Skip to content

chore(deps): bump axios from 1.15.0 to 1.15.1 in /integration-tests/esbuild in the test-versions group across 1 directory#8076

Merged
dd-octo-sts[bot] merged 1 commit intomasterfrom
dependabot/npm_and_yarn/integration-tests/esbuild/test-versions-9bde1dee0a
Apr 23, 2026
Merged

chore(deps): bump axios from 1.15.0 to 1.15.1 in /integration-tests/esbuild in the test-versions group across 1 directory#8076
dd-octo-sts[bot] merged 1 commit intomasterfrom
dependabot/npm_and_yarn/integration-tests/esbuild/test-versions-9bde1dee0a

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 23, 2026

Bumps the test-versions group with 1 update in the /integration-tests/esbuild directory: axios.

Updates axios from 1.15.0 to 1.15.1

Release notes

Sourced from axios's releases.

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)
  • Docs Artefact Cleanup: Removes the docs content that was incorrectly committed. (#10727)

🔧 Maintenance & Chores

  • Threat Model & Security Docs: Ongoing refinement of THREATMODEL.md, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (#10672, #10715, #10718, #10722, #10763, #10765)
  • Test Coverage & Migration: Expanded shouldBypassProxy coverage for wildcard/IPv6/edge cases, documented and tested AxiosError.status, and migrated progressEventReducer tests to Vitest. (#10723, #10725, #10741)
  • Type Refactor: Uses TypeScript utility types to deduplicate literal unions. (#7520)
  • Repo & CI: Adds CODEOWNERS, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (#10739, #10738, #10746)
  • Changelog Backfill: Added missing version entries to the changelog. (#10704)
  • Dependencies: Bumped follow-redirects (1.15.111.16.0) in root and docs, axios (1.14.01.15.0) in docs, and a group of 5 development dependencies. (#10717, #10716, #10684, #10709)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)

  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)

  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)

  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)

  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)

  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)

  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

  • Docs Artefact Cleanup: Removes the docs content that was incorrectly committed. (#10727)

🔧 Maintenance & Chores

  • Threat Model & Security Docs: Ongoing refinement of THREATMODEL.md, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (#10672, #10715, #10718, #10722, #10763, #10765)

  • Test Coverage & Migration: Expanded shouldBypassProxy coverage for wildcard/IPv6/edge cases, documented and tested AxiosError.status, and migrated progressEventReducer tests to Vitest. (#10723, #10725, #10741)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the test-versions group with 1 update in the /integration-tests/esbuild directory: [axios](https://github.com/axios/axios).


Updates `axios` from 1.15.0 to 1.15.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.15.1)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependabot dependencies javascript Pull requests that update javascript code semver-patch labels Apr 23, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 23, 2026 00:59
@dependabot dependabot Bot added semver-patch dependencies javascript Pull requests that update javascript code dependabot labels Apr 23, 2026
@dd-octo-sts dd-octo-sts Bot enabled auto-merge (squash) April 23, 2026 00:59
@github-actions
Copy link
Copy Markdown
Contributor

Overall package size

Self size: 5.55 MB
Deduped: 6.4 MB
No deduping: 6.4 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.0.1 | 82.56 kB | 817.39 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 23, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.77%. Comparing base (073fbd9) to head (1de0d69).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #8076   +/-   ##
=======================================
  Coverage   73.77%   73.77%           
=======================================
  Files         782      782           
  Lines       36339    36339           
=======================================
  Hits        26809    26809           
  Misses       9530     9530           
Flag Coverage Δ
aiguard-macos 36.58% <ø> (-0.09%) ⬇️
aiguard-ubuntu 36.69% <ø> (-0.09%) ⬇️
aiguard-windows 36.49% <ø> (-0.09%) ⬇️
apm-capabilities-tracing-macos 48.42% <ø> (ø)
apm-capabilities-tracing-ubuntu 48.46% <ø> (ø)
apm-capabilities-tracing-windows 48.22% <ø> (ø)
apm-integrations-child-process 36.17% <ø> (-0.10%) ⬇️
apm-integrations-couchbase-18 35.17% <ø> (-0.09%) ⬇️
apm-integrations-couchbase-eol 35.25% <ø> (-0.07%) ⬇️
apm-integrations-oracledb 35.22% <ø> (-0.09%) ⬇️
appsec-express 52.89% <ø> (-0.07%) ⬇️
appsec-fastify 49.37% <ø> (-0.07%) ⬇️
appsec-graphql 49.72% <ø> (-0.07%) ⬇️
appsec-kafka 42.17% <ø> (-0.07%) ⬇️
appsec-ldapjs 41.48% <ø> (-0.08%) ⬇️
appsec-lodash 41.51% <ø> (-0.08%) ⬇️
appsec-macos 56.96% <ø> (-0.07%) ⬇️
appsec-mongodb-core 45.82% <ø> (-0.07%) ⬇️
appsec-mongoose 46.70% <ø> (-0.07%) ⬇️
appsec-mysql 48.84% <ø> (-0.08%) ⬇️
appsec-node-serialize 40.69% <ø> (-0.08%) ⬇️
appsec-passport 44.67% <ø> (-0.08%) ⬇️
appsec-postgres 48.47% <ø> (-0.15%) ⬇️
appsec-sourcing 40.18% <ø> (-0.08%) ⬇️
appsec-stripe 42.40% <ø> (-0.08%) ⬇️
appsec-template 40.85% <ø> (-0.08%) ⬇️
appsec-ubuntu 57.03% <ø> (-0.07%) ⬇️
appsec-windows 56.85% <ø> (-0.07%) ⬇️
instrumentations-instrumentation-bluebird 29.86% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-body-parser 37.76% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-child_process 35.54% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-cookie-parser 31.78% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-express 32.00% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-express-mongo-sanitize 31.91% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-express-session 37.39% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-fs 29.53% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-generic-pool 30.91% <ø> (ø)
instrumentations-instrumentation-http 37.00% <ø> (-0.08%) ⬇️
instrumentations-instrumentation-knex 29.83% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-light-my-request 37.33% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-mongoose 30.94% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-multer 37.53% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-mysql2 35.52% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-passport 41.27% <ø> (-0.08%) ⬇️
instrumentations-instrumentation-passport-http 40.96% <ø> (-0.08%) ⬇️
instrumentations-instrumentation-passport-local 41.46% <ø> (-0.08%) ⬇️
instrumentations-instrumentation-pg 35.04% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-promise 29.80% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-promise-js 29.80% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-q 29.84% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-url 29.79% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-when 29.82% <ø> (-0.10%) ⬇️
llmobs-ai 38.49% <ø> (-0.09%) ⬇️
llmobs-anthropic 37.94% <ø> (-0.09%) ⬇️
llmobs-bedrock 37.17% <ø> (-0.08%) ⬇️
llmobs-google-genai 37.61% <ø> (-0.08%) ⬇️
llmobs-langchain 37.17% <ø> (+0.03%) ⬆️
llmobs-openai 41.31% <ø> (-0.08%) ⬇️
llmobs-vertex-ai 37.80% <ø> (-0.09%) ⬇️
platform-core 29.90% <ø> (ø)
platform-esbuild 32.72% <ø> (ø)
platform-instrumentations-misc 40.08% <ø> (ø)
platform-shimmer 35.62% <ø> (ø)
platform-unit-guardrails 31.28% <ø> (ø)
platform-webpack 20.81% <ø> (ø)
plugins-azure-durable-functions 25.25% <ø> (ø)
