Skip to content

Update all dependencies#406

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all
Open

Update all dependencies#406
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Jan 5, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
DeployHubProject/ms-cr-action action patch v1.2.165 → v1.2.189 age confidence
actions/checkout action patch v6.0.1 → v6.0.2 age confidence
axios (source) dependencies minor 1.13.2 → 1.16.0 age confidence
step-security/harden-runner action minor v2.14.0 → v2.19.1 age confidence

Release Notes

DeployHubProject/ms-cr-action (DeployHubProject/ms-cr-action)

v1.2.189

Compare Source

1.2.189 (2026-05-04)

v1.2.188

Compare Source

1.2.188 (2026-04-29)

v1.2.187

Compare Source

1.2.187 (2026-04-22)

v1.2.186

Compare Source

1.2.186 (2026-04-20)

v1.2.185

Compare Source

1.2.185 (2026-04-16)

v1.2.184

Compare Source

1.2.184 (2026-04-11)

v1.2.183

Compare Source

1.2.183 (2026-04-09)

v1.2.182

Compare Source

1.2.182 (2026-04-01)

v1.2.181

Compare Source

1.2.181 (2026-03-16)

v1.2.180

Compare Source

1.2.180 (2026-03-16)

v1.2.179

Compare Source

1.2.179 (2026-03-12)

v1.2.178

Compare Source

1.2.178 (2026-03-06)

v1.2.177

Compare Source

1.2.177 (2026-03-04)

v1.2.176

Compare Source

1.2.176 (2026-03-02)

v1.2.175

Compare Source

1.2.175 (2026-02-27)

v1.2.174

Compare Source

1.2.174 (2026-02-25)

v1.2.173

Compare Source

1.2.173 (2026-02-09)

v1.2.172

Compare Source

1.2.172 (2026-01-26)

v1.2.171

Compare Source

1.2.171 (2026-01-22)

v1.2.170

Compare Source

1.2.170 (2026-01-21)

v1.2.169

Compare Source

1.2.169 (2026-01-15)

v1.2.168

Compare Source

1.2.168 (2026-01-10)

v1.2.167

Compare Source

1.2.167 (2026-01-09)

v1.2.166

Compare Source

1.2.166 (2026-01-05)
actions/checkout (actions/checkout)

v6.0.2

Compare Source

axios/axios (axios)

v1.16.0

Compare Source

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

  • Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#​10795)
  • Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#​10822)
  • Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#​10825)
  • parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#​10729)
  • Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#​7378)
  • transformRequest input typing change was reverted. The typing change introduced in #​10745 was reverted in #​10810 after follow-up review — net behavior is unchanged from 1.15.2. (#​10745, #​10810)

🚀 New Features

  • QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#​10802)
  • ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #​6485). (#​10680)
  • Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#​6897)

🐛 Bug Fixes

  • HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#​10794, #​10800, #​6241, #​10822, #​10825)
  • HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#​10708, #​10819, #​7149)
  • Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#​10795, #​10772, #​10806, #​7260)
  • XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#​10787)
  • Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#​10724, #​7276, #​10729)
  • Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#​7414, #​6389, #​6460)
  • UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#​7378)
  • Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#​10833)

🔧 Maintenance & Chores

  • Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#​10588, #​7419)
  • Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#​10820, #​10791, #​10796)
  • Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#​10821, #​10782, #​10759, #​10804)
  • Reverted: Reverted the transformRequest input typing change from #​10745 after follow-up review. (#​10745, #​10810)
  • Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#​10785, #​10813, #​10814)
  • Release: Updated changelog and packages, and prepared the 1.16.0 release. (#​10790, #​10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.15.2

Compare Source

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#​10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#​10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#​10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#​10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #​10780). (#​10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#​10781)

Full Changelog

v1.15.1

Compare Source

v1.15.0

Compare Source

Bug Fixes
Features
  • fomdata: added support for spec-compliant FormData & Blob types; (#​5316) (6ac574e)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.6 (2023-01-28)

Bug Fixes
  • headers: added missed Authorization accessor; (#​5502) (342c0ba)
  • types: fixed CommonRequestHeadersList & CommonResponseHeadersList types to be private in commonJS; (#​5503) (5a3d0a3)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.5 (2023-01-26)

Bug Fixes
  • types: fixed AxiosHeaders to handle spread syntax by making all methods non-enumerable; (#​5499) (580f1e8)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.4 (2023-01-22)

Bug Fixes
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.3 (2023-01-10)

Bug Fixes
  • types: fixed AxiosRequestConfig header interface by refactoring it to RawAxiosRequestConfig; (#​5420) (0811963)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.2.2] - 2022-12-29

Fixed
Chores
  • chore(ci): set conventional-changelog header config #​5406
  • chore(ci): fix automatic contributors resolving #​5403
  • chore(ci): improved logging for the contributors list generator #​5398
  • chore(ci): fix release action #​5397
  • chore(ci): fix version bump script by adding bump argument for target version #​5393
  • chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2 #​5342
  • chore(ci): GitHub Actions Release script #​5384
  • chore(ci): release scripts #​5364
Contributors to this release

[1.2.1] - 2022-12-05

Changed
  • feat(exports): export mergeConfig #​5151
Fixed
  • fix(CancelledError): include config #​4922
  • fix(general): removing multiple/trailing/leading whitespace #​5022
  • fix(headers): decompression for responses without Content-Length header #​5306
  • fix(webWorker): exception to sending form data in web worker #​5139
Refactors
  • refactor(types): AxiosProgressEvent.event type to any #​5308
  • refactor(types): add missing types for static AxiosError.from method #​4956
Chores
  • chore(docs): remove README link to non-existent upgrade guide #​5307
  • chore(docs): typo in issue template name #​5159
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.2.0] - 2022-11-10

Changed
  • changed: refactored module exports #​5162
  • change: re-added support for loading Axios with require('axios').default #​5225
Fixed
  • fix: improve AxiosHeaders class #​5224
  • fix: TypeScript type definitions for commonjs #​5196
  • fix: type definition of use method on AxiosInterceptorManager to match the the README #​5071
  • fix: __dirname is not defined in the sandbox #​5269
  • fix: AxiosError.toJSON method to avoid circular references #​5247
  • fix: Z_BUF_ERROR when content-encoding is set but the response body is empty #​5250
Refactors
  • refactor: allowing adapters to be loaded by name #​5277
Chores
  • chore: force CI restart #​5243
  • chore: update ECOSYSTEM.md #​5077
  • chore: update get/index.html #​5116
  • chore: update Sandbox UI/UX #​5205
  • chore:(actions): remove git credentials after checkout #​5235
  • chore(actions): bump actions/dependency-review-action from 2 to 3 #​5266
  • chore(packages): bump loader-utils from 1.4.1 to 1.4.2 #​5295
  • chore(packages): bump engine.io from 6.2.0 to 6.2.1 #​5294
  • chore(packages): bump socket.io-parser from 4.0.4 to 4.0.5 #​5241
  • chore(packages): bump loader-utils from 1.4.0 to 1.4.1 #​5245
  • chore(docs): update Resources links in README #​5119
  • chore(docs): update the link for JSON url #​5265
  • chore(docs): fix broken links #​5218
  • chore(docs): update and rename UPGRADE_GUIDE.md to MIGRATION_GUIDE.md #​5170
  • chore(docs): typo fix line #​856 and #​920 #​5194
  • chore(docs): typo fix #​800 #​5193
  • chore(docs): fix typos #​5184
  • chore(docs): fix punctuation in README.md #​5197
  • chore(docs): update readme in the Handling Errors section - issue reference #​5260 #​5261
  • chore: remove \b from filename #​5207
  • chore(docs): update CHANGELOG.md #​5137
  • chore: add sideEffects false to package.json #​5025
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.1.3] - 2022-10-15

Added
  • Added custom params serializer support #​5113
Fixed
  • Fixed top-level export to keep them in-line with static properties #​5109
  • Stopped including null values to query string. #​5108
  • Restored proxy config backwards compatibility with 0.x #​5097
  • Added back AxiosHeaders in AxiosHeaderValue #​5103
  • Pin CDN install instructions to a specific version #​5060
  • Handling of array values fixed for AxiosHeaders #​5085
Chores
  • docs: match badge style, add link to them #​5046
  • chore: fixing comments typo #​5054
  • chore: update issue template #​5061
  • chore: added progress capturing section to the docs; #​5084
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.1.2] - 2022-10-07

Fixed
  • Fixed broken exports for UMD builds.
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.1.1] - 2022-10-07

Fixed
  • Fixed broken exports for common js. This fix breaks a prior fix, I will fix both issues ASAP but the commonJS use is more impactful.
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.1.0] - 2022-10-06

Fixed
  • Fixed missing exports in type definition index.d.ts #​5003
  • Fixed query params composing #​5018
  • Fixed GenericAbortSignal interface by making it more generic #​5021
  • Fixed adding "clear" to AxiosInterceptorManager #​5010
  • Fixed commonjs & umd exports #​5030
  • Fixed inability to access response headers when using axios 1.x with Jest #​5036
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.0.0] - 2022-10-04

Added
  • Added stack trace to AxiosError #​4624
  • Add AxiosError to AxiosStatic #​4654
  • Replaced Rollup as our build runner #​4596
  • Added generic TS types for the exposed toFormData helper #​4668
  • Added listen callback function #​4096
  • Added instructions for installing using PNPM #​4207
  • Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill #​4229
  • Added axios-url-template in ECOSYSTEM.md #​4238
  • Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an axios instance #​4248
  • Added react hook plugin #​4319
  • Adding HTTP status code for transformResponse #​4580
  • Added blob to the list of protocols supported by the browser #​4678
  • Resolving proxy from env on redirect #​4436
  • Added enhanced toFormData implementation with additional options 4704
  • Adding Canceler parameters config and request #​4711
  • Added automatic payload serialization to application/x-www-form-urlencoded #​4714
  • Added the ability for webpack users to overwrite built-ins #​4715
  • Added string[] to AxiosRequestHeaders type #​4322
  • Added the ability for the url-encoded-form serializer to respect the formSerializer config #​4721
  • Added isCancel type assert #​4293
  • Added data URL support for node.js #​4725
  • Adding types for progress event callbacks #​4675
  • URL params serializer #​4734
  • Added axios.formToJSON method #​4735
  • Bower platform add data protocol #​4804
  • Use WHATWG URL API instead of url.parse() #​4852
  • Add ENUM containing Http Status Codes to typings #​4903
  • Improve typing of timeout in index.d.ts #​4934
Changed
  • Updated AxiosError.config to be optional in the type definition #​4665
  • Updated README emphasizing the URLSearchParam built-in interface over other solutions #​4590
  • Include request and config when creating a CanceledError instance #​4659
  • Changed func-names eslint rule to as-needed #​4492
  • Replacing deprecated substr() with slice() as substr() is deprecated #​4468
  • Updating HTTP links in README.md to use HTTPS #​4387
  • Updated to a better trim() polyfill #​4072
  • Updated types to allow specifying partial default headers on instance create #​4185
  • Expanded isAxiosError types #​4344
  • Updated type definition for axios instance methods #​4224
  • Updated eslint config #​4722
  • Updated Docs #​4742
  • Refactored Axios to use ES2017 #​4787
Deprecated
  • There are multiple deprecations, refactors and fixes provided in this release. Please read through the full release notes to see how this may impact your project and use case.
Removed
  • Removed incorrect argument for NetworkError constructor #​4656
  • Removed Webpack #​4596
  • Removed function that transform arguments to array #​4544
Fixed
  • Fixed grammar in README #​4649
  • Fixed code error in README #​4599
  • Optimized the code that checks cancellation #​4587
  • Fix url pointing to defaults.js in README #​4532
  • Use type alias instead of interface for AxiosPromise #​4505
  • Fix some word spelling and lint style in code comments #​4500
  • Edited readme with 3 updated browser icons of Chrome, FireFox and Safari #​4414
  • Bump follow-redirects from 1.14.9 to 1.15.0 #​4673
  • Fixing http tests to avoid hanging when assertions fail #​4435
  • Fix TS definition for AxiosRequestTransformer #​4201
  • Fix grammatical issues in README #​4232
  • Fixing instance.defaults.headers type #​4557
  • Fixed race condition on immediate requests cancellation #​4261
  • Fixing Z_BUF_ERROR when no content #​4701
  • Fixing proxy beforeRedirect regression #​4708
  • Fixed AxiosError status code type #​4717
  • Fixed AxiosError stack capturing #​4718
  • Fixing AxiosRequestHeaders typings #​4334
  • Fixed max body length defaults #​4731
  • Fixed toFormData Blob issue on node>v17 #​4728
  • Bump grunt from 1.5.2 to 1.5.3 #​4743
  • Fixing content-type header repeated #​4745
  • Fixed timeout error message for http 4738
  • Request ignores false, 0 and empty string as body values #​4785
  • Added back missing minified builds #​4805
  • Fixed a type error #​4815
  • Fixed a regression bug with unsubscribing from cancel token; #​4819
  • Remove repeated compression algorithm #​4820
  • The error of calling extend to pass parameters #​4857
  • SerializerOptions.indexes allows boolean | null | undefined #​4862
  • Require interceptors to return values #​4874
  • Removed unused imports #​4949
  • Allow null indexes on formSerializer and paramsSerializer #​4960
Chores
  • Set permissions for GitHub actions #​4765
  • Included githubactions in the dependabot config #​4770
  • Included dependency review #​4771
  • Update security.md #​4784
  • Remove unnecessary spaces #​4854
  • Simplify the import path of AxiosError #​4875
  • Fix Gitpod dead link #​4941
  • Enable syntax highlighting for a code block #​4970
  • Using Logo Axios in Readme.md #​4993
  • Fix markup for note in README #​4825
  • Fix typo and formatting, add colons #​4853
  • Fix typo in readme #​4942
Security
Contributors to this release

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every 1 hours every weekday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title Update DeployHubProject/ms-cr-action action to v1.2.166 Update DeployHubProject/ms-cr-action action to v1.2.167 Jan 9, 2026
@renovate renovate Bot changed the title Update DeployHubProject/ms-cr-action action to v1.2.167 Update DeployHubProject/ms-cr-action action to v1.2.168 Jan 10, 2026
@renovate renovate Bot changed the title Update DeployHubProject/ms-cr-action action to v1.2.168 Update DeployHubProject/ms-cr-action action to v1.2.169 Jan 15, 2026
@renovate renovate Bot changed the title Update DeployHubProject/ms-cr-action action to v1.2.169 Update DeployHubProject/ms-cr-action action to v1.2.170 Jan 22, 2026
@renovate renovate Bot changed the title Update DeployHubProject/ms-cr-action action to v1.2.170 Update all dependencies Jan 22, 2026
@renovate renovate Bot force-pushed the renovate/all branch 5 times, most recently from d54d63c to 2125feb Compare January 27, 2026 21:54
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from a167db5 to db282da Compare February 9, 2026 05:11
@renovate renovate Bot force-pushed the renovate/all branch 5 times, most recently from 52744e6 to 5af9139 Compare March 2, 2026 12:53
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from 08d9567 to 317e542 Compare March 6, 2026 05:57
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from 86e3e21 to 80b6989 Compare March 16, 2026 18:31
@renovate renovate Bot force-pushed the renovate/all branch 4 times, most recently from 2fec479 to d346486 Compare April 1, 2026 01:00
@renovate renovate Bot force-pushed the renovate/all branch 5 times, most recently from 8720443 to 49f9d29 Compare April 15, 2026 08:37
@renovate renovate Bot force-pushed the renovate/all branch 7 times, most recently from a30f3bf to 2e15e5d Compare April 22, 2026 06:16
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from 02836e3 to 438e11d Compare May 2, 2026 17:28
@renovate renovate Bot force-pushed the renovate/all branch from 438e11d to 6d24d38 Compare May 4, 2026 06:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants