29 lines (22 loc) · 7.25 KB

Pre-Release Changelog

Unreleased

Features

Proxy bypass CIDR ranges: Added IPv4 and IPv6 CIDR matching to NO_PROXY/no_proxy, including bracketed IPv6 and IPv4-mapped IPv6 normalization, while malformed ranges fail closed. A /0 entry bypasses the proxy for its entire address family.
HTTP status code names: Added the RFC 9110 names HttpStatusCode.ContentTooLarge for 413 and HttpStatusCode.UnprocessableContent for 422 across the runtime API and ESM/CommonJS declarations. The existing PayloadTooLarge and UnprocessableEntity names remain as deprecated aliases, and numeric reverse lookups retain their existing v1.x names for compatibility. (#11082, closes #11066)

Bug Fixes

Fetch response size errors: Preserve ERR_BAD_RESPONSE and the current request/config when a fetch response exceeds maxContentLength and the runtime wraps the stream failure, including when it drops the original cause. Clarify when custom env.Response constructors must accept tracked streams at runtime while preserving existing response limits and constructor signatures. (#11179)
TypeScript declarations: Exposed the branded response-default marker type so consumers can emit declarations for helpers that forward Axios request response generics. (#11116)
Method-specific headers: Added default header buckets for all supported methods and removed those structural buckets during request preparation, so OPTIONS, PURGE, LINK, UNLINK, and QUERY defaults apply only to matching requests instead of leaking as literal headers. (#11096)
Node HTTP adapter option errors: Invalid custom DNS lookup addresses and invalid or unsupported httpVersion values, including non-coercible JavaScript types, now reject with AxiosError and ERR_BAD_OPTION_VALUE while preserving the request config for diagnostics. (#11096)
Runtime configuration hardening: Prevented values inherited only from shared prototypes, including another JavaScript realm's Object.prototype even when its constructor is altered, from becoming request behavior after config merging or interceptor replacement. Methods, headers, adapters, transports, FormData hooks, serializer options, and Fetch Request options are protected. Already-safe writable merged configs retain their identity through dispatch, while frozen, sealed, accessor-based, otherwise restricted, or unsafe-key-bearing replacements become writable filtered snapshots. Interceptor replacements with non-terminal application-defined prototypes remain supported as normalized null-prototype snapshots, terminal null-prototype ancestors are treated as shared boundaries to fail closed, and own __proto__, constructor, and prototype keys remain excluded from materialized configs.
Fetch adapter consistency: Custom fetch implementations now receive the fully resolved Request plus a safe second fetchOptions argument that preserves custom own fields without overriding Axios-managed request fields. The authoritative method, headers, body, signal, duplex, and credentials are available on the Request and omitted from the second argument. maxRedirects: 0 selects manual redirect handling when supported; Node exposes the unfollowed 3xx response, while browsers may expose an opaque redirect with status 0 and inaccessible headers. The no-Request fallback receives the same safe resolved options.
HTTP/2 adapter consistency: Custom DNS lookup functions now apply to HTTP/2 connections and can reuse pooled sessions safely. Explicit Axios proxy objects fail with ERR_NOT_SUPPORT, while process-environment and HTTP/1-agent proxyEnv settings are ignored because http2.connect() cannot apply them; proxy: false continues to force a direct connection. Failed sessions are removed without leaking an unhandled session error.
Data URI validation: Rejected media types containing extra slash separators and avoided excessive backtracking for long malformed media types.
Node HTTP adapter - keep-alive memory retention: Reused a module-scoped socket error listener so pooled keep-alive sockets no longer retain the adapter context, response body, and buffers from the request that first used each socket. Socket errors continue to destroy only the currently active request. (#11091)
XHR Adapter - final download progress delivery: onDownloadProgress now always receives a final delivery when a completed XHR download reaches its successful loadend handler. The callback runs while that event is still dispatching, so listeners reading incremental data from event.currentTarget observe the complete response. Previously the final delivery happened only when a throttled progress event was still pending, and it replayed an event whose dispatch had already finished — event.currentTarget was null — so text-streaming consumers could lose every chunk after the first in browsers whose progress cadence kept deliveries inside the throttle window. A final callback that cancels the request stops settlement processing cleanly, while a throwing callback does not leave the request pending. Upload progress and flushes triggered by stream errors, abort reasons, or failed XHR downloads retain their prior pending-event behavior. (closes #6796)
XHR Adapter - navigation-canceled requests: A response that reaches loadend with status 0 is now rejected as an ECONNABORTED error instead of resolving as a success with an empty body. Firefox 152 stopped firing error and abort for requests canceled by a document navigation, leaving loadend as the only handler that runs, so those requests were settling as successful responses. Rejecting with ECONNABORTED matches what onabort raised on Firefox 151, so the outcome an application sees is unchanged by that update. Reads over file:, which some environments report as status 0 on success, still resolve, whether the scheme appears on the request URL, is inherited from a file: page origin by a relative request URL, or appears only on responseURL. Because no response was received, the rejection is not suppressed by validateStatus, matching how onerror and onabort already behave. (#11094, closes #11093)
Request error stacks: Preserved original request failures when custom Error stack instrumentation returns non-string data or throws during optional stack decoration. (#11109, closes #11108)
Fetch adapter - cache mode: Omitted the implicit cache: 'default' when a runtime rejects it but accepts a request without a cache option, restoring requests on Cloudflare Workers, including older compatibility dates and cache_option_disabled configurations that reject every explicit cache mode. Supporting runtimes retain the explicit default to protect against Object.prototype pollution, and caller-supplied cache options remain unchanged. (#11194, closes #11192)
Interceptor storage: Removed trailing interceptor tombstones after ejection so repeated register-then-eject cycles no longer grow the handlers array, while preserving its public array shape, interceptor iteration behavior, and interceptor ID identity across registrations. (#11070)

Documentation

Global search: Added localized, private, in-browser full-text search for the active documentation language, with fuzzy and prefix matching.