Skip to content
verdict:

Axios 1.16.0

notable

Release notes

note: no summary for this older release

We summarize recent releases. The original release notes for this version are below.

release-notesgithub.com/axios/axios · 70 lines
  1. ## v1.16.0 — May 2, 2026
  3. This release adds support for the QUERY HTTP method and a new `ECONNREFUSED` error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.
  5. ## ⚠️ Notable Changes
  7. A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:
  9. - **Fetch adapter now enforces `maxBodyLength` and `maxContentLength`.** These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (**#10795**)
  10. - **Proxy requests now preserve user-supplied `Host` headers.** Previously, the proxy path could overwrite a custom `Host`. Virtual-host-style routing through a proxy will now behave correctly. (**#10822**)
  11. - **Basic auth credentials embedded in URLs are now URL-decoded.** If you have percent-encoded credentials in a URL (e.g. `https://user:p%40ss@host`), the decoded value is what now goes on the wire. (**#10825**)
  12. - **`parseProtocol` now strictly requires a colon in the protocol separator.** Strings that loosely parsed as protocols before may no longer match. (**#10729**)
  13. - **Deprecated `unescape()` replaced with modern UTF-8 encoding.** Non-ASCII URL handling is now spec-correct; consumers depending on legacy `unescape()` quirks may see different output bytes. (**#7378**)
  14. - **`transformRequest` input typing change was reverted.** The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (**#10745**, **#10810**)
  16. ## 🚀 New Features
  18. - **QUERY HTTP Method:** Added support for the QUERY HTTP method across adapters and type definitions. (**#10802**)
  19. - **ECONNREFUSED Error Constant:** Exposed `ECONNREFUSED` as a constant on `AxiosError` so callers can match connection-refused failures without comparing string literals (closes #6485). (**#10680**)
  20. - **Encode Helper Export:** Exported the internal `encode` helper from `buildURL` so userland param serializers can reuse the same encoding logic that axios uses internally. (**#6897**)
  22. ## 🐛 Bug Fixes
  24. - **HTTP Adapter — Redirects & Headers:** Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing `requestDetails` argument on `beforeRedirect`, preserved user-supplied `Host` headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (**#10794**, **#10800**, **#6241**, **#10822**, **#10825**)
  25. - **HTTP Adapter — Streams & Timeouts:** Preserved the partial response object on `AxiosError` when a stream is aborted after headers arrive, honoured the `timeout` option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and `maxRedirects: 0`. (**#10708**, **#10819**, **#7149**)
  26. - **Fetch Adapter:** Enforced `maxBodyLength` / `maxContentLength` in the fetch adapter, set the `User-Agent` header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a `TypeError` in restricted environments. (**#10795**, **#10772**, **#10806**, **#7260**)
  27. - **XHR Adapter:** Unsubscribed the `cancelToken` and `AbortSignal` listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (**#10787**)
  28. - **Error Handling:** Attached the parsed response to `AxiosError` when `JSON.parse` fails inside `dispatchRequest`, prevented `settle` from emitting `undefined` error codes, and tightened the `parseProtocol` regex to require a colon in the protocol separator. (**#10724**, **#7276**, **#10729**)
  29. - **Types & Exports:** Aligned the CommonJS `CancelToken` typings with the ESM build, fixed a compiler error caused by `RawAxiosHeaders`, and re-exported `create` from the package index. (**#7414**, **#6389**, **#6460**)
  30. - **UTF-8 Encoding:** Replaced the deprecated `unescape()` call with a modern UTF-8 encoding implementation. (**#7378**)
  31. - **Misc Cleanup:** Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (**#10833**)
  33. ## 🔧 Maintenance & Chores
  35. - **Refactor — ES6 Modernisation:** Modernised the `utils` module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (**#10588**, **#7419**)
  36. - **Tests:** Hardened the HTTP test server lifecycle to fix flaky `FormData` EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (**#10820**, **#10791**, **#10796**)
  37. - **Docs:** Documented `paramsSerializer.encode` for strict RFC 3986 query encoding, updated the `parseReviver` TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (**#10821**, **#10782**, **#10759**, **#10804**)
  38. - **Reverted:** Reverted the `transformRequest` input typing change from #10745 after follow-up review. (**#10745**, **#10810**)
  39. - **Dependencies:** Bumped `actions/setup-node`, the `github-actions` group, and `postcss` (in `/docs`) to their latest versions. (**#10785**, **#10813**, **#10814**)
  40. - **Release:** Updated changelog and packages, and prepared the 1.16.0 release. (**#10790**, **#10834**)
  42. ## 🌟 New Contributors
  44. We are thrilled to welcome our new contributors. Thank you for helping improve axios:
  46. - **@singhankit001** (**#10588**)
  47. - **@cuiweixie** (**#7419**)
  48. - **@iruizsalinas** (**#10787**)
  49. - **@MarcosNocetti** (**#10680**)
  50. - **@deepview-autofix** (**#10729**)
  51. - **@atharvasingh7007** (**#10745**)
  52. - **@OfekDanny** (**#10772**)
  53. - **@mnahkies** (**#7414**)
  54. - **@tboyila** (**#10759**)
  55. - **@Kingo64** (**#6897**)
  56. - **@ramram1048** (**#6389**)
  57. - **@FLNacif** (**#6460**)
  58. - **@zozo123** (**#10806**)
  59. - **@pierluigilenoci** (**#10802**)
  60. - **@afurm** (**#10708**)
  61. - **@karan-lrn** (**#7378**)
  62. - **@ebeigarts** (**#7149**)
  63. - **@Raymondo97** (**#10782**)
  64. - **@mixelburg** (**#10821**)
  65. - **@ashishkr96** (**#10822**)
  66. - **@cyphercodes** (**#10819**)
  67. - **@Jye10032** (**#7260**)
  68. - **@VeerShah41** (**#7276**)
  70. [Full Changelog](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)

view on githubimported 2026-09-28 via npm