v1.17.0 — June 1, 2026
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
- Config Hardening: Guarded
socketPath,params, andparamsSerializerreads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922) - Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)
🚀 New Features
- HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with
transitional.advertiseZstdAcceptEncodingcontrolling whetherzstdis advertised inAccept-Encoding. (#6792, #10920)
🐛 Bug Fixes
- Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
- Proxy TLS: Preserved user
httpsAgentTLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957) - React Native FormData: Cleared default
Content-Typefor React NativeFormDataso multipart boundaries can be generated correctly. (#10898) - Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
- Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
- Bundler Compatibility: Converted
resolveConfigfrom an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891) - Types: Corrected
AxiosHeaders.toJSON()return types and updated CommonJSisCanceltypings to narrow toCanceledError<T>. (#10956, #10952) - Build Tooling: Avoided emitting a null
Authorizationheader from the GitHub build helper whenGITHUB_TOKENis unset. (#10931)
🔧 Maintenance & Chores
- HTTP/2 Internals: Extracted
Http2Sessionsinto its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861) - Package Publishing: Reduced published package size by switching to a
filesallowlist and dropping unneeded unminified bundle source maps. (#10939) - CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
- Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
- Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
- Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright,
fs-extra,qs, docs dependencies, and GitHub Actions dependencies includingactions/dependency-review-actionandzizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios: