note: la synthèse et les notes de version sont en anglais
note: pas de synthèse pour cette release digest
Les releases digest sont listées sans synthèse. Les notes de version originales de cette version sont ci-dessous.
release-notesgithub.com/axios/axios · 19 lignes
- This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed `dist/` artefacts along with Bower support.
- ## ⚠️ Breaking Changes & Deprecations
- * **Bower & Committed `dist/` Removed:** `dist/` bundles are no longer committed to the repo, and `bower.json` plus the Grunt `package2bower` task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (__#10747__)
- ## 🔒 Security Fixes
- * **Prototype Pollution in Header Merge (GHSA-6chq-wfr3-2hj9):** Tightened `isFormData` to reject plain/null-prototype objects and require `append`, and guarded the Node HTTP adapter so `data.getHeaders()` is only merged when it is not inherited from `Object.prototype`. Blocks injected headers via polluted `getHeaders`. (__#10750__)
- * **Prototype Pollution in Config Merging (GHSA-pf86-5x62-jrwf):** `mergeConfig`, defaults resolution, and the HTTP adapter now uses own-property checks for `transport`, `env`, `Blob`, `formSerializer`, and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. (__#10752__)
- * **FormData / Params Recursion DoS:** Added a configurable `maxDepth` (default `100`, `Infinity` disables) to `toFormData` and params serialisation, throwing `AxiosError` with code `ERR_FORM_DATA_DEPTH_EXCEEDED` when exceeded. Circular-reference detection is preserved. (__#10728__)
- * **Null-Byte Injection in Query Strings:** Removed the unsafe `%00` → null-byte substitution from `AxiosURLSearchParams.encode` so `%00` is preserved as-is. Other encoding behaviour (including `%20` → `+`) unchanged. (__#10737__)
- * **Consolidated v1 Security Backport:** Rolls up remaining v1 hardenings into `v0.x`: `maxContentLength` enforcement for `responseType: 'stream'` via a guarded transform with deferred piping, `maxBodyLength` enforcement for streamed uploads on native `http`/`https` with `maxRedirects: 0`, and stricter `withXSRFToken` handling so only own boolean `true` enables cross-origin XSRF headers. (__#10764__)
- ## 🔧 Maintenance & Chores
- * **CODEOWNERS:** Added `.github/CODEOWNERS` with `* @jasonsaayman` to set a default reviewer for all paths. (__#10740__)
- [Full Changelog](https://github.com/axios/axios/compare/v0.31.0...v0.31.1)