chore(deps): bump axios from 1.13.1 to 1.15.0 by dependabot[bot] · Pull Request #4012 · linuxfoundation/crowd.dev

dependabot · 2026-04-09T17:53:08Z

Bumps axios from 1.13.1 to 1.15.0.

Release notes

v1.15.0

This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.

⚠️ Important Changes

Deprecation: url.parse() usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (#10625)

🔒 Security Fixes

Proxy Handling: Fixed a no_proxy hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (#10661)

Header Injection: Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (#10660)

🚀 New Features

Runtime Support: Added compatibility checks and documentation for Deno and Bun environments. (#10652, #10653)

🔧 Maintenance & Chores

CI Security: Hardened workflow permissions to least privilege, added the zizmor security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (#10618, #10619, #10627, #10637, #10666)

Dependencies: Bumped serialize-javascript, handlebars, picomatch, vite, and denoland/setup-deno to latest versions. Added a 7-day Dependabot cooldown period. (#10574, #10572, #10568, #10663, #10664, #10665, #10669, #10670, #10616)

Documentation: Unified docs, improved beforeRedirect credential leakage example, clarified withCredentials/withXSRFToken behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (#10649, #10624, #7452, #7471, #10654, #10644, #10589)

Housekeeping: Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (#10584, #10650, #10582, #10640, #10659, #10668)

Tests: Added regression coverage for urlencoded Content-Type casing. (#10573)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@raashish1601 (#10573)

@Kilros0817 (#10625)

@ashstrc (#10624)

@Abhi3975 (#10589)

@theamodhshetty (#7452)

v1.14.0

This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

⚠️ Important Changes

Breaking Changes: None identified in this release.

Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

🚀 New Features

Runtime Features: No new end-user features were introduced in this release.

Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

🐛 Bug Fixes

Headers: Trim trailing CRLF in normalised header values. (#7456)

HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)

Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)

Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (5945e40)

main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)

package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)

silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)

turn AxiosError into a native error (#5394) (#5558) (1c6a86d)

types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)

types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)

unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)

add automatic minor and patch upgrades to dependabot (#6053) (65a7584)

add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)

added copilot instructions (3f83143)

compatibility with frozen prototypes (#6265) (860e033)

enhance pipeFileToResponse with error handling (#7169) (88d7884)

types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298

deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

Ashvin Tiwari

Nikunj Mochi

Anchal Singh

jasonsaayman

Julian Dax

Akash Dhar Dubey

Madhumita

Tackoil

Justin Dhillon

Rudransh

WuMingDao

codenomnom

Nandan Acharya

Eric Dubé

Tibor Pilz

Gabriel Quaresma

Turadg Aleahmad

... (truncated)

Commits

772a4e5 chore(release): prepare release 1.15.0 (#10671)
4b07137 chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (#10663)
51e57b3 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (#10664)
fba1a77 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (#10665)
0bf6e28 chore(deps): bump denoland/setup-deno in the github-actions group (#10669)
8107157 chore(deps-dev): bump the development_dependencies group with 4 updates (#10670)
e66530e ci: require npm-publish environment for releases (#10666)
49f23cb chore(sponsor): update sponsor block (#10668)
3631854 fix: unrestricted cloud metadata exfiltration via header injection chain (#10...
fb3befb fix: no_proxy hostname normalization bypass leads to ssrf (#10661)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

High Risk
This changes the HTTP client version across many backend services from Axios v1.x to v0.31.0, which is a major downgrade and may break request/interceptor behavior or TypeScript types at runtime. Lockfile updates also alter transitive networking/proxy packages, increasing the chance of subtle outbound HTTP behavior changes.

Overview
Updates dependency versions across the backend/worker workspace, primarily around HTTP tooling.

Replaces Axios 1.x usages in backend and multiple services/apps/* and services/libs/* packages with axios@0.31.0, and regenerates pnpm-lock.yaml accordingly (including updated follow-redirects, form-data, and proxy-from-env entries).

Lockfile changes also adjust a few other resolved artifacts (e.g., needle source for clearbit) as part of the dependency re-resolution.

^{Reviewed by Cursor Bugbot for commit 0a3b202. Bugbot is set up for automated code reviews on this repo. Configure here.}

CLAassistant · 2026-04-09T17:53:17Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

github-actions · 2026-04-09T17:53:20Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-09T17:53:25Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-09T17:53:34Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-16T11:57:20Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-16T11:58:45Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-16T11:59:16Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

cursor · 2026-04-16T12:02:24Z

    "@octokit/request": "^5.6.3",
    "@octokit/rest": "^22.0.0",
-    "axios": "^1.13.1",
+    "axios": "^0.31.0",


Axios downgraded from 1.x to 0.x across all services

High Severity

The PR title says "bump axios from 1.13.1 to 1.15.0" but every service package is being changed from axios@^1.x to axios@^0.31.0, which is a major version downgrade, not an upgrade. The backend/package.json changing from ^0.27.2 to ^0.31.0 is fine (staying in 0.x), but all ~12 service packages that were on ^1.6.x/^1.8.x/^1.13.x are now also set to ^0.31.0. Axios 0.x has different error handling semantics, JSON parsing behavior, and request/response transforms compared to 1.x. Code relying on 1.x behavior — such as axios.isAxiosError(), AxiosError types, and consistent error-throwing patterns — may break or behave differently at runtime.

Additional Locations (2)

services/apps/integration_run_worker/package.json#L28-L29

services/libs/integrations/package.json#L25-L26

^{Reviewed by Cursor Bugbot for commit eb2c2f0. Configure here.}

github-actions · 2026-04-17T07:20:39Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-17T07:21:02Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-17T07:21:53Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f376e14. Configure here.}

cursor · 2026-04-17T07:23:58Z

    "@crowd/redis": "workspace:*",
    "@crowd/types": "workspace:*",
-    "axios": "^1.6.8",
+    "axios": "^0.31.0",


Services downgraded from axios 1.x to 0.x

High Severity

The PR claims to bump axios from 1.13.1 to 1.15.0, but it actually downgrades all 12+ service packages from axios 1.x to ^0.31.0. Only backend/package.json (previously on ^0.27.2) is correctly updated within the 0.x line. Every service under services/apps/ and services/libs/ was on various axios 1.x versions and is now incorrectly pinned to ^0.31.0. Axios 0.x and 1.x have significant API differences in error handling, headers structure, TypeScript types (e.g., InternalAxiosRequestConfig), and parameter serialization. This will likely cause runtime failures across all affected services.

Additional Locations (2)

services/libs/common_services/package.json#L27-L28

services/libs/integrations/package.json#L25-L26

^{Reviewed by Cursor Bugbot for commit f376e14. Configure here.}

github-actions · 2026-04-20T18:06:16Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

Bumps [axios](https://github.com/axios/axios) from 1.13.1 to 1.15.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.1...v1.15.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-04-20T18:07:35Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

github-actions · 2026-04-20T18:08:06Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 9, 2026

dependabot Bot mentioned this pull request Apr 9, 2026

chore(deps): bump axios from 1.13.1 to 1.13.5 #3834

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/axios-1.15.0 branch from 765d53b to eb2c2f0 Compare April 16, 2026 11:58

cursor Bot reviewed Apr 16, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/axios-1.15.0 branch from eb2c2f0 to f376e14 Compare April 17, 2026 07:20

cursor Bot reviewed Apr 17, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/axios-1.15.0 branch from f376e14 to 0a3b202 Compare April 20, 2026 18:07

Conversation

dependabot Bot commented on behalf of github Apr 9, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.15.0

⚠️ Important Changes

🔒 Security Fixes

🚀 New Features

🔧 Maintenance & Chores

🌟 New Contributors

v1.14.0

⚠️ Important Changes

🚀 New Features

🐛 Bug Fixes

Changelog

1.13.3 (2026-01-20)

Bug Fixes

Features

Reverts

Contributors to this release

Uh oh!

CLAassistant commented Apr 9, 2026

Uh oh!

github-actions Bot commented Apr 9, 2026

Uh oh!

github-actions Bot commented Apr 9, 2026

Uh oh!

github-actions Bot commented Apr 9, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

cursor Bot Apr 16, 2026

Choose a reason for hiding this comment

Axios downgraded from 1.x to 0.x across all services

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 17, 2026

Choose a reason for hiding this comment

Services downgraded from axios 1.x to 0.x

Uh oh!

github-actions Bot commented Apr 20, 2026

Uh oh!

github-actions Bot commented Apr 20, 2026

Uh oh!

github-actions Bot commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Apr 9, 2026 •

edited by cursor Bot

Loading