build(deps): bump the patch-and-minor group across 1 directory with 23 updates

[dependabot]

Bumps the patch-and-minor group with 23 updates in the /web directory:

Package	From	To
@ant-design/icons	6.2.2	6.3.2
@ant-design/x	2.7.0	2.9.0
@ant-design/x-markdown	2.7.0	2.9.0
@ant-design/x-sdk	2.7.0	2.9.0
antd	6.3.7	6.5.4
axios	1.16.0	1.19.0
casdoor-js-sdk	0.19.0	0.20.0
i18next	26.0.8	26.3.6
react	19.2.5	19.2.8
@types/react	19.2.14	19.2.18
react-dom	19.2.5	19.2.8
@types/react-dom	19.2.3	19.2.4
react-i18next	17.0.6	17.0.11
react-router-dom	7.14.2	7.18.2
zustand	5.0.12	5.0.14
@testing-library/user-event	14.6.1	14.6.3
@vitejs/plugin-react	6.0.1	6.0.5
eslint	10.3.0	10.8.1
eslint-plugin-react-refresh	0.5.2	0.5.3
globals	17.6.0	17.9.0
typescript-eslint	8.59.1	8.66.0
vite	8.0.10	8.2.1
vitest	4.1.5	4.1.10

Updates @ant-design/icons from 6.2.2 to 6.3.2

Commits

• See full diff in compare view

Updates @ant-design/x from 2.7.0 to 2.9.0

Changelog

Sourced from @​ant-design/x's changelog.

2.9.0

2026-07-23

@​ant-design/x

• 🆕 Added useMobile hook, providing an SSR-safe way to detect mobile devices. #1945 by Mickey
• 🆕 Think and ThoughtChain add a destroyOnHidden prop to automatically destroy the DOM node when content is hidden. #1985 by wryyyds7
• 💄 Actions Feedback no longer renders Tooltip on mobile devices to avoid interaction interference. #1945 by Mickey
• 💄 Conversations now always shows the menu icon on mobile devices (no hover state on mobile). #1945 by Mickey
• 🐛 Improved click responsiveness for Actions, Conversations and other components on mobile by adding touch-action: manipulation to eliminate the 300ms click delay. #1945 by Mickey
• 🐛 Fix Sources CarouselCard not syncing its carousel index when the controlled activeKey changes; the left/right buttons now jump precisely via goTo and edge-button no-ops are fixed. #1945 by Mickey
• 🐛 Fix Sender speech input (useSpeech) not cleaning up SpeechRecognition on unmount, which caused state updates on an unmounted component. #1945 by Mickey
• 🐛 Fix CodeHighlighter not calling registerLanguage after async language loading, which prevented syntax highlighting from working; also fix the code block background not stretching fully during horizontal scroll. #1945 by Mickey
• 🐛 Fix Sender still showing the outer outline on focus in borderless mode. #1963 by QDyanbing
• 🐛 Fix Sender content type slots bypassing formatResult; all slot types (including content) now honor formatResult uniformly, with the DOM text used as the input value for content slots. #1986 by wenzeyu8888-rgb
• 🐛 Fix Suggestion popup not scrolling when there are many options; the popup now scrolls internally (overflow-y: auto) once content exceeds the max height (256px). #1983 by wenzeyu8888-rgb
• 🐛 Fix Sender agent tag label wrapping in agent mode; it now renders inline. #1990 by cc-hearts

@​ant-design/x-markdown

• 🐛 Fix XMarkdown performing an O(N²) code-block scan during streaming that froze the page on long content. #1972 by Div627

@​ant-design/x-sdk

• 🐛 Fix XStream not releasing the reader lock or canceling the underlying stream on early exit (loop break / incomplete read), avoiding resource leaks and dangling read requests. #1970 by Mickey

@​ant-design/x-skill

• 🐛 Fix the x-skill ora spinner (loader) failing to load in CJS environments; the loader instance is now cached and loaded via dynamic import, avoiding duplicate loads and initialization errors. #1980 by jay666mnj

Others

• 📖 Improve site page title composition: separate subtitle and title with a space to avoid concatenated wording. #1959 by Mickey
• 📖 Add a note in the FAQ recommending Antdv Next X for Vue users. #1966 by QDyanbing
• 📖 Unify the semantic DOM heading wording on the Chinese site. #1877 by Rain120
• 🛠 Hide the focus outline on the Component Overview search box. #1987 by QDyanbing

