.13.5) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.5)
- Adds input validation to isAbsoluteURL. (1.13.5) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.5)
- AxiosError.cause is typed as Error again instead of unknown. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- AxiosError is converted into a native error. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- The AxiosInterceptorManager interface now includes handlers. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- Axios is compatible with frozen prototypes. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- Errors are handled in the same interceptor where they occur. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- The package main field now corresponds to CommonJS artifacts. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- A Bun exports condition loads the Node.js build instead of the browser build. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- Empty proxy authorization no longer produces an unclear error message. (1.13.3) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.3)
- The http2 module now uses a default export, enabling stubs to work. (1.13.2) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.2)
- Fixed socket hang up errors for keep-alive requests when using timeouts. (1.13.2) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.2)
- Fixed an interruption affecting data streams for responses with non-OK HTTP statuses. (1.13.1) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.1)
- Prevents a TypeError when config.env is undefined in the fetch implementation. (1.13.0) — [release notes](https://github.com/axios/axios/releases/tag/v1.13.0)

## axios 0.34

### Breaking changes

- TypeScript rejects Promise, function, and custom-toString object header values; resolve or explicitly convert them before assignment. (0.34.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0)

### New APIs and options

- Requests and instances can enable caller stack capture to append original caller frames to asynchronous error stacks. (0.34.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0)

### Behavior and default changes

- NO_PROXY and no_proxy now support IPv4 and IPv6 CIDR ranges, allowing matching IP destinations to bypass the proxy. (0.34.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0)

### Fixes and other changes

- CanceledError.reason now preserves AbortSignal.reason, including objects and falsy values, through config merging. (0.34.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0)
- Axios can load alongside a read-only Error.prototype.toJSON while preserving supplied own property descriptors and setters. (0.34.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0)
- HTTP(S) proxy schemes accept optional trailing colons, casing, and surrounding whitespace; invalid nonempty values fail before connecting. (0.34.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0)
- Synchronous interceptor and dispatch failures pass through response interceptors, with recovery promises awaited before dispatch. (0.34.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.34.0)

## axios 0.33

### Fixes and other changes

- Nullish Basic Auth credentials are now normalised. (0.33.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.33.0)

## axios 0.32

### Breaking changes

- AxiosError.toJSON() redacts sensitive keys by default, with behavior configurable through config.redact and defaults.redact. (0.32.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0)
- socketPath is gated by an allowedSocketPaths allowlist that accepts strings or arrays and is normalized. (0.32.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0)

### New APIs and options

- The public TypeScript declarations and runtime defaults now include formDataHeaderPolicy. (0.32.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0)

### Behavior and default changes

- The browser XHR adapter applies stricter own-property checks when reading configuration and headers. (0.32.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0)

### Fixes and other changes

- URL parameter serialization keeps %00 encoded and applies consistent encoding throughout. (0.32.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.32.0)

## axios 0.31

### Breaking changes

- Bower support was removed; installs via Bower must migrate to npm or a CDN. (0.31.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1)
- Committed dist bundles were removed; consumers using the git tree must migrate to npm or a CDN. (0.31.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1)
- The Grunt package2bower task was removed as part of dropping Bower support. (0.31.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1)

### Security

- Proxy bypass enforcement now handles wildcards, ports, loopback aliases, IPv6, and trailing-dot hostnames before parsing proxy URLs. (0.31.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.0)
- Publishes are gated behind a required npm-publish GitHub Environment with configurable reviewer protections. (0.31.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.0)
- Outgoing header values are sanitized to strip invalid bytes, CRLF sequences, and boundary whitespace, including array values. (0.31.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.0)
- Adds zizmor security scanning with SARIF upload to code scanning for the CI/CD supply chain. (0.31.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.0)

### New APIs and options

- toFormData and params serialization now support configurable recursion depth, with default 100 and Infinity disabling the limit. (0.31.1) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.1)

### Performance

- Fixes excessive computation when isEmptyObject() receives a large string. (0.31.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.0)

### Tooling

- Adds an OIDC Trusted Publishing workflow with npm provenance attestations. (0.31.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.0)

### Fixes and other changes

- AxiosInstance methods now resolve to Promise<R>, and the generic call signature correctly enforces the response data type. (0.31.0) — [release notes](https://github.com/axios/axios/releases/tag/v0.31.0)