chore(deps): bump the minor-versions group across 5 directories with 61 updates

[dependabot]

Bumps the minor-versions group with 35 updates in the / directory:

Package	From	To
commitizen	4.3.1	4.3.2
react	19.2.3	19.2.7
@types/react	19.2.7	19.2.17
react-test-renderer	19.2.3	19.2.7
wait-on	9.0.5	9.0.10
@bloom-housing/ui-seeds	3.4.1	3.4.3
@mapbox/mapbox-sdk	0.13.7	0.16.2
@vis.gl/react-google-maps	1.7.1	1.9.0
autoprefixer	10.4.20	10.5.2
dayjs	1.11.13	1.11.21
dotenv	17.2.3	17.4.2
mapbox-gl	3.16.0	3.26.0
qs	6.15.2	6.15.3
react-dom	19.2.3	19.2.7
react-google-recaptcha-v3	1.10.1	1.11.0
react-map-gl	8.1.0	8.1.1
@testing-library/dom	10.4.0	10.4.1
@testing-library/jest-dom	6.6.3	6.9.1
@testing-library/react	16.2.0	16.3.2
cypress	15.18.0	15.18.1
postcss	8.5.14	8.5.16
sass	1.93.3	1.101.0
ts-loader	9.5.2	9.6.2
webpack	5.107.2	5.108.4
@tiptap/core	3.23.6	3.27.3
@tiptap/extension-character-count	3.23.6	3.27.3
@tiptap/react	3.23.6	3.27.3
@tiptap/starter-kit	3.23.6	3.27.3
swr	2.2.5	2.4.2
@types/mapbox__mapbox-sdk	0.13.11	0.16.5
@opentelemetry/api	1.9.0	1.9.1
@opentelemetry/exporter-metrics-otlp-grpc	0.215.0	0.220.0
@opentelemetry/sdk-node	0.218.0	0.220.0
@opentelemetry/semantic-conventions	1.40.0	1.43.0
@google-cloud/translate	9.2.0	9.4.2
react-dom	19.2.3	19.2.7

Bumps the minor-versions group with 31 updates in the /api directory:

Package	From	To
ts-jest	29.1.1	29.4.11
ts-node	10.9.1	10.9.2
axios	1.16.0	1.18.1
dayjs	1.11.9	1.11.21
dotenv	17.2.3	17.4.2
qs	6.15.2	6.15.3
ts-loader	9.5.2	9.6.2
webpack	5.105.2	5.108.4
@opentelemetry/exporter-metrics-otlp-grpc	0.218.0	0.220.0
@opentelemetry/sdk-node	0.218.0	0.220.0
@opentelemetry/semantic-conventions	1.41.1	1.43.0
@google-cloud/translate	9.4.1	9.4.2
@aws-sdk/client-pinpoint-sms-voice-v2	3.1070.0	3.1084.0
@aws-sdk/client-s3	3.1003.0	3.1084.0
@aws-sdk/client-sesv2	3.1003.0	3.1084.0
@aws-sdk/lib-storage	3.1003.0	3.1084.0
@aws-sdk/rds-signer	3.1003.0	3.1084.0
@aws-sdk/s3-request-presigner	3.1003.0	3.1084.0
@google-cloud/recaptcha-enterprise	6.4.1	6.4.2
casbin	5.27.1	5.51.1
class-validator	0.14.0	0.15.1
compression	1.7.4	1.8.1
@types/compression	1.7.5	1.8.1
cookie-parser	1.4.6	1.4.7
jsonwebtoken	9.0.2	9.0.3
passport	0.6.0	0.7.0
pg	8.17.2	8.22.0
reflect-metadata	0.1.13	0.2.2
rxjs	7.8.1	7.8.2
sanitize-html	2.17.4	2.17.5
@types/exceljs	1.3.0	1.3.2

Bumps the minor-versions group with 7 updates in the /shared-helpers directory:

Package	From	To
react	19.2.3	19.2.7
react-test-renderer	19.2.3	19.2.7
@bloom-housing/ui-seeds	3.4.1	3.4.3
react-dom	19.2.3	19.2.7
@testing-library/react	16.3.0	16.3.2
@opentelemetry/exporter-metrics-otlp-grpc	0.215.0	0.220.0
@opentelemetry/sdk-node	0.218.0	0.220.0

Bumps the minor-versions group with 5 updates in the /sites/partners directory:

Package	From	To
react	19.2.3	19.2.7
@bloom-housing/ui-seeds	3.4.1	3.4.3
@mapbox/mapbox-sdk	0.13.7	0.16.2
react-dom	19.2.3	19.2.7
@types/mapbox__mapbox-sdk	0.13.11	0.16.5

Bumps the minor-versions group with 4 updates in the /sites/public directory: react, @bloom-housing/ui-seeds, @mapbox/mapbox-sdk and react-dom.

Updates commitizen from 4.3.1 to 4.3.2

Release notes

Sourced from commitizen's releases.

v4.3.2

4.3.2 (2026-06-12)

• chore(deps): bump semantic-release to 25 for npm trusted publishing (#1029) (6eb168c), closes #1029
• ci(release): bump actions/checkout and actions/setup-node to v4 (#1024) (f5702c4), closes #1024
• ci(release): use npm trusted publishing via OIDC (#1028) (096ed52), closes #1028
• chore(deps) Update all non-major dependencies (#1026) (4e98218), closes #1026
• chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#1010) (11be6a1), closes #1010
• fix(ci): fix pipelines and update matrices to node 18/20/22 (#1023) (48e4b8b), closes #1023
• docs: update README.md to add contributors (#985) (3c08866), closes #985

Commits

• 6eb168c chore(deps): bump semantic-release to 25 for npm trusted publishing (#1029)
• 096ed52 ci(release): use npm trusted publishing via OIDC (#1028)
• 4e98218 chore(deps) Update all non-major dependencies (#1026)
• f5702c4 ci(release): bump actions/checkout and actions/setup-node to v4 (#1024)
• 11be6a1 chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#1010)
• 48e4b8b fix(ci): fix pipelines and update matrices to node 18/20/22 (#1023)
• 3c08866 docs: update README.md to add contributors (#985)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for commitizen since your current version.

Updates react from 19.2.3 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

Commits

• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.7 to 19.2.17

Commits

• See full diff in compare view

Updates react-test-renderer from 19.2.3 to 19.2.7

Release notes

Sourced from react-test-renderer's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Changelog

Sourced from react-test-renderer's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

Commits

• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-test-renderer since your current version.

Updates wait-on from 9.0.5 to 9.0.10

Release notes

Sourced from wait-on's releases.

v9.0.10

Cleaned up unnecessary files from npm published package, added code coverage

Removed:

• .fastembed_cache
• .github
• .nyc_output
• coverage
• .editorconfig
• .nycrc.json
• .prettierrc.js
• eslint.config.mjs

Increased code coverage

Thanks @​aarongoldenthal

v9.0.6

Update minor deps for security vulnerabilities

• axios
  • follow-redirects
• joi

Commits

• 27d5744 9.0.10
• c7c97df correct .npmignore for .prettierrc.js
• c152252 9.0.9
• 95f01cd Merge pull request #210 from jeffbski/cleanup-more-npm-publish
• d45cff3 more npm publish cleanup
• bab38d2 9.0.8
• 0ab9473 Merge pull request #209 from jeffbski/exclude-coverage
• 881dfaa also exclude .nyc_output and coverage from npm
• e3dad37 9.0.7
• 5a681e5 Merge pull request #208 from jeffbski/exclude-fastembed-cache-from-npm-publish
• Additional commits viewable in compare view

Updates @bloom-housing/ui-seeds from 3.4.1 to 3.4.3

Release notes

Sourced from @​bloom-housing/ui-seeds's releases.

v3.4.3

3.4.3 (2026-04-22)

Bug Fixes

• ensure button loading states show in all variants (#153) (405f940)

v3.4.2

3.4.2 (2026-04-22)

Bug Fixes

• allow disabling live for loading state (#148) (09f8142)

Commits

• 405f940 fix: ensure button loading states show in all variants (#153)
• 09f8142 fix: allow disabling live for loading state (#148)
• See full diff in compare view

Updates @heroicons/react from 2.1.1 to 2.2.0

Release notes

Sourced from @​heroicons/react's releases.

v2.2.0

Added

• Add React 19 support (#1247)

Fixed

• Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

v2.1.5

Added

• Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

v2.1.4

Fixed

• Improve tree-shakability of React package (#1192)

v2.1.3

• Improve project READMEs (#1152)

v2.1.2

• Include license file with published packages (#1151)

Changelog

Sourced from @​heroicons/react's changelog.

[2.2.0] - 2024-11-18

Added

• Add React 19 support (#1247)

Fixed

• Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

[2.1.5] - 2024-07-10

Added

• Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

[2.1.4] - 2024-06-17

Fixed

• Improve tree-shakability of React package (#1192)

[2.1.3] - 2024-03-22

• Improve project READMEs (#1152)

[2.1.2] - 2024-03-22

• Include license file with published packages (#1151)

Commits

• 0435d4c 2.2.0
• f327cbe Add React 19 support (#1247)
• 56c073c Update changelog
• 64e2368 Remove clip-path from 20/arrow-left-circle (#1211)
• ad0ad1f 2.1.5
• 58d511e Add new icons (#1204)
• c1b192b 2.1.4
• e2e487f Make sure calls to forwardRef are marked as pure (#1192)
• cafc7d6 use size-* instead of w-* h-* (#1182)
• 9a17872 Update README.md (#1167)
• Additional commits viewable in compare view

Updates @mapbox/mapbox-sdk from 0.13.7 to 0.16.2

Release notes

Sourced from @​mapbox/mapbox-sdk's releases.

v0.16.2

0.16.2

• Addressed security issues CVE-2025-7783 and CVE-2022-25881

v0.16.1

0.16.1

• Add: Add session_token as optional parameter in the geocoding services

v0.15.16

0.15.6

• Add: Add secondary_address to list of accepted types for Geocoding v6

v0.15.4

No release notes provided.

Changelog

Sourced from @​mapbox/mapbox-sdk's changelog.

Changelog

0.16.1

• Add: Add session_token as optional parameter in the geocoding services

0.16.0

• Add: Add depart_at as optional parameter in the isochrone service

0.15.6

• Fix: Add secondary_address to list of accepted types for Geocoding v6

0.15.5

• Fix: Rename directions api annotation option max_speed to maxspeed #480

0.15.4

• Fix: Set body = '' for POST, PUT, PATCH, and DELETE requests that do not have a body #479

0.15.3

• Fix: Maximum Optimization V1 request size limits should not be enforced client-side

0.15.2

• Add: Add depart_at and arrive_by as optional parameters in the directions service

0.15.1

• Add: Add driving-traffic as a profile option in the isochrone service

0.15.0

• Add: Geocoding v6 service

0.14.0

• Add: Config for Tokens#createToken and Tokens#updateToken can now include the allowedApplications property.

Commits

• 8b8dc60 Merge pull request #502 from mapbox/max/CVE-2025-7783
• f897e42 [CVE-2025-7783] Upgrade form-data
• 12f5a42 Merge pull request #493 from mapbox/geocoding-sessionid
• 0e19cc9 docs, bump package version
• ae00cc5 change to token
• 19b012d add sessionId param to geocoding services
• 41c7da5 0.16.0
• d5a34be prepare v0.16.0
• eb8e804 Merge pull request #473 from mapbox/add-depart-at
• 1b5c24b Merge pull request #483 from mapbox/geocoding-v6-secondary-address
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by mbx-npm-07-production, a new releaser for @​mapbox/mapbox-sdk since your current version.

Updates @vis.gl/react-google-maps from 1.7.1 to 1.9.0

Release notes

Sourced from @​vis.gl/react-google-maps's releases.

v1.9.0

1.9.0 (2026-06-27)

Features

• add basic keyboard events for advanced marker (#1001) (af5ab1c)
• add map-3d-route example with 3D Map and custom route element (v=alpha) (#989) (4adb9e1)
• map-control: add className prop (#967) (37bfe46)

Bug Fixes

• build: don't build examples with library build (1b43288)
• handle externally-loaded importLibrary in loader (#1002) (f76ed12)
• hooks: add SafeReact and fallback for useInsertionEffect to ensure compatibility with React 16/17 (#1017) (1a503a8), closes #957
• map: don't crash when remounting with a broken cached map instance (#984) (31a5261), closes #982
• prevent api provider race condition, defer loading state update (#970) (7fd6efe)
• update dependencies and update importLibrary typings (#1019) (ef951c4)
• update gmp types (#973) (2f5c29c)
• use correct pointer events behaviour (#997) (538e918)

v1.8.3

1.8.3 (2026-04-09)

