You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)
🚀 New Features
HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)
🐛 Bug Fixes
Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)
🔧 Maintenance & Chores
HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.60.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.1045.0→3.1062.03.1067.0(+4)3.1045.0→3.1062.03.1067.0(+4)8.59.2→8.60.18.61.0v6.0.2→v6.0.3v3.1.1→v3.2.01.1.9→1.1.101.16.0→1.17.0v7.1.0→v7.2.0v4.1.0→v4.2.0v6.0.0→v6.1.0v4.0.0→v4.1.01.3.1→1.3.216.14.0→16.14.116.14.211.7.5→11.7.624.15.0→24.16.01.63.0→1.68.01.69.07.8.0→7.8.27.8.4(+1)21.0.3→21.1.25.31.6→5.31.74.21.0→4.22.48.59.2→8.60.18.61.07.25.0→7.27.17.27.28.20.0→8.21.0Release Notes
aws/aws-sdk-js-v3 (@aws-sdk/client-s3)
v3.1062.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1061.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1060.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1059.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1058.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1057.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1056.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1055.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1054.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1053.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1052.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1051.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1050.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1049.0Compare Source
Bug Fixes
v3.1048.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1047.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
v3.1046.0Compare Source
Note: Version bump only for package @aws-sdk/client-s3
aws/aws-sdk-js-v3 (@aws-sdk/lib-storage)
v3.1062.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1061.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1060.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1059.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1058.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1057.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1056.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1055.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1054.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1053.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1052.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1051.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1050.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1049.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1048.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1047.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
v3.1046.0Compare Source
Note: Version bump only for package @aws-sdk/lib-storage
typescript-eslint/typescript-eslint (@typescript-eslint/parser)
v8.60.1Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.60.0Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.59.4Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.59.3Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
actions/checkout (actions/checkout)
v6.0.3Compare Source
actions/create-github-app-token (actions/create-github-app-token)
v3.2.0Compare Source
Features
repositoriesinput (#372) (85eb8dd)Bug Fixes
nodejs/amaro (amaro)
v1.1.10Compare Source
Miscellaneous
axios/axios (axios)
v1.17.0Compare Source
v1.17.0 — June 1, 2026
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
socketPath,params, andparamsSerializerreads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)🚀 New Features
transitional.advertiseZstdAcceptEncodingcontrolling whetherzstdis advertised inAccept-Encoding. (#6792, #10920)🐛 Bug Fixes
httpsAgentTLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)Content-Typefor React NativeFormDataso multipart boundaries can be generated correctly. (#10898)resolveConfigfrom an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)AxiosHeaders.toJSON()return types and updated CommonJSisCanceltypings to narrow toCanceledError<T>. (#10956, #10952)Authorizationheader from the GitHub build helper whenGITHUB_TOKENis unset. (#10931)🔧 Maintenance & Chores
Http2Sessionsinto its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)filesallowlist and dropping unneeded unminified bundle source maps. (#10939)fs-extra,qs, docs dependencies, and GitHub Actions dependencies includingactions/dependency-review-actionandzizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog
v1.16.1Compare Source
docker/build-push-action (docker/build-push-action)
v7.2.0Compare Source
docker/login-action (docker/login-action)
v4.2.0Compare Source
Full Changelog: docker/login-action@v4.1.0...v4.2.0
docker/metadata-action (docker/metadata-action)
v6.1.0Compare Source
Full Changelog: docker/metadata-action@v6.0.0...v6.1.0
docker/setup-buildx-action (docker/setup-buildx-action)
v4.1.0Compare Source
Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0
timokoessler/easy-ocsp (easy-ocsp)
v1.3.2Compare Source
Changed
graphql/graphql-js (graphql)
v16.14.1Compare Source
v16.14.1 (2026-06-02)
Docs 📝
9 PRs were merged
Polish 💅
Internal 🏠
Committers: 2
mochajs/mocha (mocha)
v11.7.6Compare Source
🩹 Fixes
describe().timeout()work (aafe6fd)wmicusage with native Windows API (#5694) (73ebdfa)🧹 Chores
nodejs/node (node)
v24.16.0: 2026-05-21, Version 24.16.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
b267f6bca3] - (SEMVER-MINOR) crypto: implementrandomUUIDv7()(nabeel378) #62553ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #627139705f628d9] - (SEMVER-MINOR) fs: add signal option tofs.stat()(Mert Can Altin) #5777540ccfdecf9] - (SEMVER-MINOR) fs: exposefrsizefield instatfs(Jinho Jang) #62277d7188af5c9] - (SEMVER-MINOR) http: hardenClientRequestoptions merge (Matteo Collina) #63082aa1d8a9afc] - (SEMVER-MINOR) http: addreq.signaltoIncomingMessage(Akshat) #625416f37f7e240] - (SEMVER-MINOR) stream: propagate destruction induplexPair(Ahmed Elhor) #61098d14029be7f] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747d142c584cd] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #6282001a9552585] - (SEMVER-MINOR) test_runner: add mock-timers support forAbortSignal.timeout(DeveloperViraj) #6075100705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556Commits
dd72df060d] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509add94f4bc3] - build: track PDL files as inputs in inspector GN build (Robo) #628881b1eb9e334] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #626678752b604ec] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902341947e7fd] - crypto: reject unintended raw key format string input (Filip Skokan) #6297428a78747fc] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #6286316e8c2b54d] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839eeae754a87] - crypto: reject inherited key type names (Jonathan Lopes) #628759dd5540325] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #625537597d204c1] - crypto: add support forEd25519context parameter (Filip Skokan) #624744bf85845da] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #6271383e98f77b7] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375ec8c6b939a] - deps: V8: cherry-pick657d8de(Guy Bedford) #62784722c0c3274] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #611875304db93d3] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046e073b3811d] - deps: update nghttp3 to 1.11.0 (James M Snell) #592491d00313fb2] - deps: update ngtcp2 to 1.14.0 (James M Snell) #592498b3a4fc18f] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #6309062fe0cfcd1] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045137e09c8e9] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #6281014a4cb8fbc] - deps: update timezone to 2026b (Node.js GitHub Bot) #629623e1036583a] - deps: upgrade npm to 11.13.0 (npm team) #6289801dfe5961c] - deps: cherry-pick libuv/libuv@439a54b(skooch) #628816cd368b10c] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699f218a4f553] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698b47688524a] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629d202e2d343] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #626292faba66341] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594fa46c90c5d] - deps: update googletest tod72f9c8(Node.js GitHub Bot) #62593099ded5713] - deps: update simdjson to 4.6.1 (Node.js GitHubConfiguration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.