Vai al contenuto
verdict:

Axios 1.15.1

digest

Note di rilascio

note: la sintesi e le note di rilascio sono in inglese

note: nessuna sintesi per questa release digest

Le release digest sono elencate senza una sintesi. Le note di rilascio originali di questa versione sono qui sotto.

release-notesgithub.com/axios/axios · 48 righe
  1. This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.
  3. ## 🔒 Security Fixes
  5. * **Header Injection Hardening:** Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (__#10749__)
  6. * **CRLF Stripping in Multipart Headers:** Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (__#10758__)
  7. * **Prototype Pollution / Auth Bypass:** Replaced unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (__#10761__, __#10760__)
  8. * **`withXSRFToken` Truthy Bypass:** Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (__#10762__)
  9. * **`maxBodyLength` With Zero Redirects:** Enforces `maxBodyLength` even when `maxRedirects` is set to `0`, closing a bypass path for oversized request bodies. (__#10753__)
  10. * **Streamed Response `maxContentLength` Bypass:** Applies `maxContentLength` to streamed responses that previously bypassed the cap. (__#10754__)
  11. * **Follow-up CVE Completion:** Completes an earlier incomplete CVE fix to fully close the regression window. (__#10755__)
  13. ## 🚀 New Features
  15. * **AI-Based Docs Translations:** Initial scaffold for AI-assisted translations of the documentation site. (__#10705__)
  16. * **`Location` Request Header Type:** Adds `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests. (__#7528__)
  18. ## 🐛 Bug Fixes
  20. * **FormData Handling:** Removes `Content-Type` when no boundary is present on `FormData` fetch requests, supports multi-select fields, cancels `request.body` instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (__#7314__, __#10676__, __#10702__, __#10726__)
  21. * **HTTP Adapter:** Handles socket-only request errors without leaking keep-alive listeners. (__#10576__)
  22. * **Progress Events:** Clamps `loaded` to `total` for computable upload/download progress events. (__#7458__)
  23. * **Types:** Aligns `runWhen` type with the runtime behaviour in `InterceptorManager` and makes response header keys case-insensitive. (__#7529__, __#10677__)
  24. * **`buildFullPath`:** Uses strict equality in the base/relative URL check. (__#7252__)
  25. * **`AxiosURLSearchParams` Regex:** Improves the regex used for param serialisation to avoid edge-case mismatches. (__#10736__)
  26. * **Resilient Value Parsing:** Parses out header/config values instead of throwing on malformed input. (__#10687__)
  27. * **Docs Artefact Cleanup:** Removes the docs content that was incorrectly committed. (__#10727__)
  29. ## 🔧 Maintenance & Chores
  31. * **Threat Model & Security Docs:** Ongoing refinement of `THREATMODEL.md`, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (__#10672__, __#10715__, __#10718__, __#10722__, __#10763__, __#10765__)
  32. * **Test Coverage & Migration:** Expanded `shouldBypassProxy` coverage for wildcard/IPv6/edge cases, documented and tested `AxiosError.status`, and migrated `progressEventReducer` tests to Vitest. (__#10723__, __#10725__, __#10741__)
  33. * **Type Refactor:** Uses TypeScript utility types to deduplicate literal unions. (__#7520__)
  34. * **Repo & CI:** Adds `CODEOWNERS`, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (__#10739__, __#10738__, __#10746__)
  35. * **Changelog Backfill:** Added missing version entries to the changelog. (__#10704__)
  36. * **Dependencies:** Bumped `follow-redirects` (`1.15.11` → `1.16.0`) in root and docs, `axios` (`1.14.0` → `1.15.0`) in docs, and a group of 5 development dependencies. (__#10717__, __#10716__, __#10684__, __#10709__)
  38. ## 🌟 New Contributors
  40. We are thrilled to welcome our new contributors. Thank you for helping improve axios:
  42. * __@curiouscoder-cmd__ (__#7252__)
  43. * __@tryonelove__ (__#7520__)
  44. * __@darwin808__ (__#7314__)
  45. * __@zoontek__ (__#10702__)
  46. * __@AKIB473__ (__#10725__)
  48. [Full Changelog](https://github.com/axios/axios/compare/v1.15.0...v1.15.1)

vedi su githubimported 2026-09-28 via npm