[updateclibot]

Bump "axios" package version

Bump "axios" package version to 1.21.0

ran shell command "npm install --package-lock-only --dry-run=$DRY_RUN axios@1.21.0"

v1.21.0

## v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

## ⚠️ Breaking Changes & Deprecations

* **Header Defaults:** Only plain objects, null-prototype maps, and compatible `AxiosHeaders` instances are treated as common or method-specific defaults; literal headers such as `Link` are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example `{ post: { ...customDefaults } }`, or compatible `AxiosHeaders`. Otherwise, those instances become literal header values, including on requests using other methods. (__[#11156](https://github.com/axios/axios/pull/11156)__)

## 🚀 New Features

* **Response Timing:** Added `response.duration`, in milliseconds, including on `error.response` when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing `duration` value supplied by a custom adapter. (__[#11214](https://github.com/axios/axios/pull/11214)__)
* **UTF-8 Basic Authentication:** Added `transitional.encodeBasicAuthUsername: true` to support Unicode usernames in XHR and Fetch requests. The option defaults to `false`, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (__[#11159](https://github.com/axios/axios/pull/11159)__)

## 🐛 Bug Fixes

* **Fetch Compatibility:** Restored requests in runtimes such as Cloudflare Workers that reject the implicit `cache: 'default'`, while preserving explicit caller settings. Response-size failures now retain their original `ERR_BAD_RESPONSE` and request context when runtime wrappers replace the underlying stream error. (__[#11194](https://github.com/axios/axios/pull/11194)__, __[#11179](https://github.com/axios/axios/pull/11179)__)
* **Runtime Consistency:** Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with `ERR_BAD_OPTION_VALUE`, and sparse or non-index numeric form fields serialize as keyed objects. With `proxy: false`, native `proxyEnv` agents using unsupported pool-management or TLS-session lifecycle overrides now reject with `ERR_BAD_OPTION_VALUE`; construct those agents without `proxyEnv`. (__[#11242](https://github.com/axios/axios/pull/11242)__)
* **Header Handling:** Preserved headers named `__proto__` using safe casing without changing the `AxiosHeaders` instance prototype. Function matchers in `has()`, `delete()`, and `clear()` now receive the headers instance as `this`, matching their declared contract. (__[#11134](https://github.com/axios/axios/pull/11134)__, __[#11216](https://github.com/axios/axios/pull/11216)__)
* **URL and Data URL Parsing:** Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (__[#11138](https://github.com/axios/axios/pull/11138)__, __[#11163](https://github.com/axios/axios/pull/11163)__, __[#11294](https://github.com/axios/axios/pull/11294)__)
* **Error Diagnostics:** Preserved short reconstructed request stacks and appended wrapped error stacks under `Caused by:` so tooling that reads only `error.stack` retains the original failure context. (__[#11132](https://github.com/axios/axios/pull/11132)__, __[#11142](https://github.com/axios/axios/pull/11142)__)
* **Interceptor Removal:** Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (__[#11139](https://github.com/axios/axios/pull/11139)__)
* **Proxy TLS:** HTTPS CONNECT tunnels now apply current origin TLS options from an explicit `httpsAgent`, or from `https.globalAgent` when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (__[#11178](https://github.com/axios/axios/pull/11178)__)
* **XHR Lifecycle:** Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (__[#11166](https://github.com/axios/axios/pull/11166)__, __[#11225](https://github.com/axios/axios/pull/11225)__)
* **HTTP/2 Sessions:** Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (__[#11210](https://github.com/axios/axios/pull/11210)__)
* **TypeScript Declarations:** Exposed the response-default marker as a public type to resolve `TS2527` when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (__[#11125](https://github.com/axios/axios/pull/11125)__)

## 🔧 Maintenance & Chores

* **Configuration Performance:** Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (__[#11208](https://github.com/axios/axios/pull/11208)__)
* **Same-Origin Checks:** Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (__[#11174](https://github.com/axios/axios/pull/11174)__)
* **Dependencies:** Updated `follow-redirects` to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused `dayjs` from the docs package, root `chalk`, and `chai` from CJS module tests. (__[#11169](https://github.com/axios/axios/pull/11169)__, __[#11188](https://github.com/axios/axios/pull/11188)__, __[#11189](https://github.com/axios/axios/pull/11189)__, __[#11195](https://github.com/axios/axios/pull/11195)__, __[#11212](https://github.com/axios/axios/pull/11212)__, __[#11213](https://github.com/axios/axios/pull/11213)__, __[#11218](https://github.com/axios/axios/pull/11218)__, __[#11220](https://github.com/axios/axios/pull/11220)__, __[#11221](https://github.com/axios/axios/pull/11221)__, __[#11230](https://github.com/axios/axios/pull/11230)__, __[#11234](https://github.com/axios/axios/pull/11234)__, __[#11244](https://github.com/axios/axios/pull/11244)__, __[#11245](https://github.com/axios/axios/pull/11245)__, __[#11266](https://github.com/axios/axios/pull/11266)__, __[#11267](https://github.com/axios/axios/pull/11267)__, __[#11268](https://github.com/axios/axios/pull/11268)__, __[#11269](https://github.com/axios/axios/pull/11269)__, __[#11270](https://github.com/axios/axios/pull/11270)__, __[#11271](https://github.com/axios/axios/pull/11271)__, __[#11272](https://github.com/axios/axios/pull/11272)__, __[#11298](https://github.com/axios/axios/pull/11298)__, __[#11302](https://github.com/axios/axios/pull/11302)__, __[#11303](https://github.com/axios/axios/pull/11303)__, __[#11304](https://github.com/axios/axios/pull/11304)__, __[#11305](https://github.com/axios/axios/pull/11305)__, __[#11306](https://github.com/axios/axios/pull/11306)__, __[#11313](https://github.com/axios/axios/pull/11313)__, __[#11321](https://github.com/axios/axios/pull/11321)__, __[#11322](https://github.com/axios/axios/pull/11322)__, __[#11323](https://github.com/axios/axios/pull/11323)__, __[#11342](https://github.com/axios/axios/pull/11342)__)
* **Documentation:** Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (__[#11228](https://github.com/axios/axios/pull/11228)__, __[#11149](https://github.com/axios/axios/pull/11149)__, __[#11335](https://github.com/axios/axios/pull/11335)__)
* **Contributor Workflow:** Consolidated agent instructions in `AGENTS.md`, standardized PR labels, required prerelease notes and validation evidence, and clarified that `npm test` requires installed Playwright browsers. (__[#11238](https://github.com/axios/axios/pull/11238)__, __[#11273](https://github.com/axios/axios/pull/11273)__, __[#11223](https://github.com/axios/axios/pull/11223)__, __[#11284](https://github.com/axios/axios/pull/11284)__)
* **Sponsors and Support:** Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (__[#11222](https://github.com/axios/axios/pull/11222)__, __[#11249](https://github.com/axios/axios/pull/11249)__, __[#11252](https://github.com/axios/axios/pull/11252)__, __[#11341](https://github.com/axios/axios/pull/11341)__)
* **Proxy Regression Coverage:** Added a long dotted request-hostname test for `NO_PROXY` handling, extending coverage of an existing denial-of-service fix. (__[#11235](https://github.com/axios/axios/pull/11235)__)
* **Release Preparation:** Updated package version metadata for 1.21.0. (__[#11346](https://github.com/axios/axios/pull/11346)__)

## 🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

* __@lazerg__ (__[#11194](https://github.com/axios/axios/pull/11194)__)
* __@QIU-Guanzong__ (__[#11228](https://github.com/axios/axios/pull/11228)__)
* __@Iams4kura__ (__[#11125](https://github.com/axios/axios/pull/11125)__)
* __@vjymisal0__ (__[#11179](https://github.com/axios/axios/pull/11179)__)
* __@jarrensj__ (__[#11238](https://github.com/axios/axios/pull/11238)__)
* __@LineGu__ (__[#11132](https://github.com/axios/axios/pull/11132)__)
* __@luantaraschi__ (__[#11134](https://github.com/axios/axios/pull/11134)__)
* __@Cyberhet__ (__[#11284](https://github.com/axios/axios/pull/11284)__)
* __@nyxst4ck__ (__[#11138](https://github.com/axios/axios/pull/11138)__)
* __@windcrestai__ (__[#11163](https://github.com/axios/axios/pull/11163)__)
* __@kazuki-netizen__ (__[#11294](https://github.com/axios/axios/pull/11294)__)
* __@bilashcse__ (__[#11139](https://github.com/axios/axios/pull/11139)__)
* __@JiuYue0820__ (__[#11149](https://github.com/axios/axios/pull/11149)__)
* __@official-burak__ (__[#11156](https://github.com/axios/axios/pull/11156)__)
* __@contactjawad__ (__[#11159](https://github.com/axios/axios/pull/11159)__)
* __@wittachai-as__ (__[#11174](https://github.com/axios/axios/pull/11174)__)
* __@yiheng-kkk__ (__[#11166](https://github.com/axios/axios/pull/11166)__)
* __@ShikeChen01__ (__[#11208](https://github.com/axios/axios/pull/11208)__)
* __@cuishuang__ (__[#11210](https://github.com/axios/axios/pull/11210)__)
* __@Truenocancion__ (__[#11225](https://github.com/axios/axios/pull/11225)__)
* __@jakezwang__ (__[#11216](https://github.com/axios/axios/pull/11216)__)
* __@Adityagarg2712__ (__[#11214](https://github.com/axios/axios/pull/11214)__)
* __@Zandereins__ (__[#11235](https://github.com/axios/axios/pull/11235)__)
* __@Plastic-time__ (__[#11335](https://github.com/axios/axios/pull/11335)__)

[Full Changelog](https://github.com/axios/axios/compare/v1.20.0...v1.21.0)

GitHub Action workflow link

---

Created automatically by Updatecli Options: Most of Updatecli configuration is done via its manifest(s). If you close this pull request, Updatecli will automatically reopen it, the next time it runs. If you close this pull request and delete the base branch, Updatecli will automatically recreate it, erasing all previous commits made. Feel free to report any issues at github.com/updatecli/updatecli. If you find this tool useful, do not hesitate to star our GitHub repository as a sign of appreciation, and/or to tell us directly on our chat!

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 07802d3e-cac3-4f8b-b8a8-1ebb543b9515

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn