[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	1.20.0 → 1.21.1

---

Release Notes

axios/axios (axios)

v1.21.1

Compare Source

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

• follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#​11410)

🐛 Bug Fixes

• Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#​11411)
• TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#​11404)

🔧 Maintenance & Chores

• Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

  • transformRequest runs for every method, and transformers receive (data, headers, status).
  • responseType and Content-Type have no default value.
  • AxiosHeaders#get and #normalize are described correctly.
  • Errors should be identified with axios.isAxiosError(), not by name.
  • The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.
  • New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

  (#​11374, #​11373, #​11389, #​11419, #​11429, #​11430)

• Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#​11390, #​11399, #​11400, #​11412, #​11401)

• Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#​11376, #​11431)

• CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#​11396)

• Dependencies: Updated development and tooling dependencies, including vitest and @vitest/* (to 5.x at the root), typescript (7.x at the root), vite, rollup, eslint, playwright, @commitlint/*, @rollup/plugin-alias, @rollup/plugin-terser, body-parser, multer, serialize-javascript, fast-uri, qs, zizmorcore/zizmor-action, and follow-redirects in /docs. (#​11383, #​11375, #​11372, #​11345, #​11392, #​11387, #​11386, #​11385, #​11391, #​11388, #​11395, #​11421, #​11422, #​11426)

• Release: Prepared the 1.21.1 release. (#​11435)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​Ghoscro (#​11374)
• @​pei711 (#​11373)
• @​ivanhapaz (#​11399)
• @​aelmanaa (#​11404)
• @​Aryapatel-007 (#​11429, #​11430)
• @​umair-ghafoor-ai (#​11376)
• @​yxshee (#​11389)
• @​malinele (#​11401)
• @​AnantDuhan (#​11431)

Full Changelog

v1.21.0

Compare Source

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.