Skip to content
This repository was archived by the owner on Aug 24, 2026. It is now read-only.

Bump axios, @alcalzone/release-script and @iobroker/dev-server - #122

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-bdd7634ef1
Closed

Bump axios, @alcalzone/release-script and @iobroker/dev-server#122
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-bdd7634ef1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 4, 2026

Copy link
Copy Markdown
Contributor

Bumps axios, @alcalzone/release-script and @iobroker/dev-server. These dependencies needed to be updated together.
Updates axios from 0.27.2 to 1.17.0

Release notes

Sourced from axios's releases.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Changelog

Sourced from axios's changelog.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @alcalzone/release-script from 3.5.9 to 3.8.0

Release notes

Sourced from @​alcalzone/release-script's releases.

Release v3.8.0

  • git plugin: allow to skip push stage via noPush option

Release v3.7.3

  • package plugin: Support monorepos managed with Yarn v4

Release v3.7.2

  • iobroker plugin: Fixed issue in changelog cleanup routine introduced in 3.7.1

Release v3.7.1

  • iobroker plugin: Detect more author names and @ mentions in the changelog

Release v3.7.0

  • Added -lf option to run the lock file update with the --force flag
  • Dependency upgrades

Release v3.6.0

  • git plugin: Add the --tagOnly flag to only create a tag without pushing the commit to the release branch.
Changelog

Sourced from @​alcalzone/release-script's changelog.

3.8.0 (2024-07-23)

  • git plugin: allow to skip push stage via noPush option

3.7.3 (2024-07-05)

  • package plugin: Support monorepos managed with Yarn v4

3.7.2 (2024-06-24)

  • iobroker plugin: Fixed issue in changelog cleanup routine introduced in 3.7.1

3.7.1 (2024-06-12)

  • iobroker plugin: Detect more author names and @ mentions in the changelog

3.7.0 (2023-11-29)

  • Added -lf option to run the lock file update with the --force flag
  • Dependency upgrades

3.6.0 (2023-07-03)

  • git plugin: Add the --tagOnly flag to only create a tag without pushing the commit to the release branch.
Commits

Updates @iobroker/dev-server from 0.5.0 to 0.8.0

Release notes

Sourced from @​iobroker/dev-server's releases.

Release v0.8.0

  • (@Apollon77/@​copilot) Fix git repository check to prevent errors in non-git directories
  • (@Apollon77/@​copilot) Fix version check to honor npm "latest" tag instead of jsDelivr
  • (@Apollon77/@​copilot) Add support for TypeScript-only adapters where main field points to .ts files
  • (@Apollon77/@​copilot) Add support for TypeScript-only adapters where main field points to .ts files
  • (@Apollon77/@​copilot) Add --no-browser-sync flag to run and watch commands for environments where BrowserSync causes issues
  • (@Apollon77/@​bolliy) Add support for ESM modules with .mjs file extensions

Release v0.7.8

Release v0.7.7

Release v0.7.6

Release v0.7.5

Release v0.7.4

Release v0.7.3

  • (foxriver76) set activeRepo as an array as it is intended

Release v0.7.2

  • (stevenengland) Add support for jsonconfig json5 files hot reload

Release v0.7.1

  • (Apollon77) downgrade boxen again to fix problems with it

Release v0.7.0

  • (AlCalzone/Garfonso) symlink the local adapter instead of pack/install on each change
  • (Apollon77) Update dependencies

Release v0.6.0

  • (Apollon77) Add option --doNotWatch for "watch" mode to ignore changes on defined files or locations
  • (Apollon77/kleinOr) Set several other system settings on "setup" call like the location, currency, language and temperature unit that they are not empty
  • (Apollon77) Only send SIGINT on exit first and then SIGKILL after 5 seconds if not yet exited to allow clean shutdown of all components
  • (Apollon77) Make sure initial file sync is finished before starting adapter (incl. a short static delay to make sure all is persisted before start watching)
  • (Apollon77) Wait that js-controller DB ports are available before starting adapter
  • (Apollon77) User 127.0.0.1 instead of localhost to avoid DNS lookup issues with Node.js 18 (looks up IPv6 by default)
Changelog

Sourced from @​iobroker/dev-server's changelog.

