Skip to content

chore(deps): bump axios from 1.8.4 to 1.15.2#19

Closed
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/axios-1.15.1
Closed

chore(deps): bump axios from 1.8.4 to 1.15.2#19
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/axios-1.15.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 21, 2026 •
edited
Loading

Bumps axios from 1.8.4 to 1.15.2.

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 21, 2026
@dependabot dependabot Bot mentioned this pull request Apr 21, 2026
Closed
@dependabot
chore(deps): bump axios from 1.8.4 to 1.15.2
35ded58 
Bumps [axios](https://github.com/axios/axios) from 1.8.4 to 1.15.2.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.8.4...v1.15.2)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump axios from 1.8.4 to 1.15.1 chore(deps): bump axios from 1.8.4 to 1.15.2 Apr 24, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/axios-1.15.1 branch from 51ed7d9 to 35ded58 Compare April 24, 2026 17:26
@y1o1 y1o1 mentioned this pull request Apr 24, 2026
Merged
5 tasks
y1o1 added a commit that referenced this pull request Apr 24, 2026
@y1o1 @claude
refactor: migrate axios → Node built-in fetch (#26)
37e6a38 
* refactor: migrate axios → Node built-in fetch

Drop the axios runtime dependency in favor of the standard library.
Node 24 supplies fetch, Response, Headers, and AbortSignal.timeout — no
behavior change, smaller surface.

- session-grant-client: throw-on-non-2xx replaced with explicit resp.ok
  check. Network errors (TypeError, AbortError) map to provider_unavailable
  in a single catch. Retry-After lookup now uses Headers.get() which is
  case-insensitive, so the Title-case test still passes without extra code.
- validation/introspect: added IntrospectHttpError so the router can branch
  on HTTP status without peeking at a framework-specific error shape.
- validation/router: replaced axios.isAxiosError with instanceof
  IntrospectHttpError.
- Tests: replaced vi.mock("axios") with vi.stubGlobal("fetch", vi.fn())
  across the three affected suites. Two new tests added for the new error
  paths (non-JSON 200 body, AbortError timeout).

tests: 86 → 88 passing. typecheck / lint / build clean.

Obsoletes dependabot PR #19 (axios 1.8 → 1.13 bump).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(validation): codify malformed 200 introspect response as 502

Addresses Codex review finding on the axios→fetch migration.

Before migration, axios 1.x with default silentJSONParsing=true swallowed
JSON.parse SyntaxError on a 200 response with a malformed body, returning
the raw string. The router's `if (!result.active)` then evaluated
`!"...".active` → truthy, mapping the case to 401 Invalid Token — an
accidental side effect, not an intentional contract.

After migration, `resp.json()` throws on malformed bodies, which the
router caught but mapped to 500 (fall-through path).

Explicitly codify the new contract: a 200 with a non-JSON body is a
provider bug, not an auth decision. Wrap the json() call and rethrow as
IntrospectHttpError(502). This mirrors session-grant-client's
provider_invalid_response (502) handling and makes provider bugs
observable rather than silently degrading to an auth-layer response.

Also add validation tests that were missing for the new fetch error paths:
- non-JSON 200 → IntrospectHttpError(502)
- non-2xx → IntrospectHttpError with matching status
- fetch rejection (AbortError/network) propagates to caller

tests: 88 → 91 passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(validation): reject introspection responses that violate RFC 7662

Closes an auth bypass reported by Copilot on PR #26.

resp.json() successfully parses non-object JSON (strings, numbers, arrays,
null) and objects where `active` is not a boolean. The router only
checked `if (!result.active)`, so a provider returning `{"active":"false"}`
would be truthy → bypass the 401 branch → forward an invalid token to
upstream.

RFC 7662 §2.2 defines `active` as a boolean. Reject any deviation at
introspect boundary by throwing IntrospectHttpError(502), which the router
already maps to 500. This closes the bypass regardless of the parsed shape:

- JSON primitives (string / number / null) → 502
- JSON arrays → 502
- Objects missing `active` → 502
- Objects where `active` is not a boolean (e.g. "false", 1, null) → 502

Only `{"active": <boolean>, ...}` is accepted as a valid introspection
response. The `[key: string]: unknown` extra fields remain permissive.

The bug existed under axios too (same falsy-check pattern), but this PR
touches the introspection path, so per CLAUDE.md it is in scope.

tests: 91 → 99 passing. 8 new parameterized cases covering the Critical
shapes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address Copilot round 2 review on PR #26

Three fixes surfaced by the second Copilot review after the RFC 7662
validation commit:

1. session-grant-client: error message for malformed 200 said "non-JSON
   body", but parseJsonBody() also returns null for valid JSON that is
   not a plain object (string / number / array). Update to
   "non-JSON or non-object JSON body" so provider debugging is accurate.

2. AbortSignal.timeout coverage (session-grant-client + introspect):
   the timeout tests only asserted that init.signal was an AbortSignal
   instance, which would hold even if the code silently ignored the
   configured timeoutMs. Wrap both tests with vi.spyOn(AbortSignal,
   "timeout") and assert the call received 1234. vi.restoreAllMocks()
   added to each afterEach to clean up the spy.

   This point converged with Codex Minor 3 from the original review
   round (CLAUDE.md multi-reviewer convergence rule), auto-promoting
   from Minor to Important.

tests: 99 passing (no new tests; two existing tests strengthened).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@y1o1
Copy link
Copy Markdown
Contributor

y1o1 commented Apr 24, 2026

Obsolete — auth.proxy migrated from axios to Node built-in fetch in PR #26 (merged as 37e6a38). The axios dependency has been removed from package.json, so this bump no longer applies.

@y1o1 y1o1 closed this Apr 24, 2026
@y1o1 y1o1 deleted the dependabot/npm_and_yarn/axios-1.15.1 branch April 24, 2026 18:56
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 24, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@y1o1