2.8.0

2026-06-08

@​ant-design/x

• 🆕 Folder component adds a right-click context menu. #1919 by Mickey
• 🐛 Fix FileCard.List scroll button state not refreshing when items update. #1914 by Ryker_Feng
• 🐛 Fix Sender runtime-inserted slots being cleared when the slotConfig ref changes. #1900 by pikanohup
• 🐛 Fix design token type coercion before arithmetic operations. #1910 by Div627

@​ant-design/x-markdown

... (truncated)

Commits

• 13afbf4 Merge pull request #1991 from ant-design/chore/changelog-2.9.0
• 5892920 test: update demo snapshots
• b22ee17 Merge branch 'main' into chore/changelog-2.9.0
• 002ec52 chore: bump version to 2.9.0
• d6c6808 chore: merge unreleased 2.8.1 changelog into 2.9.0
• 018276b chore: set 2.9.0 release date to 2026-07-23
• 93c44e1 chore: add newly merged PRs to 2.9.0 changelog
• f17d4ec Merge pull request #1980 from jay666mnj/fix-x-skill-ora-cjs
• 3f1aa9f Merge pull request #1877 from Rain120/feature/docs-unified_semantic
• b6cdd2b Merge branch 'main' into fix-x-skill-ora-cjs
• Additional commits viewable in compare view

Updates @ant-design/x-markdown from 2.7.0 to 2.9.0

Changelog

Sourced from @​ant-design/x-markdown's changelog.

2.9.0

2026-07-23

@​ant-design/x

• 🆕 Added useMobile hook, providing an SSR-safe way to detect mobile devices. #1945 by Mickey
• 🆕 Think and ThoughtChain add a destroyOnHidden prop to automatically destroy the DOM node when content is hidden. #1985 by wryyyds7
• 💄 Actions Feedback no longer renders Tooltip on mobile devices to avoid interaction interference. #1945 by Mickey
• 💄 Conversations now always shows the menu icon on mobile devices (no hover state on mobile). #1945 by Mickey
• 🐛 Improved click responsiveness for Actions, Conversations and other components on mobile by adding touch-action: manipulation to eliminate the 300ms click delay. #1945 by Mickey
• 🐛 Fix Sources CarouselCard not syncing its carousel index when the controlled activeKey changes; the left/right buttons now jump precisely via goTo and edge-button no-ops are fixed. #1945 by Mickey
• 🐛 Fix Sender speech input (useSpeech) not cleaning up SpeechRecognition on unmount, which caused state updates on an unmounted component. #1945 by Mickey
• 🐛 Fix CodeHighlighter not calling registerLanguage after async language loading, which prevented syntax highlighting from working; also fix the code block background not stretching fully during horizontal scroll. #1945 by Mickey
• 🐛 Fix Sender still showing the outer outline on focus in borderless mode. #1963 by QDyanbing
• 🐛 Fix Sender content type slots bypassing formatResult; all slot types (including content) now honor formatResult uniformly, with the DOM text used as the input value for content slots. #1986 by wenzeyu8888-rgb
• 🐛 Fix Suggestion popup not scrolling when there are many options; the popup now scrolls internally (overflow-y: auto) once content exceeds the max height (256px). #1983 by wenzeyu8888-rgb
• 🐛 Fix Sender agent tag label wrapping in agent mode; it now renders inline. #1990 by cc-hearts

@​ant-design/x-markdown

• 🐛 Fix XMarkdown performing an O(N²) code-block scan during streaming that froze the page on long content. #1972 by Div627

@​ant-design/x-sdk

• 🐛 Fix XStream not releasing the reader lock or canceling the underlying stream on early exit (loop break / incomplete read), avoiding resource leaks and dangling read requests. #1970 by Mickey

@​ant-design/x-skill

• 🐛 Fix the x-skill ora spinner (loader) failing to load in CJS environments; the loader instance is now cached and loaded via dynamic import, avoiding duplicate loads and initialization errors. #1980 by jay666mnj

Others

• 📖 Improve site page title composition: separate subtitle and title with a space to avoid concatenated wording. #1959 by Mickey
• 📖 Add a note in the FAQ recommending Antdv Next X for Vue users. #1966 by QDyanbing
• 📖 Unify the semantic DOM heading wording on the Chinese site. #1877 by Rain120
• 🛠 Hide the focus outline on the Component Overview search box. #1987 by QDyanbing

2.8.0

2026-06-08

@​ant-design/x

• 🆕 Folder component adds a right-click context menu. #1919 by Mickey
• 🐛 Fix FileCard.List scroll button state not refreshing when items update. #1914 by Ryker_Feng
• 🐛 Fix Sender runtime-inserted slots being cleared when the slotConfig ref changes. #1900 by pikanohup
• 🐛 Fix design token type coercion before arithmetic operations. #1910 by Div627

@​ant-design/x-markdown

... (truncated)

Commits

• 13afbf4 Merge pull request #1991 from ant-design/chore/changelog-2.9.0
• 5892920 test: update demo snapshots
• b22ee17 Merge branch 'main' into chore/changelog-2.9.0
• 002ec52 chore: bump version to 2.9.0
• d6c6808 chore: merge unreleased 2.8.1 changelog into 2.9.0
• 018276b chore: set 2.9.0 release date to 2026-07-23
• 93c44e1 chore: add newly merged PRs to 2.9.0 changelog
• f17d4ec Merge pull request #1980 from jay666mnj/fix-x-skill-ora-cjs
• 3f1aa9f Merge pull request #1877 from Rain120/feature/docs-unified_semantic
• b6cdd2b Merge branch 'main' into fix-x-skill-ora-cjs
• Additional commits viewable in compare view

Updates @ant-design/x-sdk from 2.7.0 to 2.9.0

Changelog

Sourced from @​ant-design/x-sdk's changelog.

2.9.0

2026-07-23

@​ant-design/x

• 🆕 Added useMobile hook, providing an SSR-safe way to detect mobile devices. #1945 by Mickey
• 🆕 Think and ThoughtChain add a destroyOnHidden prop to automatically destroy the DOM node when content is hidden. #1985 by wryyyds7
• 💄 Actions Feedback no longer renders Tooltip on mobile devices to avoid interaction interference. #1945 by Mickey
• 💄 Conversations now always shows the menu icon on mobile devices (no hover state on mobile). #1945 by Mickey
• 🐛 Improved click responsiveness for Actions, Conversations and other components on mobile by adding touch-action: manipulation to eliminate the 300ms click delay. #1945 by Mickey
• 🐛 Fix Sources CarouselCard not syncing its carousel index when the controlled activeKey changes; the left/right buttons now jump precisely via goTo and edge-button no-ops are fixed. #1945 by Mickey
• 🐛 Fix Sender speech input (useSpeech) not cleaning up SpeechRecognition on unmount, which caused state updates on an unmounted component. #1945 by Mickey
• 🐛 Fix CodeHighlighter not calling registerLanguage after async language loading, which prevented syntax highlighting from working; also fix the code block background not stretching fully during horizontal scroll. #1945 by Mickey
• 🐛 Fix Sender still showing the outer outline on focus in borderless mode. #1963 by QDyanbing
• 🐛 Fix Sender content type slots bypassing formatResult; all slot types (including content) now honor formatResult uniformly, with the DOM text used as the input value for content slots. #1986 by wenzeyu8888-rgb
• 🐛 Fix Suggestion popup not scrolling when there are many options; the popup now scrolls internally (overflow-y: auto) once content exceeds the max height (256px). #1983 by wenzeyu8888-rgb
• 🐛 Fix Sender agent tag label wrapping in agent mode; it now renders inline. #1990 by cc-hearts

@​ant-design/x-markdown

• 🐛 Fix XMarkdown performing an O(N²) code-block scan during streaming that froze the page on long content. #1972 by Div627

@​ant-design/x-sdk

• 🐛 Fix XStream not releasing the reader lock or canceling the underlying stream on early exit (loop break / incomplete read), avoiding resource leaks and dangling read requests. #1970 by Mickey

@​ant-design/x-skill

• 🐛 Fix the x-skill ora spinner (loader) failing to load in CJS environments; the loader instance is now cached and loaded via dynamic import, avoiding duplicate loads and initialization errors. #1980 by jay666mnj