Bug Fixes

• hooks: avoid static useInsertionEffect imports (#960) (f2870c1)

v1.8.2

1.8.2 (2026-04-01)

Bug Fixes

• move vite back to devDependencies (#955) (d3535ac)

v1.8.1

1.8.1 (2026-03-27)

Bug Fixes

• hooks: add fallback to useLayoutEffect for React 16/17 compatibility (#950) (86ad8ee)

v1.8.0

1.8.0 (2026-03-26)

... (truncated)

Changelog

Sourced from @​vis.gl/react-google-maps's changelog.

1.9.0 (2026-06-27)

Features

• add basic keyboard events for advanced marker (#1001) (af5ab1c)
• add map-3d-route example with 3D Map and custom route element (v=alpha) (#989) (4adb9e1)
• map-control: add className prop (#967) (37bfe46)

Bug Fixes

• build: don't build examples with library build (1b43288)
• handle externally-loaded importLibrary in loader (#1002) (f76ed12)
• hooks: add SafeReact and fallback for useInsertionEffect to ensure compatibility with React 16/17 (#1017) (1a503a8), closes #957
• map: don't crash when remounting with a broken cached map instance (#984) (31a5261), closes #982
• prevent api provider race condition, defer loading state update (#970) (7fd6efe)
• update dependencies and update importLibrary typings (#1019) (ef951c4)
• update gmp types (#973) (2f5c29c)
• use correct pointer events behaviour (#997) (538e918)

1.8.3 (2026-04-09)

Bug Fixes

• hooks: avoid static useInsertionEffect imports (#960) (f2870c1)

1.8.2 (2026-04-01)

Bug Fixes

• move vite back to devDependencies (#955) (d3535ac)

1.8.1 (2026-03-27)

Bug Fixes

• hooks: add fallback to useLayoutEffect for React 16/17 compatibility (#950) (86ad8ee)

1.8.0 (2026-03-26)

Features

• add 2d geometry components - circle, polyline and polygon (#917) (54b1d0e)
• add 3D map, marker and popover components (#898) (2ba09a1)
• add fetchAppCheckToken prop to APIProvider (#913) (992994d)

... (truncated)

Commits

• c7a2f52 chore(main): release 1.9.0 (#971)
• bca4773 chore(deps): bump styled-components (#1021)
• 0c23770 chore(deps-dev): bump webpack-dev-server from 5.2.3 to 5.2.5 in /website (#1016)
• ef951c4 fix: update dependencies and update importLibrary typings (#1019)
• 1b43288 fix(build): don't build examples with library build
• 1a503a8 fix(hooks): add SafeReact and fallback for useInsertionEffect to ensure compa...
• af46466 chore(deps-dev): bump undici from 7.24.4 to 7.28.0 in /website (#1014)
• 2ef29e1 chore(deps-dev): bump launch-editor from 2.13.1 to 2.14.1 in /website (#1011)
• 669c93b chore(deps): bump ws in /website (#1010)
• a3dd3ea chore(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 in /website (#1007)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vis.gl/react-google-maps since your current version.

Updates autoprefixer from 10.4.20 to 10.5.2

Release notes

Sourced from autoprefixer's releases.

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

Changelog

Sourced from autoprefixer's changelog.

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

Commits

• e99e381 Release 10.5.2 version
• 98de3f5 Move -webkit-fill-available before -moz-available to get a closer to spec res...
• 8fe2513 Release 10.5.1 version
• 60ea651 Update release process
• cbd4a70 Update dependencies
• ffae49f fix: reset grid area spans when overriding areas (#1549)
• d90ad86 Fix CI
• a0f701b Update dependencies
• bb935eb Fix CI
• e63efe4 Move to pnpm 11
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.

Updates axios from 1.16.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: unde...

  Description has been truncated

[netlify]

❌ Deploy Preview for bloom-angelopolis failed. Why did it fail? →

Name	Link
🔨 Latest commit	3f0d8e8
🔍 Latest deploy log	https://app.netlify.com/projects/bloom-angelopolis/deploys/6a50167f9360c90008090e7b