0.8.0 (2025-09-20)

  • (@Apollon77/@​copilot) Fix git repository check to prevent errors in non-git directories
  • (@Apollon77/@​copilot) Fix version check to honor npm "latest" tag instead of jsDelivr
  • (@Apollon77/@​copilot) Add support for TypeScript-only adapters where main field points to .ts files
  • (@Apollon77/@​copilot) Add support for TypeScript-only adapters where main field points to .ts files
  • (@Apollon77/@​copilot) Add --no-browser-sync flag to run and watch commands for environments where BrowserSync causes issues
  • (@Apollon77/@​bolliy) Add support for ESM modules with .mjs file extensions

0.7.8 (2025-01-29)

0.7.7 (2025-01-27)

0.7.6 (2025-01-25)

0.7.3 (2024-05-02)

  • (foxriver76) set activeRepo as an array as it is intended

0.7.2 (2024-03-26)

  • (stevenengland) Add support for jsonConfig json5 files hot reload

0.7.1 (2023-11-09)

  • (Apollon77) downgrade boxen again to fix problems with it

0.7.0 (2023-11-09)

  • (AlCalzone/Garfonso) symlink the local adapter instead of pack/install on each change
  • (Apollon77) Update dependencies

0.6.0 (2022-10-02)

  • (Apollon77) Add option --doNotWatch for "watch" mode to ignore changes on defined files or locations
  • (Apollon77/kleinOr) Set several other system settings on "setup" call like the location, currency, language and temperature unit that they are not empty
  • (Apollon77) Only send SIGINT on exit first and then SIGKILL after 5 seconds if not yet exited to allow clean shutdown of all components
  • (Apollon77) Make sure initial file sync is finished before starting adapter (incl. a short static delay to make sure all is persisted before start watching)
  • (Apollon77) Wait that js-controller DB ports are available before starting adapter
  • (Apollon77) User 127.0.0.1 instead of localhost to avoid DNS lookup issues with Node.js 18 (looks up IPv6 by default)
Commits
  • bfbaef5 chore: release v0.8.0
  • 3c5d412 prepare release
  • 7f746a5 Merge pull request #504 from ioBroker/copilot/fix-427
  • 51b9677 Simplify git repository check and add changelog entry
  • f6961ee Fix git repository check to prevent errors in non-git directories
  • 1f0b378 Initial plan
  • 9d8bf40 Merge pull request #502 from ioBroker/copilot/fix-501
  • 17b2da1 Update build output and package-lock after merge
  • 5721228 Merge main branch and resolve indentation conflicts
  • 99da4ab Delete .editorconfig
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump axios, @alcalzone/release-script and @iobroker/dev-server
38a7dc1 
Bumps [axios](https://github.com/axios/axios), [@alcalzone/release-script](https://github.com/AlCalzone/release-script) and [@iobroker/dev-server](https://github.com/ioBroker/dev-server). These dependencies needed to be updated together.

Updates `axios` from 0.27.2 to 1.17.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.27.2...v1.17.0)

Updates `@alcalzone/release-script` from 3.5.9 to 3.8.0
- [Release notes](https://github.com/AlCalzone/release-script/releases)
- [Changelog](https://github.com/AlCalzone/release-script/blob/master/CHANGELOG.md)
- [Commits](AlCalzone/release-script@v3.5.9...v3.8.0)

Updates `@iobroker/dev-server` from 0.5.0 to 0.8.0
- [Release notes](https://github.com/ioBroker/dev-server/releases)
- [Changelog](https://github.com/ioBroker/dev-server/blob/main/CHANGELOG.md)
- [Commits](ioBroker/dev-server@v0.5.0...v0.8.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.17.0
  dependency-type: direct:development
- dependency-name: "@alcalzone/release-script"
  dependency-version: 3.8.0
  dependency-type: direct:development
- dependency-name: "@iobroker/dev-server"
  dependency-version: 0.8.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 4, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: xXBJXx. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot mentioned this pull request Jun 4, 2026
Closed
@DutchmanNL

DutchmanNL commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Not needed anymore - this repository is archived.

@DutchmanNL DutchmanNL closed this Aug 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-bdd7634ef1 branch August 24, 2026 10:43
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DutchmanNL