This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and zizmor scanning, resolves TypeScript typing issues in AxiosInstance, and fixes a performance regression in isEmptyObject().
🔒 Security Fixes
-
Header Injection & Proxy Bypass: Backports v1 security hardening — sanitizes outgoing header values to strip invalid bytes, CRLF sequences, and boundary whitespace (including array values); adds proper
NO_PROXY/no_proxyenforcement covering wildcards, explicit ports, loopback aliases (localhost,127.0.0.1,::1), bracketed IPv6, and trailing-dot hostnames. Proxy bypass is now checked before the proxy URL is parsed, andparsed.hostis used for correct port and IPv6 handling. (#10688) -
CI Security: SHA-pins all actions and disables credential persistence in v0.x CI, introduces
zizmorsecurity scanning with SARIF upload to code scanning, adds an OIDC Trusted Publishing workflow with npm provenance attestations, and gates all publishes behind a requirednpm-publishGitHub Environment with configurable reviewer protections. (#10638, #10639, #10667)
🐛 Bug Fixes
-
TypeScript —
AxiosInstanceReturn Types: Fixes return types inAxiosInstancemethods to correctly resolve toPromise<R>(matchingAxiosPromise<T>semantics), and corrects the generic call signature so TypeScript properly enforces the response data type. TypeScript-only changes; no runtime impact. (#6253, #7328) -
Performance: Fixes a performance regression in
isEmptyObject()that caused excessive computation when the argument was a large string. (#6484)
🔧 Maintenance & Chores
- Versioning & CI Workflow: Adds an automated versioning flow for v0.x, renames the CI workflow for consistency with the v1.x naming convention, and corrects the branch name reference in CI config. (#10690, #10691, #10692)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios: