fix: replace ternary side effect with if/else and fix null Authorizat…#10931
Merged
jasonsaayman merged 4 commits intoJun 1, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
1 issue found across 1 file
Confidence score: 4/5
- This PR is likely safe to merge, with only a moderate-risk behavior change noted (severity 5/10, confidence 7/10).
- In
scripts/axios-build-instance.js, conditionally omittingAuthorizationmay stop explicitly clearing inherited default headers, which can lead to unintended auth headers being sent in some request paths. - The impact appears scoped to header-construction behavior rather than a broad functional break, so risk looks manageable with a focused verification pass.
- Pay close attention to
scripts/axios-build-instance.js- ensureAuthorizationis explicitly unset when required to avoid inherited default header leakage.
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
azandabot
force-pushed
the
fix/github-token-style-and-null-header
branch
from
May 25, 2026 07:14
fb4594a to
f42d845
Compare
jasonsaayman
previously requested changes
May 27, 2026
jasonsaayman
left a comment
Member
There was a problem hiding this comment.
Just a couple changes before this one can land.
Contributor
Author
|
Done, both changes applied. Thanks for the review! |
jasonsaayman
approved these changes
May 27, 2026
radovanjorgic
pushed a commit
to devrev/adaas-sdk
that referenced
this pull request
Jul 2, 2026
https://app.devrev.ai/devrev/issue/ASCPT-41  <h3>Snyk has created this PR to upgrade axios from 1.16.1 to 1.17.0.</h3> :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project. <hr/> - The recommended version is **1 version** ahead of your current version. - The recommended version was released **22 days ago**. <details> <summary><b>Release notes</b></summary> <br/> <details> <summary>Package name: <b>axios</b></summary> <ul> <li> <b>1.17.0</b> - <a href="https://redirect.github.com/axios/axios/releases/tag/v1.17.0">2026-06-03</a></br><h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4463370380" data-permission-text="Title is private" data-url="axios/axios#10901" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10901/hovercard" href="https://redirect.github.com/axios/axios/pull/10901">#10901</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4490479466" data-permission-text="Title is private" data-url="axios/axios#10922" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10922/hovercard" href="https://redirect.github.com/axios/axios/pull/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496414139" data-permission-text="Title is private" data-url="axios/axios#10926" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10926/hovercard" href="https://redirect.github.com/axios/axios/pull/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2873194565" data-permission-text="Title is private" data-url="axios/axios#6792" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/6792/hovercard" href="https://redirect.github.com/axios/axios/pull/6792">#6792</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4488098721" data-permission-text="Title is private" data-url="axios/axios#10920" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10920/hovercard" href="https://redirect.github.com/axios/axios/pull/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497340497" data-permission-text="Title is private" data-url="axios/axios#10929" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10929/hovercard" href="https://redirect.github.com/axios/axios/pull/10929">#10929</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4452495512" data-permission-text="Title is private" data-url="axios/axios#10896" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10896/hovercard" href="https://redirect.github.com/axios/axios/pull/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4542876807" data-permission-text="Title is private" data-url="axios/axios#10957" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10957/hovercard" href="https://redirect.github.com/axios/axios/pull/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4460351681" data-permission-text="Title is private" data-url="axios/axios#10898" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10898/hovercard" href="https://redirect.github.com/axios/axios/pull/10898">#10898</a></strong>)</li> <li><strong>Headers:</strong> Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4414924447" data-permission-text="Title is private" data-url="axios/axios#10875" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10875/hovercard" href="https://redirect.github.com/axios/axios/pull/10875">#10875</a></strong>)</li> <li><strong>Request Data Merging:</strong> Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4340876537" data-permission-text="Title is private" data-url="axios/axios#10812" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10812/hovercard" href="https://redirect.github.com/axios/axios/pull/10812">#10812</a></strong>)</li> <li><strong>Bundler Compatibility:</strong> Converted <code>resolveConfig</code> from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4444501376" data-permission-text="Title is private" data-url="axios/axios#10891" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10891/hovercard" href="https://redirect.github.com/axios/axios/pull/10891">#10891</a></strong>)</li> <li><strong>Types:</strong> Corrected <code>AxiosHeaders.toJSON()</code> return types and updated CommonJS <code>isCancel</code> typings to narrow to <code>CanceledError<T></code>. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4541388760" data-permission-text="Title is private" data-url="axios/axios#10956" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10956/hovercard" href="https://redirect.github.com/axios/axios/pull/10956">#10956</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4534902166" data-permission-text="Title is private" data-url="axios/axios#10952" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10952/hovercard" href="https://redirect.github.com/axios/axios/pull/10952">#10952</a></strong>)</li> <li><strong>Build Tooling:</strong> Avoided emitting a null <code>Authorization</code> header from the GitHub build helper when <code>GITHUB_TOKEN</code> is unset. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497546091" data-permission-text="Title is private" data-url="axios/axios#10931" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10931/hovercard" href="https://redirect.github.com/axios/axios/pull/10931">#10931</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>HTTP/2 Internals:</strong> Extracted <code>Http2Sessions</code> into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4395016914" data-permission-text="Title is private" data-url="axios/axios#10861" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10861/hovercard" href="https://redirect.github.com/axios/axios/pull/10861">#10861</a></strong>)</li> <li><strong>Package Publishing:</strong> Reduced published package size by switching to a <code>files</code> allowlist and dropping unneeded unminified bundle source maps. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506840788" data-permission-text="Title is private" data-url="axios/axios#10939" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10939/hovercard" href="https://redirect.github.com/axios/axios/pull/10939">#10939</a></strong>)</li> <li><strong>CI and Release Automation:</strong> Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471484133" data-permission-text="Title is private" data-url="axios/axios#10907" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10907/hovercard" href="https://redirect.github.com/axios/axios/pull/10907">#10907</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4477353252" data-permission-text="Title is private" data-url="axios/axios#10911" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10911/hovercard" href="https://redirect.github.com/axios/axios/pull/10911">#10911</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479841599" data-permission-text="Title is private" data-url="axios/axios#10916" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10916/hovercard" href="https://redirect.github.com/axios/axios/pull/10916">#10916</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496500463" data-permission-text="Title is private" data-url="axios/axios#10927" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10927/hovercard" href="https://redirect.github.com/axios/axios/pull/10927">#10927</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506636815" data-permission-text="Title is private" data-url="axios/axios#10935" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10935/hovercard" href="https://redirect.github.com/axios/axios/pull/10935">#10935</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4564803325" data-permission-text="Title is private" data-url="axios/axios#10983" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10983/hovercard" href="https://redirect.github.com/axios/axios/pull/10983">#10983</a></strong>)</li> <li><strong>Developer Workflow:</strong> Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496362243" data-permission-text="Title is private" data-url="axios/axios#10925" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10925/hovercard" href="https://redirect.github.com/axios/axios/pull/10925">#10925</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479754974" data-permission-text="Title is private" data-url="axios/axios#10914" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10914/hovercard" href="https://redirect.github.com/axios/axios/pull/10914">#10914</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4542923609" data-permission-text="Title is private" data-url="axios/axios#10958" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10958/hovercard" href="https://redirect.github.com/axios/axios/pull/10958">#10958</a></strong>)</li> <li><strong>Documentation and Policy:</strong> Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439857559" data-permission-text="Title is private" data-url="axios/axios#10890" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10890/hovercard" href="https://redirect.github.com/axios/axios/pull/10890">#10890</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439812615" data-permission-text="Title is private" data-url="axios/axios#10889" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10889/hovercard" href="https://redirect.github.com/axios/axios/pull/10889">#10889</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4488493808" data-permission-text="Title is private" data-url="axios/axios#10921" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10921/hovercard" href="https://redirect.github.com/axios/axios/pull/10921">#10921</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4521919780" data-permission-text="Title is private" data-url="axios/axios#10945" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10945/hovercard" href="https://redirect.github.com/axios/axios/pull/10945">#10945</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471392208" data-permission-text="Title is private" data-url="axios/axios#10905" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10905/hovercard" href="https://redirect.github.com/axios/axios/pull/10905">#10905</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4504485021" data-permission-text="Title is private" data-url="axios/axios#10933" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10933/hovercard" href="https://redirect.github.com/axios/axios/pull/10933">#10933</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479794362" data-permission-text="Title is private" data-url="axios/axios#10915" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10915/hovercard" href="https://redirect.github.com/axios/axios/pull/10915">#10915</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439585604" data-permission-text="Title is private" data-url="axios/axios#10887" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10887/hovercard" href="https://redirect.github.com/axios/axios/pull/10887">#10887</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4539242124" data-permission-text="Title is private" data-url="axios/axios#10955" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10955/hovercard" href="https://redirect.github.com/axios/axios/pull/10955">#10955</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, <code>fs-extra</code>, <code>qs</code>, docs dependencies, and GitHub Actions dependencies including <code>actions/dependency-review-action</code> and <code>zizmorcore/zizmor-action</code>. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4413298372" data-permission-text="Title is private" data-url="axios/axios#10871" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10871/hovercard" href="https://redirect.github.com/axios/axios/pull/10871">#10871</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4430775028" data-permission-text="Title is private" data-url="axios/axios#10879" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10879/hovercard" href="https://redirect.github.com/axios/axios/pull/10879">#10879</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4481451976" data-permission-text="Title is private" data-url="axios/axios#10918" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10918/hovercard" href="https://redirect.github.com/axios/axios/pull/10918">#10918</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4481452562" data-permission-text="Title is private" data-url="axios/axios#10919" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10919/hovercard" href="https://redirect.github.com/axios/axios/pull/10919">#10919</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4504986865" data-permission-text="Title is private" data-url="axios/axios#10934" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10934/hovercard" href="https://redirect.github.com/axios/axios/pull/10934">#10934</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4526297030" data-permission-text="Title is private" data-url="axios/axios#10947" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10947/hovercard" href="https://redirect.github.com/axios/axios/pull/10947">#10947</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4537480721" data-permission-text="Title is private" data-url="axios/axios#10954" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10954/hovercard" href="https://redirect.github.com/axios/axios/pull/10954">#10954</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4549771364" data-permission-text="Title is private" data-url="axios/axios#10960" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10960/hovercard" href="https://redirect.github.com/axios/axios/pull/10960">#10960</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BasixKOR/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/BasixKOR">@ BasixKOR</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2873194565" data-permission-text="Title is private" data-url="axios/axios#6792" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/6792/hovercard" href="https://redirect.github.com/axios/axios/pull/6792">#6792</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/carladams1299-lab/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/carladams1299-lab">@ carladams1299-lab</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4395016914" data-permission-text="Title is private" data-url="axios/axios#10861" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10861/hovercard" href="https://redirect.github.com/axios/axios/pull/10861">#10861</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/LaplaceYoung/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/LaplaceYoung">@ LaplaceYoung</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4340876537" data-permission-text="Title is private" data-url="axios/axios#10812" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10812/hovercard" href="https://redirect.github.com/axios/axios/pull/10812">#10812</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/JamieMagee/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/JamieMagee">@ JamieMagee</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506840788" data-permission-text="Title is private" data-url="axios/axios#10939" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10939/hovercard" href="https://redirect.github.com/axios/axios/pull/10939">#10939</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/RonGamzu/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/RonGamzu">@ RonGamzu</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471392208" data-permission-text="Title is private" data-url="axios/axios#10905" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10905/hovercard" href="https://redirect.github.com/axios/axios/pull/10905">#10905</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sapirbaruch/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/sapirbaruch">@ sapirbaruch</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4444501376" data-permission-text="Title is private" data-url="axios/axios#10891" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10891/hovercard" href="https://redirect.github.com/axios/axios/pull/10891">#10891</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/nezukoagent/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/nezukoagent">@ nezukoagent</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4463370380" data-permission-text="Title is private" data-url="axios/axios#10901" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10901/hovercard" href="https://redirect.github.com/axios/axios/pull/10901">#10901</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/devareddy05/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/devareddy05">@ devareddy05</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497340497" data-permission-text="Title is private" data-url="axios/axios#10929" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10929/hovercard" href="https://redirect.github.com/axios/axios/pull/10929">#10929</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Mohammad-Faiz-Cloud-Engineer/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Mohammad-Faiz-Cloud-Engineer">@ Mohammad-Faiz-Cloud-Engineer</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4490479466" data-permission-text="Title is private" data-url="axios/axios#10922" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10922/hovercard" href="https://redirect.github.com/axios/axios/pull/10922">#10922</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/azandabot/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/azandabot">@ azandabot</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497546091" data-permission-text="Title is private" data-url="axios/axios#10931" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10931/hovercard" href="https://redirect.github.com/axios/axios/pull/10931">#10931</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/niksy/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/niksy">@ niksy</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4452495512" data-permission-text="Title is private" data-url="axios/axios#10896" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10896/hovercard" href="https://redirect.github.com/axios/axios/pull/10896">#10896</a></strong>)</li> </ul> <p><a href="https://redirect.github.com/axios/axios/compare/v1.16.1...v1.17.0">Full Changelog</a></p> </li> <li> <b>1.16.1</b> - <a href="https://redirect.github.com/axios/axios/releases/tag/v1.16.1">2026-05-13</a></br><h2>v1.16.1 — May 13, 2026</h2> <p>This release ships a defence-in-depth fix for prototype pollution in <code>formDataToJSON</code>, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Prototype Pollution Defence-in-Depth:</strong> Hardened <code>formDataToJSON</code> against already-polluted <code>Object.prototype</code> by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3959581677" data-permission-text="Title is private" data-url="axios/axios#7413" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/7413/hovercard" href="https://redirect.github.com/axios/axios/pull/7413">#7413</a></strong>)</li> <li><strong>Proxy Cleartext Leak:</strong> Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392783718" data-permission-text="Title is private" data-url="axios/axios#10858" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10858/hovercard" href="https://redirect.github.com/axios/axios/pull/10858">#10858</a></strong>)</li> <li><strong>CI Cache Removal:</strong> Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4431484006" data-permission-text="Title is private" data-url="axios/axios#10882" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10882/hovercard" href="https://redirect.github.com/axios/axios/pull/10882">#10882</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Data URI Parsing:</strong> Updated the <code>fromDataURI</code> regex to match RFC 2397 more strictly, fixing edge cases in <code>data:</code> URL handling. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4356424237" data-permission-text="Title is private" data-url="axios/axios#10829" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10829/hovercard" href="https://redirect.github.com/axios/axios/pull/10829">#10829</a></strong>)</li> <li><strong>Unicode Headers:</strong> Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4388506485" data-permission-text="Title is private" data-url="axios/axios#10850" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10850/hovercard" href="https://redirect.github.com/axios/axios/pull/10850">#10850</a></strong>)</li> <li><strong>XHR Upload Progress:</strong> Guarded against malformed <code>ProgressEvent</code> payloads emitted by some environments during XHR upload, preventing crashes when <code>loaded</code> / <code>total</code> are missing or invalid. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4409815240" data-permission-text="Title is private" data-url="axios/axios#10868" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10868/hovercard" href="https://redirect.github.com/axios/axios/pull/10868">#10868</a></strong>)</li> <li><strong>Webpack 4 Fetch Adapter:</strong> Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4400660060" data-permission-text="Title is private" data-url="axios/axios#10864" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10864/hovercard" href="https://redirect.github.com/axios/axios/pull/10864">#10864</a></strong>)</li> <li><strong>Type Definitions:</strong> Made <code>parseReviver</code> <code>context.source</code> optional in the type definitions to align with the ES2023 specification. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4370232960" data-permission-text="Title is private" data-url="axios/axios#10837" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10837/hovercard" href="https://redirect.github.com/axios/axios/pull/10837">#10837</a></strong>)</li> <li><strong>URL Object Support Reverted:</strong> Reverted the change that allowed passing a <code>URL</code> object as <code>config.url</code> (originally <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4403806527" data-permission-text="Title is private" data-url="axios/axios#10866" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10866/hovercard" href="https://redirect.github.com/axios/axios/pull/10866">#10866</a></strong>) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4414921751" data-permission-text="Title is private" data-url="axios/axios#10874" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10874/hovercard" href="https://redirect.github.com/axios/axios/pull/10874">#10874</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Cycle Detection Refactor:</strong> Replaced the array-based cycle tracker in <code>toJSONObject</code> with a <code>WeakSet</code>, improving performance and memory behaviour on large nested structures. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4361368446" data-permission-text="Title is private" data-url="axios/axios#10832" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10832/hovercard" href="https://redirect.github.com/axios/axios/pull/10832">#10832</a></strong>)</li> <li><strong>composeSignals Cleanup:</strong> Refactored <code>composeSignals</code> to use a clearer early-return structure, simplifying the cancellation/abort composition path. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4380190238" data-permission-text="Title is private" data-url="axios/axios#10844" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10844/hovercard" href="https://redirect.github.com/axios/axios/pull/10844">#10844</a></strong>)</li> <li><strong>AI Readiness & Repo Docs:</strong> Added <code>AGENTS.md</code> and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369274702" data-permission-text="Title is private" data-url="axios/axios#10835" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10835/hovercard" href="https://redirect.github.com/axios/axios/pull/10835">#10835</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4378451451" data-permission-text="Title is private" data-url="axios/axios#10841" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10841/hovercard" href="https://redirect.github.com/axios/axios/pull/10841">#10841</a></strong>)</li> <li><strong>Docs Improvements:</strong> Clarified the GET request example, fixed the interceptor <code>eject</code> example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369287222" data-permission-text="Title is private" data-url="axios/axios#10836" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10836/hovercard" href="https://redirect.github.com/axios/axios/pull/10836">#10836</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4390162698" data-permission-text="Title is private" data-url="axios/axios#10853" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10853/hovercard" href="https://redirect.github.com/axios/axios/pull/10853">#10853</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392363280" data-permission-text="Title is private" data-url="axios/axios#10856" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10856/hovercard" href="https://redirect.github.com/axios/axios/pull/10856">#10856</a></strong>)</li> <li><strong>Sponsorship Tooling:</strong> Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4378946632" data-permission-text="Title is private" data-url="axios/axios#10843" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10843/hovercard" href="https://redirect.github.com/axios/axios/pull/10843">#10843</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4393416912" data-permission-text="Title is private" data-url="axios/axios#10859" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10859/hovercard" href="https://redirect.github.com/axios/axios/pull/10859">#10859</a></strong>, <strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4412918174" data-permission-text="Title is private" data-url="axios/axios#10869" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10869/hovercard" href="https://redirect.github.com/axios/axios/pull/10869">#10869</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>@ commitlint/cli</code> from 20.5.0 to 20.5.2. (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4383276255" data-permission-text="Title is private" data-url="axios/axios#10846" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10846/hovercard" href="https://redirect.github.com/axios/axios/pull/10846">#10846</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/hpinmetaverse/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/hpinmetaverse">@ hpinmetaverse</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369287222" data-permission-text="Title is private" data-url="axios/axios#10836" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10836/hovercard" href="https://redirect.github.com/axios/axios/pull/10836">#10836</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tommyhgunz14/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/tommyhgunz14">@ tommyhgunz14</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3959581677" data-permission-text="Title is private" data-url="axios/axios#7413" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/7413/hovercard" href="https://redirect.github.com/axios/axios/pull/7413">#7413</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/abhu85/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/abhu85">@ abhu85</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4356424237" data-permission-text="Title is private" data-url="axios/axios#10829" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10829/hovercard" href="https://redirect.github.com/axios/axios/pull/10829">#10829</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/divyanshuraj1095/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/divyanshuraj1095">@ divyanshuraj1095</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4390162698" data-permission-text="Title is private" data-url="axios/axios#10853" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10853/hovercard" href="https://redirect.github.com/axios/axios/pull/10853">#10853</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sagodi97/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/sagodi97">@ sagodi97</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392363280" data-permission-text="Title is private" data-url="axios/axios#10856" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10856/hovercard" href="https://redirect.github.com/axios/axios/pull/10856">#10856</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/rkdfx/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/rkdfx">@ rkdfx</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4409815240" data-permission-text="Title is private" data-url="axios/axios#10868" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10868/hovercard" href="https://redirect.github.com/axios/axios/pull/10868">#10868</a></strong>)</li> <li><strong><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Liuwei1125/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Liuwei1125">@ Liuwei1125</a></strong> (<strong><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4403806527" data-permission-text="Title is private" data-url="axios/axios#10866" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10866/hovercard" href="https://redirect.github.com/axios/axios/pull/10866">#10866</a></strong>)</li> </ul> <p><a href="https://redirect.github.com/axios/axios/compare/v1.16.0...v1.16.1">Full Changelog</a></p> </li> </ul> from <a href="https://redirect.github.com/axios/axios/releases">axios GitHub release notes</a> </details> </details> --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._ **For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJiZjMyYzAwMC1iZGM2LTQyMzktYjg1Mi0wMzRhOGNhYTIzZDUiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImJmMzJjMDAwLWJkYzYtNDIzOS1iODUyLTAzNGE4Y2FhMjNkNSJ9fQ==" width="0" height="0"/> > - 🧐 [View latest project report](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template) > - 🛠 [Adjust upgrade PR settings](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2/settings/integration?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2/settings/integration?pkg=axios&utm_source=github&utm_medium=referral&page=upgrade-pr#auto-dep-upgrades) [//]: # 'snyk:metadata:{"breakingChangeRiskLevel":null,"FF_showPullRequestBreakingChanges":false,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"axios","from":"1.16.1","to":"1.17.0"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"bf32c000-bdc6-4239-b852-034a8caa23d5","prPublicId":"bf32c000-bdc6-4239-b852-034a8caa23d5","packageManager":"npm","priorityScoreList":[],"projectPublicId":"58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2","projectUrl":"https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2026-06-03T06:58:28.145Z"},"vulns":[]}' Co-authored-by: snyk-bot <snyk-bot@snyk.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two issues found in
scripts/axios-build-instance.js:Ternary used for side effects
The contributing guidelines reference the node-style-guide which discourages using ternary operators purely for side effects with no return value. Replaced with an if/else for clarity.
Null Authorization header
When GITHUB_TOKEN is undefined, the header was being set to
nullrather than being omitted entirely. Setting a header to null can result in the string "null" being sent in some environments. Fixed using conditional object spreading so the header is simply absent when no token is provided.Note:
npm run testshows 1049/1050 tests passing. The single unhandled error is a webkit browser session timeout unrelated to this change.Summary by cubic
Fixes the GitHub
axiosclient to omit theAuthorizationheader whenGITHUB_TOKENis missing and replaces a ternary side effect with a clear if/else. Prevents sending a "null" header; behavior is unchanged when a token is provided.Changes
scripts/axios-build-instance.js, replace ternary side effect with if/else for logging.AuthorizationwhenGITHUB_TOKENexists using conditional object spread.v1.x(no functional changes).Notes
/docs/to clarify the header is added only when a token is set.Written for commit b525733. Summary will update on new commits.