plugins-azure-event-hubs 25.40% <ø> (ø)
plugins-azure-service-bus 24.82% <ø> (ø)
plugins-bullmq 40.83% <ø> (-0.08%) ⬇️
plugins-cassandra 35.36% <ø> (-0.09%) ⬇️
plugins-cookie 26.37% <ø> (ø)
plugins-cookie-parser 26.17% <ø> (ø)
plugins-crypto 25.56% <ø> (ø)
plugins-dd-trace-api 35.48% <ø> (-0.09%) ⬇️
plugins-express-mongo-sanitize 26.31% <ø> (ø)
plugins-express-session 26.13% <ø> (ø)
plugins-fastify 39.44% <ø> (-0.09%) ⬇️
plugins-fetch 35.87% <ø> (-0.09%) ⬇️
plugins-fs 35.77% <ø> (-0.10%) ⬇️
plugins-generic-pool 25.29% <ø> (ø)
plugins-google-cloud-pubsub 43.12% <ø> (-0.08%) ⬇️
plugins-grpc 38.14% <ø> (-0.09%) ⬇️
plugins-handlebars 26.35% <ø> (ø)
plugins-hapi 37.38% <ø> (-0.09%) ⬇️
plugins-hono 37.62% <ø> (-0.09%) ⬇️
plugins-ioredis 35.82% <ø> (-0.09%) ⬇️
plugins-knex 26.04% <ø> (ø)
plugins-langgraph 35.15% <ø> (-0.09%) ⬇️
plugins-ldapjs 23.92% <ø> (ø)
plugins-light-my-request 25.78% <ø> (ø)
plugins-limitd-client 30.10% <ø> (-0.10%) ⬇️
plugins-lodash 25.36% <ø> (ø)
plugins-mariadb 36.69% <ø> (-0.09%) ⬇️
plugins-memcached 35.47% <ø> (-0.09%) ⬇️
plugins-microgateway-core 36.46% <ø> (-0.09%) ⬇️
plugins-modelcontextprotocol-sdk 34.40% <ø> (-0.09%) ⬇️
plugins-moleculer 38.16% <ø> (-0.09%) ⬇️
plugins-mongodb 36.54% <ø> (-0.09%) ⬇️
plugins-mongodb-core 36.31% <ø> (-0.07%) ⬇️
plugins-mongoose 36.23% <ø> (ø)
plugins-multer 26.13% <ø> (ø)
plugins-mysql 36.55% <ø> (-0.09%) ⬇️
plugins-mysql2 36.53% <ø> (-0.09%) ⬇️
plugins-node-serialize 26.40% <ø> (ø)
plugins-opensearch 35.12% <ø> (-0.09%) ⬇️
plugins-passport-http 26.19% <ø> (ø)
plugins-postgres 34.51% <ø> (-0.09%) ⬇️
plugins-process 25.56% <ø> (ø)
plugins-pug 26.37% <ø> (ø)
plugins-redis 36.02% <ø> (-0.09%) ⬇️
plugins-router 40.03% <ø> (-0.09%) ⬇️
plugins-sequelize 25.07% <ø> (ø)
plugins-test-and-upstream-amqp10 35.79% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-amqplib 40.97% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-apollo 36.62% <ø> (-0.08%) ⬇️
plugins-test-and-upstream-avsc 35.62% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-bunyan 31.25% <ø> (-0.10%) ⬇️
plugins-test-and-upstream-connect 37.97% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-graphql 37.32% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-koa 37.58% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-protobufjs 35.84% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-rhea 41.08% <ø> (-0.09%) ⬇️
plugins-undici 36.63% <ø> (-0.09%) ⬇️
plugins-url 25.56% <ø> (ø)
plugins-valkey 35.49% <ø> (+0.02%) ⬆️
plugins-vm 25.56% <ø> (ø)
plugins-winston 31.55% <ø> (-0.22%) ⬇️
plugins-ws 39.10% <ø> (-0.09%) ⬇️
profiling-macos 38.03% <ø> (-0.09%) ⬇️
profiling-ubuntu 38.19% <ø> (-0.09%) ⬇️
profiling-windows 39.56% <ø> (-0.09%) ⬇️
serverless-azure-functions-client 25.14% <ø> (ø)
serverless-azure-functions-eventhubs 25.14% <ø> (ø)
serverless-azure-functions-servicebus 25.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@datadog-prod-us1-6
Copy link
Copy Markdown

datadog-prod-us1-6 Bot commented Apr 23, 2026

Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 68.14% (+0.00%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1de0d69 | Docs | Datadog PR Page | Give us feedback!

@pr-commenter
Copy link
Copy Markdown

pr-commenter Bot commented Apr 23, 2026

Benchmarks

Benchmark execution time: 2026-04-23 01:13:26

Comparing candidate commit 1de0d69 in PR branch dependabot/npm_and_yarn/integration-tests/esbuild/test-versions-9bde1dee0a with baseline commit 073fbd9 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 1339 metrics, 105 unstable metrics.

@dd-octo-sts dd-octo-sts Bot merged commit 8cd7c26 into master Apr 23, 2026
960 of 965 checks passed
@dd-octo-sts dd-octo-sts Bot deleted the dependabot/npm_and_yarn/integration-tests/esbuild/test-versions-9bde1dee0a branch April 23, 2026 01:20
@dd-octo-sts dd-octo-sts Bot mentioned this pull request Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependabot dependencies javascript Pull requests that update javascript code semver-patch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants