chore(deps): bump axios from 0.27.2 to 0.33.0 by dependabot[bot] · Pull Request #4367 · linuxfoundation/crowd.dev

dependabot · 2026-07-20T17:55:16Z

Bumps axios from 0.27.2 to 0.33.0.

Release notes

v0.33.0 — June 13, 2026

This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

🔒 Security Fixes

Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats 0.0.0.0 as local for proxy bypass. (#11001)

🚀 New Features

Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#10937)

🔧 Maintenance & Chores

Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#10936, #10943)

Changelog: Backfills missing v0.x changelog entries for prior releases. (#10842)

Release Metadata: Bumps package and internal version metadata for v0.33.0. (#11002)

Full Changelog

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

🔒 Security Fixes

Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)

Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)

Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)

Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)

Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)

URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)

Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

🔧 Maintenance & Chores

Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

Full Changelog

v0.31.1

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)

... (truncated)

Commits

d998cc9 chore: release v0.33.0 (#11002)
1417285 fix: improve request config handling (#11001)
ff12ec1 ci: stop caching npm (#10943)
b2a702f feat: add node 26 to matrix (#10937)
31b7bdf ci(publish): adopt npm staged publishing on v0.x (#10936)
5436976 chore: update changelog (#10842)
8db2d44 chore: bump version to v0.32.0 (#10840)
2af6116 chore: backport fixes from the v1x branch (#10838)
a589dc5 chore: bump version to v0.31.1 (#10766)
b0c632f fix: backport security issues (#10764)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

cursor · 2026-07-20T17:55:24Z

PR Summary

Medium Risk
axios is used broadly for integrations and enrichment; 0.32–0.33 include breaking config-merge behavior and security hardening, and several packages move down from axios 1.x, so regressions in HTTP clients are plausible without broad tests.

Overview
Pins the backend and many workspace packages to axios ^0.33.0, replacing the prior mix of 0.27.2 on backend and assorted ~1.6.x / ^1.x declarations across workers and libs (common_services, database, integrations, nango, opensearch, etc.).

The pnpm-lock.yaml refresh collapses multiple resolved axios 1.x versions to a single 0.33.0 install for those workspaces, with incidental lockfile churn (e.g. Clearbit needle git URL, AWS SDK client peer wiring, transitive form-data / follow-redirects).

No application source changes—only dependency manifests and the lockfile. Reviewers should smoke-test outbound HTTP (integrations, enrichment, Nango, GitHub/Octokit paths) given 0.32+ behavior changes (null-prototype merged config, stricter proxy/socket handling, default error redaction).

^{Reviewed by Cursor Bugbot for commit e89678b. Bugbot is set up for automated code reviews on this repo. Configure here.}

CLAassistant · 2026-07-20T17:55:26Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

github-actions · 2026-07-20T17:55:37Z

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

feat: add user authentication (CM-123)
feat: add user authentication (IN-123)

Projects:

CM: Community Data Platform
IN: Insights

Please add a Jira issue key to your PR title.

Bumps [axios](https://github.com/axios/axios) from 0.27.2 to 0.33.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.27.2...v0.33.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e89678b. Configure here.}

cursor · 2026-07-23T09:01:28Z

-  needle@https://codeload.github.com/clearbit/needle/tar.gz/84d28b5f2c3916db1e7eb84aeaa9d976cc40054b:
-    resolution: {tarball: https://codeload.github.com/clearbit/needle/tar.gz/84d28b5f2c3916db1e7eb84aeaa9d976cc40054b}
+  needle@git+https://git@github.com:clearbit/needle.git#84d28b5f2c3916db1e7eb84aeaa9d976cc40054b:
+    resolution: {commit: 84d28b5f2c3916db1e7eb84aeaa9d976cc40054b, repo: git@github.com:clearbit/needle.git, type: git}


Clearbit needle needs SSH install

High Severity

Regenerating the lockfile replaced Clearbit’s needle dependency from an HTTPS tarball with a git resolution using git@github.com. Fresh pnpm install for backend (which depends on clearbit) may fail in environments that only allow HTTPS dependency fetch and lack SSH keys for GitHub.

Additional Locations (1)

pnpm-lock.yaml#L15613-L15614

^{Reviewed by Cursor Bugbot for commit e89678b. Configure here.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 20, 2026

dependabot Bot changed the title ~~chore(deps): bump axios from 1.13.1 to 1.18.0~~ chore(deps): bump axios from 0.27.2 to 0.33.0 Jul 22, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/axios-1.18.0 branch from dd180e8 to 95a4e6c Compare July 22, 2026 11:08

dependabot Bot force-pushed the dependabot/npm_and_yarn/axios-1.18.0 branch from 95a4e6c to e89678b Compare July 23, 2026 08:56

cursor Bot reviewed Jul 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump axios from 0.27.2 to 0.33.0#4367

chore(deps): bump axios from 0.27.2 to 0.33.0#4367
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/axios-1.18.0

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.33.0 — June 13, 2026

🔒 Security Fixes

🚀 New Features

🔧 Maintenance & Chores

v0.32.0 — May 4, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🔧 Maintenance & Chores

v0.31.1

⚠️ Breaking Changes & Deprecations

Uh oh!

cursor Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

CLAassistant commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 23, 2026

Choose a reason for hiding this comment

Clearbit needle needs SSH install

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

cursor Bot commented Jul 20, 2026 •

edited

Loading