chore(deps): bump the workbench-minor-and-patch group across 1 directory with 15 updates

[dependabot]

Bumps the workbench-minor-and-patch group with 15 updates in the /compileflow-workbench directory:

Package	From	To
prettier	3.8.1	3.9.9
@typescript-eslint/parser	8.69.0	8.71.0
tsx	4.23.13	4.23.15
@reduxjs/toolkit	2.12.0	2.13.0
antd	6.3.1	6.6.5
axios	1.18.0	1.20.0
dexie	4.4.5	4.4.6
monaco-editor	0.55.1	0.57.0
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.7	19.3.0
react-router-dom	7.18.3	7.18.4
@playwright/test	1.58.2	1.63.0
@testing-library/dom	10.4.1	10.4.2
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.7	19.3.0

Updates prettier from 3.8.1 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

... (truncated)

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
</tr></table> 

... (truncated)

Commits

• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.69.0 to 8.71.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.71.0 (2026-09-28)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• 7ee7608 chore(release): publish 8.70.0
• See full diff in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• See full diff in compare view

Updates @reduxjs/toolkit from 2.12.0 to 2.13.0

Release notes

Sourced from @​reduxjs/toolkit's releases.

v2.13.0

This feature release updates our build tooling to TSDown and PNPM, adds official TypeScript 7 support, and includes a long list of bugfixes across RTK Query, createAsyncThunk, createEntityAdapter, and combineSlices.

Changelog

Build Tooling Updates

We've fully modernizing modernized our build tooling across all of the Redux repos. That included switching from Yarn to PNPM, ESLint to Oxlint, Prettier to Oxfmt, and TSUp to TSDown.

The part that matters for users is that we now build the package with TSDown instead of tsup. The package layout, exports definitions, and exported APIs are all unchanged from 2.12. We've checked the new build with attw, and verified that CJS and ESM entry points load in both dev and prod builds, and that the legacy-esm artifacts still target ES2017. The contents of the bundles do look a bit different (smaller CJS artifacts, slightly different helper output in the legacy-esm files). If you see any behavior differences that look build-related, please file an issue!

This is also our first release published via the updated PNPM-based workflow, still using NPM Trusted Publishing. We've also added pkg.pr.new previews for every commit, so you can try out a PR build before it's released.

Docs Updates

We've shipped a new combined Redux libraries docs site! The core docs site at https://redux.js.org now contains the docs for all of our libraries: Redux core and usage guides, Redux Toolkit, React Redux, and Reselect. The prior standalone docs sites for RTK, R-R, and Reselect now redirect to their respective sections of the combined docs. We've also done a major cleanup pass on the docs, deduplicating pages that had similarities (like the Next.js or RTK2 migration pages that lived in both the core and RTK docs), and updating outdated content (modernizing example code snippets, deleting dead links, and making RTK and hooks the default patterns shown). The RTK content now lives at https://redux.js.org/toolkit/ .

TypeScript 7 Support

TS 7.0 (the native Go port) is now out! We fixed the remaining type errors in RTK when checked by TS 7.0 and 7.1, and TS 7.0 is now part of our CI test matrix.

Per our TS support policy of matching DefinitelyTyped's support window, we've also updated our support matrix to TS 5.6+. As always, RTK may still work with earlier versions, but we no longer test against them.

RTK Query Fixes

useQueryState (and thus useQuery) was passing a new inline selector to useSelector on every render, and also reading the store directly during render. The selector is now memoized, and the direct store read is gone. This also fixes a bug where isSuccess could flip from false to true on an unrelated re-render while a query was refetching after an error. isSuccess now correctly stays false in that case.

data now reflects cache updates made via updateQueryData while a refetch is in flight, instead of showing the previous result.

Polling now reads the current cache state when each poll fires, rather than the state at the time the poll was scheduled. This means skipPollingIfUnfocused respects focus loss that happens after scheduling, and polls stop if their cache entry was removed.

We fixed a race where a duplicate query request rejected by the thunk condition could cause queued tag invalidations to run too early and be lost, leaving stale data in the cache.

Tags with falsy ids like 0 now invalidate and clean up correctly.

Lazy query hooks now re-subscribe correctly when effects restart while the hook state is preserved, such as with Fast Refresh or <Activity>.

Infinite queries no longer trigger onQueryStarted when fetching past the end of the list, and the infinite query hook result type now includes the page error flags.

fetchBaseQuery only treats a URL as absolute if it starts with a scheme.

We also fixed an error when rehydrating state for an endpoint name that has no definition.

Other Fixes

createAsyncThunk no longer swallows aborts that happen before the pending action is dispatched, and now correctly sets rejectedWithValue when rejectWithValue is called with a falsy payload.

createEntityAdapter's setAll now keeps the last item when given duplicate IDs, matching setMany. The sorted adapter's updateMany now merges multiple updates for the same ID before applying them.

combineSlices now keeps its internal state proxy cache per instance, so multiple combined reducers no longer interfere with each other.

... (truncated)

Commits

• 370f7eb Release 2.13.0
• 8c40241 Fix release-it commands for PNPM
• 483f0fb Fix unstable selector reference inside of useQueryState and isSuccess dur...
• 62103f5 Fix TS7 errors and update TS matrix (#5455)
• 71db2d4 Fetch the other libraries' docs from master in previews (#5454)
• 0eeae5c Convert Redux Toolkit docs to the combined site format (#5451)
• c9dac93 docs: clarify browser ESM import map usage (#5375)
• 00b133f fix(toolkit): handle circular references in immutable state middleware (#5433)
• ded675e docs site: fix pagefind search by preloading window.pagefind (#5447)
• 322c01a Reinstate lazy queries after preserved effects restart (#5424)
• Additional commits viewable in compare view

Updates antd from 6.3.1 to 6.6.5

Release notes

Sourced from antd's releases.

6.6.5

• 🐞 Fix numeric 0 content rendering across Result, message, notification, Avatar, Modal, Descriptions, and Form.Item. #59153 #59125 #59289 @​bhumin18 @​nrps9909 @​QDyanbing
• Upload
  • 🐞 Fix Upload.Dragger custom style.height being overridden when the height prop is not set. #59319 @​dogledogle
  • ♿ Fix Upload file names being focusable as buttons when no preview action is available. #59295 @​QDyanbing
• Transfer
  • 🐞 Fix Transfer calling a stale onSelectChange callback after it is replaced or removed. #59307 @​yunfeizhu
  • 🐞 Fix Transfer footer callbacks not receiving direction when using rest parameters. #59303 @​QDyanbing
• 🐞 Fix Avatar not retrying image loading after srcSet changes. #59297 @​QDyanbing
• 🐞 Fix Anchor scrolling and Table and Transfer range selection using stale values after updates. #59308 @​QDyanbing
• 🐞 Fix Select inconsistent single and multiple heights after customizing global fontSize or lineHeight. #59298 @​zombieJ
• 🤖 Fix Tooltip, Popover, Popconfirm, and Slider TypeScript definitions accepting unsupported rc Tooltip props. #59288 @​QDyanbing
• 🛎 Fix Drawer not warning that destroyOnClose is deprecated. #59299 @​dogledogle

---

• 🐞 修复 Result、message、notification、Avatar、Modal、Descriptions 和 Form.Item 无法正确渲染数值 0 内容的问题。#59153 #59125 #59289 @​bhumin18 @​nrps9909 @​QDyanbing
• Upload
  • 🐞 修复 Upload.Dragger 未设置 height 属性时自定义 style.height 被覆盖的问题。#59319 @​dogledogle
  • ♿ 修复 Upload 没有可用预览操作时文件名仍可作为按钮聚焦的问题。#59295 @​QDyanbing
• Transfer
  • 🐞 修复 Transfer 在替换或移除 onSelectChange 后仍调用旧回调的问题。#59307 @​yunfeizhu
  • 🐞 修复 Transfer 使用剩余参数的 footer 回调无法获取 direction 的问题。#59303 @​QDyanbing
• 🐞 修复 Avatar 图片加载失败后更新 srcSet 无法重新加载的问题。#59297 @​QDyanbing
• 🐞 修复 Anchor 滚动及 Table 和 Transfer 范围选择在更新后仍使用旧值的问题。#59308 @​QDyanbing
• 🐞 修复 Select 自定义全局 fontSize 或 lineHeight 后单选与多选高度不一致的问题。#59298 @​zombieJ
• 🤖 修正 Tooltip、Popover、Popconfirm 和 Slider 的 TypeScript 类型定义，避免接受实际无效的 rc Tooltip 属性。#59288 @​QDyanbing
• 🛎 修复 Drawer 未提示 destroyOnClose 已废弃的问题。#59299 @​dogledogle

6.6.4

• 🗑 Deprecate legacy Avatar GroupProps, BackTop and FloatButton BackTopProps, Input GroupProps, Mentions OptionProps, and Select OptionProps types in favor of GetProps or option-derived types. #58949 @​li-jia-nan
• 🐞 Fix AutoComplete missing classNames.clear and styles.clear semantic customizations for the clear button. #59245 @​lazerg
• Table
  • 🐞 Fix Table filteredValue being ignored when responsive columns are hidden. #59198 @​QDyanbing
  • 🐞 Fix Table ignoring pagination.classNames and pagination.styles semantic customizations. #59267 @​QDyanbing
  • 🐞 Fix Table virtual cell content not being vertically centered. #59260 @​QDyanbing
• Modal
  • 🐞 Fix Modal okText and cancelText falling back to default text for falsy ReactNode values. #59254 @​QDyanbing
  • 🐞 Fix Modal not triggering onCancel when cancelButtonProps.onClick is provided. #59255 @​QDyanbing
• ColorPicker
  • 🐞 Fix ColorPicker clear control remaining interactive and showing hover styles when disabled. #59164 @​dogledogle
  • 🐞 Fix ColorPicker modifying presets and crashing when preset items are frozen. #59272 @​QDyanbing
• 🐞 Fix Splitter panel sizes exceeding their min and max constraints when the container resizes. #59084 @​QDyanbing
• 🐞 Fix Segmented selected item text color lagging behind the thumb animation when custom itemSelectedBg and itemSelectedColor tokens are used. #59046 @​EmilyyyLiu
• 🐞 Fix Transfer restoring stale selections after dataSource item key types change. #59166 @​QDyanbing
• 🐞 Fix FloatButton.Group menu flickering when moving the pointer from the trigger to the menu with trigger="hover". #59246 @​QDyanbing
• 🐞 Fix Form vertical Form.Item controls shrinking inside horizontal layouts. #59263 @​QDyanbing
• 🐞 Fix Tabs more dropdown ignoring styles.popup.root. #59221 @​giaBaoJS
• 🐞 Fix ConfigProvider failing to inherit zeroRuntime in nested themes when inherit is false. #59250 @​QDyanbing

---

• 🗑 废弃 Avatar GroupProps、BackTop 和 FloatButton BackTopProps、Input GroupProps、Mentions OptionProps 与 Select OptionProps 旧类型，建议改用 GetProps 或从选项推导的类型。#58949 @​li-jia-nan
• 🐞 修复 AutoComplete 缺失清除按钮 classNames.clear 和 styles.clear 语义化配置的问题。#59245 @​lazerg

... (truncated)

Changelog

Sourced from antd's changelog.

6.6.5

2026-09-20

• 🐞 Fix numeric 0 content rendering across Result, message, notification, Avatar, Modal, Descriptions, and Form.Item. #59153 #59125 #59289 @​bhumin18 @​nrps9909 @​QDyanbing
• Upload
  • 🐞 Fix Upload.Dragger custom style.height being overridden when the height prop is not set. #59319 @​dogledogle
  • ♿ Fix Upload file names being focusable as buttons when no preview action is available. #59295 @​QDyanbing
• Transfer
  • 🐞 Fix Transfer calling a stale onSelectChange callback after it is replaced or removed. #59307 @​yunfeizhu
  • 🐞 Fix Transfer footer callbacks not receiving direction when using rest parameters. #59303 @​QDyanbing
• 🐞 Fix Avatar not retrying image loading after srcSet changes. #59297 @​QDyanbing
• 🐞 Fix Anchor scrolling and Table and Transfer range selection using stale values after updates. #59308 @​QDyanbing
• 🐞 Fix Select inconsistent single and multiple heights after customizing global fontSize or lineHeight. #59298 @​zombieJ
• 🤖 Fix Tooltip, Popover, Popconfirm, and Slider TypeScript definitions accepting unsupported rc Tooltip props. #59288 @​QDyanbing
• 🛎 Fix Drawer not warning that destroyOnClose is deprecated. #59299 @​dogledogle

6.6.4

2026-09-14

• 🗑 Deprecate legacy Avatar GroupProps, BackTop and FloatButton BackTopProps, Input GroupProps, Mentions OptionProps, and Select OptionProps types in favor of GetProps or option-derived types. #58949 @​li-jia-nan
• 🐞 Fix AutoComplete missing classNames.clear and styles.clear semantic customizations for the clear button. #59245 @​lazerg
• Table
  • 🐞 Fix Table filteredValue being ignored when responsive columns are hidden. #59198 @​QDyanbing
  • 🐞 Fix Table ignoring pagination.classNames and pagination.styles semantic customizations. #59267 @​QDyanbing
  • 🐞 Fix Table virtual cell content not being vertically centered. #59260 @​QDyanbing
• Modal
  • 🐞 Fix Modal okText and cancelText falling back to default text for falsy ReactNode values. #59254 @​QDyanbing
  • 🐞 Fix Modal not triggering onCancel when cancelButtonProps.onClick is provided. #59255 @​QDyanbing
• ColorPicker
  • 🐞 Fix ColorPicker clear control remaining interactive and showing hover styles when disabled. #59164 @​dogledogle
  • 🐞 Fix ColorPicker modifying presets and crashing when preset items are frozen. #59272 @​QDyanbing
• 🐞 Fix Splitter panel sizes exceeding their min and max constraints when the container resizes. #59084 @​QDyanbing
• 🐞 Fix Segmented selected item text color lagging behind the thumb animation when custom itemSelectedBg and itemSelectedColor tokens are used. #59046 @​EmilyyyLiu
• 🐞 Fix Transfer restoring stale selections after dataSource item key types change. #59166 @​QDyanbing
• 🐞 Fix FloatButton.Group menu flickering when moving the pointer from the trigger to the menu with trigger="hover". #59246 @​QDyanbing
• 🐞 Fix Form vertical Form.Item controls shrinking inside horizontal layouts. #59263 @​QDyanbing
• 🐞 Fix Tabs more dropdown ignoring styles.popup.root. #59221 @​giaBaoJS
• 🐞 Fix ConfigProvider failing to inherit zeroRuntime in nested themes when inherit is false. #59250 @​QDyanbing

6.6.3

2026-09-07

• 🐞 Fix DatePicker and TimePicker rendering issues when prefix, suffixIcon, allowClear.clearIcon, or the value returned by renderExtraFooter is 0. #59212 react-component/picker#1009 @​github-actions @​QDyanbing
• 🐞 Fix Modal and Drawer mask click closing behavior when reusing a mask configuration object. #59233 @​giaBaoJS
• 🤖 Fix Select, AutoComplete, Cascader, and TreeSelect popupRender types to accept ReactElement and return ReactNode. #59207 @​QDyanbing
• DatePicker
  • 🇩🇪 Fix DatePicker using incorrect default date and date-time formats with the German locale, using DD.MM.YYYY and DD.MM.YYYY HH:mm:ss respectively. #59151 @​nrps9909

... (truncated)

Commits

• 4a39f54 chore(deps): update dependency size-limit to v14 (#59339)
• 74f6318 chore(deps): update dependency dotenv to v18 (#59338)
• 2baea10 docs: changelog for 6.6.5 (#59333)
• 492d78e chore(deps): update codecov/codecov-action digest to 303a32d (#59334)
• 050dd0e chore(deps): update jest dependencies to v30.5.2 (#59335)
• 51dd67f chore(deps): update dependency @​size-limit/file to v14 (#59337)
• fea0690 fix(demo): use prefixCls instead of token.antCls in Table demos (#59327)
• e12b757 fix(demo): use public GetProps type in Avatar demo (#59328)
• 91a6d1d chore(workflow): run upgrade deps at 08:00 Beijing time (#59322)
• f045034 fix(Upload): keep Dragger style height when height prop is unset (#59319)
• Additional commits viewable in compare view

Updates axios from 1.18.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

• HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

• Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

• Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
• Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
• XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
• Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
• Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

• Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
• Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
• Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
• CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​yens1 (#11109)
• @​Sasireddy001 (#11113)
• @​ari-token-security (#11094)
• @​timothyokooboh (#11097)
• @​gi9439041-png (#11119)
• @​Hashim1999164 (#11082)
• @​v-dev-cl (#11091)
• @​r0h1tb (#11118)
• @​ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero a...

  Description has been truncated