Skip to content

[Snyk] Upgrade axios from 1.13.2 to 1.14.0#11

Open
srvsec wants to merge 1 commit intomainfrom
snyk-upgrade-6afe41b6bdb75429e8cf3878d0ed3dd3
Open

[Snyk] Upgrade axios from 1.13.2 to 1.14.0#11
srvsec wants to merge 1 commit intomainfrom
snyk-upgrade-6afe41b6bdb75429e8cf3878d0ed3dd3

Conversation

@srvsec
Copy link
Copy Markdown

@srvsec srvsec commented Apr 22, 2026

snyk-top-banner

Snyk has created this PR to upgrade axios from 1.13.2 to 1.14.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 5 versions ahead of your current version.

  • The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Prototype Pollution
SNYK-JS-AXIOS-15252993		 281 Proof of Concept
Release notes
Package name: axios
  • 1.14.0 - 2026-03-27

    This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

    ⚠️ Important Changes

    • Breaking Changes: None identified in this release.
    • Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

    🚀 New Features

    • Runtime Features: No new end-user features were introduced in this release.
    • Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

    🐛 Bug Fixes

    • Headers: Trim trailing CRLF in normalised header values. (#7456)
    • HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)
    • Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)
    • Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)
    • CommonJS Compatibility: Fixed package main entry regression affecting CJS consumers. (#7532)

    🔧 Maintenance & Chores

    • Security/Dependencies: Updated formidable and refreshed package set to newer versions. (#7533, #10556)
    • Tooling: Continued migration to Vitest and modernised CI/test harnesses. (#7484, #7489, #7498)
    • Build/Lint Stack: Rollup, ESLint, TypeScript, and related dev-dependency updates. (#7508, #7509, #7522)
    • Documentation: Clarified JSON parsing and adapter-related docs/comments. (#7398, #7460, #7478)

    🌟 New Contributors

    We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

    Full Changelog: v1.13.6...v1.14.0

  • 1.13.6 - 2026-02-27

    This release focuses on platform compatibility, error handling improvements, and code quality maintenance.

    ⚠️ Important Changes

    • Breaking Changes: None identified in this release.
    • Action Required: Users targeting React Native should verify their integration, particularly if relying on specific Blob or FormData behaviours, as improvements have been made to support these objects.

    🚀 New Features

    • React Native Blob Support: Axios now includes support for React Native Blob objects. Thanks to @ moh3n9595 for the initial implementation. (#5764)
    • Code Quality: Implemented prettier across the codebase and resolved associated formatting issues. (#7385)

    🐛 Bug Fixes

    • Environment Compatibility:

      • Fixed module exports for React Native and Browserify environments. (#7386)
      • Added safe FormData detection for the WeChat Mini Program environment. (#7324)

    • Error Handling:

      • AxiosError.message is now correctly enumerable. (#7392)
      • AxiosError.from now correctly copies the status property from the source error, ensuring better error propagation. (#7403)

    🔧 Maintenance & Chores

    • Dependencies: Updated the development_dependencies group (5 updates). (#7432)
    • Infrastructure: Migrated @ rollup/plugin-babel from v5.3.1 to v6.1.0. (#7424)
    • Documentation: Added missing JSDoc comments to utilities. (#7427)

    🌟 New Contributors

    We are thrilled to welcome our new contributors! Thank you for helping improve the project:

    Full Changelog: v1.13.5...v1.13.6

  • 1.13.5 - 2026-02-08

    Release 1.13.5

    Highlights

    • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
    • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

    Changes

    Security

    • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

    Fixes

    • Fix/5657. (PR #7313)
    • Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

    Features / Improvements

    • Add input validation to isAbsoluteURL. (PR #7326)
    • Refactor: bump minor package versions. (PR #7356)

    Documentation

    • Clarify object-check comment. (PR #7323)
    • Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

    CI / Maintenance

    • Chore: fix issues with YAML. (PR #7355)
    • CI: update workflow YAMLs. (PR #7372)
    • CI: fix run condition. (PR #7373)
    • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
    • Chore(release): prepare release 1.13.5. (PR #7379)

    New Contributors

    Full Changelog: v1.13.4...v1.13.5

  • 1.13.4 - 2026-01-27

    Overview

    The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

    Full Changelog: v1.13.3...v1.13.4

    What's New in v1.13.4

    Bug Fixes

    • fix: issues with version 1.13.3 (#7352) (ee90dfc)
      • Fixed issues discovered in v1.13.3 release
      • Cleaned up interceptor test files
      • Improved workflow configurations

    Infrastructure & CI/CD

    • refactor: ci and build (#7340) (8ff6c19)

      • Major refactoring of CI/CD workflows
      • Consolidated workflow files for better maintainability
      • Added mise configuration for the development environment
      • Improved sponsor block update automation
      • Enhanced issue and PR templates
      • Added automatic release notes generation
      • Implemented workflow cancellation for concurrent runs

    • chore: codegen and some updates to workflows (76cf77b)

      • Code generation improvements
      • Workflow optimisations

    Migration Notes

    Breaking Changes

    None in this release.

    Deprecations

    None in this release.

    Contributors

    Thank you to all contributors who made this release possible! Special thanks to:

  • 1.13.3 - 2026-01-25

    Release notes:

    Bug Fixes

    • http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
    • interceptor: handle the error in the same interceptor (#6269) (5945e40)
    • main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
    • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
    • silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
    • turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
    • types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
    • types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
    • unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

    Features

    Reverts

    • Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
    • deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

    Contributors to this release

  • 1.13.2 - 2025-11-04

    Release notes:

    Bug Fixes

    • http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
    • http: use default export for http2 module to support stubs; (#7196) (0588880)

    Performance Improvements

    Contributors to this release

from axios GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
fix: upgrade axios from 1.13.2 to 1.14.0
1afd0bb 
Snyk has created this PR to upgrade axios from 1.13.2 to 1.14.0.

See this package in npm:
axios

See this project in Snyk:
https://app.eu.snyk.io/org/pigs/project/581c082d-5492-4d66-b5ae-c80c24f9d394?utm_source=github-enterprise&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@srvsec @snyk-bot