Bump the npm_and_yarn group across 2 directories with 14 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the /docs directory: astro, sharp, js-yaml and svgo.
Bumps the npm_and_yarn group with 10 updates in the /frontend/nextcp-ui directory:

Package	From	To
nanoid	3.3.17	3.3.18
postcss	8.5.13	8.5.23
@angular/common	22.0.1	22.0.2
@hono/node-server	1.19.14	1.19.17
axios	1.16.1	1.19.0
fast-uri	3.1.2	3.1.5
hono	4.12.26	4.13.3
qs	6.14.0	6.15.3
tar	7.5.16	7.5.22
ws	8.18.3	8.21.3

Updates astro from 7.0.6 to 7.1.1

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

  Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

... (truncated)

Commits

• 91c645a [ci] release (#17403)
• 4b03702 Normalize domain-based i18n request paths consistently (#17399)
• fdd673c [ci] release (#17387)
• d9f99e1 Preserve CSP resource defaults for element directives (#17394)
• 092da56 Add more escaping for rendered content (#17393)
• 186a1e7 fix(logger): allows setting in updateConfig() (#17391)
• 4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
• 16de021 feat(logger): allow passing entrypoint as URL (#17389)
• ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
• 30698a2 feat: chunk data store (#17296)
• Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.0

Release notes

Sourced from sharp's releases.

v0.35.0

• Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

• Breaking: Remove install script from package.json file. Compiling from source is now opt-in via the build script.

• Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

• Breaking: Add limitInputChannels with a default value of 5.

• Breaking: Remove deprecated failOnError constructor property.

• Breaking: Remove deprecated paletteBitDepth from metadata response.

• Breaking: Remove deprecated properties from sharpen operation.

• Breaking: Rename format.jp2k as format.jp2 for API consistency.

• Upgrade to libvips v8.18.3 for upstream bug fixes.

• Remove experimental status from WebAssembly binaries.

• Add prebuilt binaries for FreeBSD (WebAssembly).

• Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

• Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

• Add AVIF/HEIF tune option for control over quality metrics. #4227

• Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps. #4314

• Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer. #4355

• Require prebuilt binaries using static paths to aid code bundling. #4380

• TypeScript: Ensure FormatEnum keys match reality. #4475

• Add margin option to trim operation. #4480 @​eddienubes

• Ensure HEIF primary item is used as default page/frame. #4487

... (truncated)

Commits

• 2ed5af4 Release v0.35.0
• 4475cf1 Tests: update locator hash for sharp-libvips v1.3.0
• deb22dd Upgrade to sharp-libvips v1.3.0
• 07f1be9 Prerelease v0.35.0-rc.8
• df1109b Prerelease v0.35.0-rc.7
• aca49b3 Upgrade to libvips v8.18.3
• e9e86f5 Type-check density option before range validation (#4536)
• 2f0bcf0 Docs: update supported image formats
• 98e03b8 Revert "Guard heif bitdepth property for prebuilt binaries"
• e4ea2f3 CI: Ignore package minimum age in smoke tests
• Additional commits viewable in compare view

Updates js-yaml from 4.3.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• See full diff in compare view

Updates nanoid from 3.3.15 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

Changelog

Sourced from nanoid's changelog.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

Commits

• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• See full diff in compare view

Updates postcss from 8.5.16 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates svgo from 4.0.1 to 4.0.2

Release notes

Sourced from svgo's releases.

v4.0.2

What's Changed

Security

• removeScripts, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @​SethFalco

Bug Fixes

• convertColors, skip case-normalization for CSS custom properties. By @​SethFalco in svg/svgo#2213
• convertPathData, improve handling of consecutive t commands. By @​KTibow in svg/svgo#2156
• convertPathData, safer handling of paths. By @​KTibow in svg/svgo#2158
• Improve parsing of negative (or +) arc radii. By @​KTibow in svg/svgo#2205
• When converting to a data URI, only encode it as a data URI once. By @​johnkenny54 in svg/svgo#2053

