note: la síntesis y las notas de la versión están en inglés
note: sin síntesis para esta release digest
Las releases digest se listan sin síntesis. Las notas de la versión originales de esta versión están aquí abajo.
release-notesgithub.com/axios/axios · 48 líneas
- This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.
- ## 🔒 Security Fixes
- * **Header Injection Hardening:** Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (__#10749__)
- * **CRLF Stripping in Multipart Headers:** Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (__#10758__)
- * **Prototype Pollution / Auth Bypass:** Replaced unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (__#10761__, __#10760__)
- * **`withXSRFToken` Truthy Bypass:** Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (__#10762__)
- * **`maxBodyLength` With Zero Redirects:** Enforces `maxBodyLength` even when `maxRedirects` is set to `0`, closing a bypass path for oversized request bodies. (__#10753__)
- * **Streamed Response `maxContentLength` Bypass:** Applies `maxContentLength` to streamed responses that previously bypassed the cap. (__#10754__)
- * **Follow-up CVE Completion:** Completes an earlier incomplete CVE fix to fully close the regression window. (__#10755__)
- ## 🚀 New Features
- * **AI-Based Docs Translations:** Initial scaffold for AI-assisted translations of the documentation site. (__#10705__)
- * **`Location` Request Header Type:** Adds `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests. (__#7528__)
- ## 🐛 Bug Fixes
- * **FormData Handling:** Removes `Content-Type` when no boundary is present on `FormData` fetch requests, supports multi-select fields, cancels `request.body` instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (__#7314__, __#10676__, __#10702__, __#10726__)
- * **HTTP Adapter:** Handles socket-only request errors without leaking keep-alive listeners. (__#10576__)
- * **Progress Events:** Clamps `loaded` to `total` for computable upload/download progress events. (__#7458__)
- * **Types:** Aligns `runWhen` type with the runtime behaviour in `InterceptorManager` and makes response header keys case-insensitive. (__#7529__, __#10677__)
- * **`buildFullPath`:** Uses strict equality in the base/relative URL check. (__#7252__)
- * **`AxiosURLSearchParams` Regex:** Improves the regex used for param serialisation to avoid edge-case mismatches. (__#10736__)
- * **Resilient Value Parsing:** Parses out header/config values instead of throwing on malformed input. (__#10687__)
- * **Docs Artefact Cleanup:** Removes the docs content that was incorrectly committed. (__#10727__)
- ## 🔧 Maintenance & Chores
- * **Threat Model & Security Docs:** Ongoing refinement of `THREATMODEL.md`, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (__#10672__, __#10715__, __#10718__, __#10722__, __#10763__, __#10765__)
- * **Test Coverage & Migration:** Expanded `shouldBypassProxy` coverage for wildcard/IPv6/edge cases, documented and tested `AxiosError.status`, and migrated `progressEventReducer` tests to Vitest. (__#10723__, __#10725__, __#10741__)
- * **Type Refactor:** Uses TypeScript utility types to deduplicate literal unions. (__#7520__)
- * **Repo & CI:** Adds `CODEOWNERS`, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (__#10739__, __#10738__, __#10746__)
- * **Changelog Backfill:** Added missing version entries to the changelog. (__#10704__)
- * **Dependencies:** Bumped `follow-redirects` (`1.15.11` → `1.16.0`) in root and docs, `axios` (`1.14.0` → `1.15.0`) in docs, and a group of 5 development dependencies. (__#10717__, __#10716__, __#10684__, __#10709__)
- ## 🌟 New Contributors
- We are thrilled to welcome our new contributors. Thank you for helping improve axios:
- * __@curiouscoder-cmd__ (__#7252__)
- * __@tryonelove__ (__#7520__)
- * __@darwin808__ (__#7314__)
- * __@zoontek__ (__#10702__)
- * __@AKIB473__ (__#10725__)
- [Full Changelog](https://github.com/axios/axios/compare/v1.15.0...v1.15.1)