note: die Zusammenfassung und die Release Notes sind auf Englisch
note: keine Zusammenfassung für dieses digest-Release
digest-Releases werden ohne Zusammenfassung gelistet. Die originalen Release Notes dieser Version stehen hier unten.
release-notesgithub.com/axios/axios · 21 Zeilen
- This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).
- Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.
- ## 🛡️ Security Fixes
- - **Backport: Fix DoS via __proto__ key in merge config**
- - Patched a vulnerability where specifically crafted configuration objects using the __proto__ key could cause a Denial of Service during the merge process. - _by @FeBe95 in [PR #7388](https://github.com/axios/axios/pull/7388)_
- ## ⚙️ Maintenance & CI
- - **CI Infrastructure Update**
- - Updated Continuous Integration workflows for the v0.x branch to maintain long-term support and build reliability. - _by @jasonsaayman in [PR #7407](https://github.com/axios/axios/pull/7407)_
- ## ⚠️ Breaking Changes
- Configuration Merging Behavior:
- As part of the security fix, Axios now restricts the merging of the __proto__ key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.
- Full Changelog: [v0.30.2...v0.30.3](https://github.com/axios/axios/compare/v0.30.2...v0.30.3)