Performance

• mergePaths, speed up child node removal. By @​mozzie in svg/svgo#2216

Other Changes

• removeAttributesBySelector, log warning and noop if missing parameters. By @​KTibow in svg/svgo#2215

Commits

• b2309cf chore: sync version with api
• f529cfc Merge commit from fork
• 581fe68 performance: speed up mergePath child node removal (#2216)
• eb4c8b6 docs(removeAttributesBySelector): properly document and check types (#2215)
• 6fd5872 fix(convertColors): skip convertCase on css custom properties (#2213)
• 7414f73 fix: properly parse negative (or +) arc radii (#2205)
• a8c19aa fix: only call encodeSVGDatauri once and add test case (#2053)
• 65548f4 fix(convertPathData): properly handle consecutive t commands (#2156)
• a41a7c1 fix(convertPathData): introducing isSafeToRemove (#2164)
• 38625dd test: handle charm icons (#2203)
• See full diff in compare view

Updates nanoid from 3.3.17 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

Changelog

Sourced from nanoid's changelog.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

Commits

• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• See full diff in compare view

Updates postcss from 8.5.13 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates @angular/common from 22.0.1 to 22.0.2

Release notes

Sourced from @​angular/common's releases.

22.0.2

common

Commit	Description
	escape anchor fragment in shadow DOM name selector
	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Description
	restrict possible event handler check to property names longer than 2 characters

core

Commit	Description
	avoid caching missing locale data
	escape overlapping comment delimiters in escapeCommentText
	guard against DOM clobbering in declareExperimentalWebMcpTool
	preserve leave animation for sibling instances sharing a TNode
	prevent unsubscribe during emit from throwing off other listeners
	treat iframe credentialless as security-sensitive
	detect existing signal dependency without checking all producer links

http

Commit	Description
	distinguish repeated transfer cache params
	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Description
	migration skip any target are not build or test

Changelog

Sourced from @​angular/common's changelog.

22.0.2 (2026-06-17)

common

Commit	Type	Description
94ea403563	fix	escape anchor fragment in shadow DOM name selector
6c1f3e9d49	fix	skip transfer cache for uncacheable HTTP traffic (#69316)

compiler

Commit	Type	Description
6f1171991a	fix	restrict possible event handler check to property names longer than 2 characters

core

Commit	Type	Description
528a34f766	fix	avoid caching missing locale data
e17e8d5422	fix	escape overlapping comment delimiters in escapeCommentText
59dea13f80	fix	guard against DOM clobbering in declareExperimentalWebMcpTool
3a48abc15c	fix	preserve leave animation for sibling instances sharing a TNode
93d0a5f95c	fix	prevent unsubscribe during emit from throwing off other listeners
b32ee7ceb3	fix	treat iframe credentialless as security-sensitive
f902d1d35e	perf	detect existing signal dependency without checking all producer links

http

Commit	Type	Description
6867f77ec7	fix	distinguish repeated transfer cache params
7ef1399068	fix	skip transfer cache for fetch credentialed requests (#69316)

migrations

Commit	Type	Description
15314c1736	fix	migration skip any target are not build or test

Commits

• 6867f77 fix(http): distinguish repeated transfer cache params
• 6c1f3e9 fix(common): skip transfer cache for uncacheable HTTP traffic (#69316)
• 7ef1399 fix(http): skip transfer cache for fetch credentialed requests (#69316)
• 94ea403 fix(common): escape anchor fragment in shadow DOM name selector
• See full diff in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

• 71941da 1.19.17
• 0208500 ci: add stage option for publishing (#386)
• cbdf713 1.19.16
• 86e96c2 ci: add an action for trusted publisher (#385)
• 99c1a1a ci: run on v1.x branch pushes
• 84cb2ee Merge commit from fork
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

Updates axios from 1.16.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)
• @​Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#...

  Description has been truncated