●Change8

v1.19.0

📦 axiosView on GitHub →
✨ 4 features🐛 15 fixes🔧 9 symbols

Summary

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

Migration Steps

  1. Ensure form-data dependency is at least ^4.0.6 to prevent CRLF injection vulnerability.

✨ New Features

  • Preserved own-enumerable symbol-keyed fields through mergeConfig.
  • Added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers.
  • Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior.
  • Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations.

🐛 Bug Fixes

  • Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys.
  • Removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills.
  • Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching.
  • Honored * entries within comma- or space-separated bypass lists for NO_PROXY.
  • Propagated already-aborted input signals immediately when composing abort signals.
  • Preserved empty first values for duplicate singleton headers.
  • Made AxiosHeaders#getSetCookie() consistently return arrays for present values.
  • Included normalized, safely redacted offending URLs in malformed-protocol errors.
  • Removed repeated trailing slashes when combining base URLs.
  • Clamped malformed negative progress values to zero.
  • Ensured final Node.js download progress events are delivered before streamed responses close.
  • Serialized Set values as arrays in JSON-compatible snapshots.
  • Synthesized useful AxiosError messages from otherwise-empty AggregateError instances.
  • Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters.
  • Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully.

Affected Symbols

AxiosHeaders.parseParameters()AxiosHeaders#getSetCookie()formDataToJSONtoFormDatamergeConfigAggregateErrormaxContentLengthHTTP adapterFetch adapter