Others

• 📖 Improve site page title composition: separate subtitle and title with a space to avoid concatenated wording. #1959 by Mickey
• 📖 Add a note in the FAQ recommending Antdv Next X for Vue users. #1966 by QDyanbing
• 📖 Unify the semantic DOM heading wording on the Chinese site. #1877 by Rain120
• 🛠 Hide the focus outline on the Component Overview search box. #1987 by QDyanbing

2.8.0

2026-06-08

@​ant-design/x

• 🆕 Folder component adds a right-click context menu. #1919 by Mickey
• 🐛 Fix FileCard.List scroll button state not refreshing when items update. #1914 by Ryker_Feng
• 🐛 Fix Sender runtime-inserted slots being cleared when the slotConfig ref changes. #1900 by pikanohup
• 🐛 Fix design token type coercion before arithmetic operations. #1910 by Div627

@​ant-design/x-markdown

... (truncated)

Commits

• 13afbf4 Merge pull request #1991 from ant-design/chore/changelog-2.9.0
• 5892920 test: update demo snapshots
• b22ee17 Merge branch 'main' into chore/changelog-2.9.0
• 002ec52 chore: bump version to 2.9.0
• d6c6808 chore: merge unreleased 2.8.1 changelog into 2.9.0
• 018276b chore: set 2.9.0 release date to 2026-07-23
• 93c44e1 chore: add newly merged PRs to 2.9.0 changelog
• f17d4ec Merge pull request #1980 from jay666mnj/fix-x-skill-ora-cjs
• 3f1aa9f Merge pull request #1877 from Rain120/feature/docs-unified_semantic
• b6cdd2b Merge branch 'main' into fix-x-skill-ora-cjs
• Additional commits viewable in compare view

Updates antd from 6.3.7 to 6.5.4

Release notes

Sourced from antd's releases.

6.5.4

• 🐞 Fix Alert not showing the close button when the closable configuration object only contains onClose. #58885 @​QDyanbing
• 🐞 Fix Checkbox.Group crashing when options contains nullish entries or values. #58879 @​GuillaumeZ2SS
• 🐞 Fix App emitting an unnecessary CSS variable warning with component={false}, while warning when root props cannot be applied in this mode. #58877 @​li-jia-nan
• 🐞 Fix Table selecting disabled rows on other pages when selecting all data. #58843 @​QDyanbing
• 🐞 Fix Transfer deselect-all behavior after filtering. #58844 @​thlovey
• 🐞 Fix DatePicker RangePicker semantic callbacks not receiving forwarded props. #58905 @​QDyanbing
• 💄 Fix FloatButton.BackTop scroll animation not respecting prefers-reduced-motion. #58849 @​li-jia-nan
• 💄 Fix bare <svg> icons from third-party icon libraries being misaligned, missing spacing, or breaking onto separate lines in Breadcrumb, Collapse, Segmented, Tabs, and Tag. #58862 #58868 #58869 #58870 @​mohamedkhaled4053
• 💄 Fix AutoComplete disabled text not using the disabled text color. #58838 @​lazerg
• 🤖 Fix Tour exposing unusable per-step indicatorsRender and actionsRender TypeScript definitions. #58859 @​lazerg

---

• 🐞 修复 Alert 的 closable 配置对象仅包含 onClose 时不显示关闭按钮的问题。#58885 @​QDyanbing
• 🐞 修复 Checkbox.Group 的 options 包含空值选项或空值 value 时崩溃的问题。#58879 @​GuillaumeZ2SS
• 🐞 修复 App 使用 component={false} 时产生不必要的 CSS 变量警告，并在此模式下无法应用根节点属性时给出提示。#58877 @​li-jia-nan
• 🐞 修复 Table 全选数据时仍会选中其他分页中禁用行的问题。#58843 @​QDyanbing
• 🐞 修复 Transfer 筛选后取消全选行为异常的问题。#58844 @​thlovey
• 🐞 修复 DatePicker RangePicker 语义化回调未透传 props 的问题。#58905 @​QDyanbing
• 💄 修复 FloatButton.BackTop 滚动动画未遵循 prefers-reduced-motion 设置的问题。#58849 @​li-jia-nan
• 💄 修复 Breadcrumb、Collapse、Segmented、Tabs 和 Tag 使用第三方图标库的原生 <svg> 图标时可能出现对齐异常、间距缺失，或在 CSS reset 下换行的问题。#58862 #58868 #58869 #58870 @​mohamedkhaled4053
• 💄 修复 AutoComplete 禁用状态下文本未使用禁用文字颜色的问题。#58838 @​lazerg
• 🤖 修复 Tour 暴露无法在单个步骤中使用的 indicatorsRender 和 actionsRender TypeScript 类型定义的问题。#58859 @​lazerg

6.5.3

• Input
  • 🐞 Fix Input.OTP using type="text" when mask is a string while preserving explicit type values. #58835 @​QDyanbing
  • 🐞 Fix Input.OTP displaying the original value when mask is true. #58805 @​cyphercodes
  • 💄 Fix Input.TextArea resize handle rendering as a dot on touch devices. #58812 @​pupuking723
• Typography
  • ⚡️ Improve Typography ellipsis tooltip performance in large lists. #58806 @​lkxdsb
  • 🐞 Fix Typography editable textarea font size not matching the edited content. #58551 @​gaurav0107
• 🐞 Fix DatePicker.RangePicker submitting unconfirmed partial values on blur when using showTime and allowEmpty. #58803 @​zombieJ
• 🐞 Fix Form.Item useStatus returning stale errors and warnings when the validation status remains unchanged. #58815 @​afc163
• 🐞 Fix Slider triggering onFocus and onBlur callbacks multiple times. #58711 @​QDyanbing
• 🐞 Fix Spin standalone indicators being mispositioned when nested in another Spin. #58801 @​QDyanbing
• 🐞 Fix Table controlled filter dropdown selections not updating while open. #58816 @​afc163
• 🐞 Fix Upload default download links allowing newly opened tabs to access the opener page. #58817 @​afc163
• 💄 Fix incomplete Icon base styles when theme.zeroRuntime or CSS layers are enabled. #58763 @​QDyanbing
• 💄 Fix Select suffix icons and selected content overlapping the clear icon with custom theme colors. #58581 @​QDyanbing
• 💄 Fix Tabs third-party <svg> icons not vertically aligning with labels. #58847 @​mohamedkhaled4053

---

• Input
  • 🐞 修复 Input.OTP 使用字符串 mask 时仍采用 type="text" 的问题，并保留显式 type 配置。#58835 @​QDyanbing
  • 🐞 修复 Input.OTP 的 mask 为 true 时仍显示原始值的问题。#58805 @​cyphercodes
  • 💄 修复 Input.TextArea 调整大小手柄在触摸设备上显示为小圆点的问题。#58812 @​pupuking723
• Typography
  • ⚡️ 优化 Typography 省略提示在大列表中的渲染性能。#58806 @​lkxdsb
  • 🐞 修复 Typography 可编辑文本框字号与被编辑内容不一致的问题。#58551 @​gaurav0107
• 🐞 修复 DatePicker.RangePicker 使用 showTime 和 allowEmpty 时失焦会提交未确认部分值的问题。#58803 @​zombieJ
• 🐞 修复 Form.Item useStatus 在校验状态未变化时返回旧错误和警告内容的问题。#58815 @​afc163

... (truncated)

Changelog

Sourced from antd's changelog.

6.5.4

2026-08-07

• 🐞 Fix Alert not showing the close button when the closable configuration object only contains onClose. #58885 @​QDyanbing
• 🐞 Fix Checkbox.Group crashing when options contains nullish entries or values. #58879 @​GuillaumeZ2SS
• 🐞 Fix App emitting an unnecessary CSS variable warning with component={false}, while warning when root props cannot be applied in this mode. #58877 @​li-jia-nan
• 🐞 Fix Table selecting disabled rows on other pages when selecting all data. #58843 @​QDyanbing
• 🐞 Fix Transfer deselect-all behavior after filtering. #58844 @​thlovey
• 🐞 Fix DatePicker RangePicker semantic callbacks not receiving forwarded props. #58905 @​QDyanbing
• 💄 Fix FloatButton.BackTop scroll animation not respecting prefers-reduced-motion. #58849 @​li-jia-nan
• 💄 Fix bare <svg> icons from third-party icon libraries being misaligned, missing spacing, or breaking onto separate lines in Breadcrumb, Collapse, Segmented, Tabs, and Tag. #58862 #58868 #58869 #58870 @​mohamedkhaled4053
• 💄 Fix AutoComplete disabled text not using the disabled text color. #58838 @​lazerg
• 🤖 Fix Tour exposing unusable per-step indicatorsRender and actionsRender TypeScript definitions. #58859 @​lazerg

6.5.3

2026-07-31

• Input
  • 🐞 Fix Input.OTP using type="text" when mask is a string while preserving explicit type values. #58835 @​QDyanbing
  • 🐞 Fix Input.OTP displaying the original value when mask is true. #58805 @​cyphercodes
  • 💄 Fix Input.TextArea resize handle rendering as a dot on touch devices. #58812 @​pupuking723
• Typography
  • ⚡️ Improve Typography ellipsis tooltip performance in large lists. #58806 @​lkxdsb
  • 🐞 Fix Typography editable textarea font size not matching the edited content. #58551 @​gaurav0107
• 🐞 Fix DatePicker.RangePicker submitting unconfirmed partial values on blur when using showTime and allowEmpty. #58803 @​zombieJ
• 🐞 Fix Form.Item useStatus returning stale errors and warnings when the validation status remains unchanged. #58815 @​afc163
• 🐞 Fix Slider triggering onFocus and onBlur callbacks multiple times. #58711 @​QDyanbing
• 🐞 Fix Spin standalone indicators being mispositioned when nested in another Spin. #58801 @​QDyanbing
• 🐞 Fix Table controlled filter dropdown selections not updating while open. #58816 @​afc163
• 🐞 Fix Upload default download links allowing newly opened tabs to access the opener page. #58817 @​afc163
• 💄 Fix incomplete Icon base styles when theme.zeroRuntime or CSS layers are enabled. #58763 @​QDyanbing
• 💄 Fix Select suffix icons and selected content overlapping the clear icon with custom theme colors. #58581 @​QDyanbing
• 💄 Fix Tabs third-party <svg> icons not vertically aligning with labels. #58847 @​mohamedkhaled4053

6.5.2

2026-07-24

• 💄 Fix Button, Collapse, ColorPicker, Layout, Select, Space.Addon, Tree, and Typography borders not respecting the global lineWidth and lineType Design Tokens. #58740 #58741 #58742 #58743 #58745 #58755 @​li-jia-nan @​QDyanbing
• 🐞 Fix BorderBeam, Checkbox, and Switch reduced-motion styles causing Lightning CSS minification failures. #58707 @​QDyanbing
• Tag
  • 💄 Fix Tag missing spacing and incorrect vertical alignment for bare <svg> icons from third-party icon libraries. #58723 @​mohamedkhaled4053
  • 🐞 Fix Tag navigation being triggered when clicking the close icon with both href and closable set. #58720 @​QDyanbing
• 🐞 Fix Input.OTP dropping root DOM event handlers including onPointerDown, onAnimationEnd, onTransitionEnd, and onScrollEnd. #58697 react-component/util#794 @​aojunhao123
• 🐞 Fix Form triggering a hook-order warning in React 19 when using the UMD development build. #58417 @​biubiukam
• 💄 Fix Table missing the top border when a bordered nested table is wrapped by Tabs or custom content. #58746 @​QDyanbing
• 🐞 Fix Input.Search custom enterButton not respecting the component's disabled and loading states. #58726 @​QDyanbing
• 🐞 Fix Transfer custom action buttons passed through actions not preserving their own disabled state. #58718 @​QDyanbing

... (truncated)

Commits

• 5ade994 docs: fix grammar in detail page spec (#58908)
• c514396 docs: add changelog 6.5.4 (#58904)
• 01055a7 fix(DatePicker): pass props to RangePicker semantic callbacks (#58905)
• 0d0b6b7 docs: fix typos in code comment and docs (#58901)
• cd2c5c8 refactor(utils): centralize guards function (#58897)
• cd54cc8 chore(deps): update dependency @​types/css-tree to v3 (#58893)
• e1f247d fix(Tour): remove unusable per-step indicatorsRender/actionsRender types (#58...
• 1a4b06c docs: subject-verb agreement in ComponentTokenTable locale (#58891)
• 5040df9 fix(Alert): show close button when closable contains onClose (#58885)
• 3910e70 fix(Checkbox): filter out Checkbox.Group options with nullish values (#58879)
• Additional commits viewable in compare view

Updates axios from 1.16.0 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)
• @​Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (<...

  Description has been truncated