Skip to content

Bump axios from 0.16.2 to 1.13.1 - #75

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/axios-1.13.1
Open

Bump axios from 0.16.2 to 1.13.1#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/axios-1.13.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2025

Copy link
Copy Markdown

Bumps axios from 0.16.2 to 1.13.1.

Release notes

Sourced from axios's releases.

Release v1.13.1

Release notes:

Bug Fixes

  • http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Release v1.13.0

Release notes:

Bug Fixes

  • fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
  • resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

Contributors to this release

Release v1.12.2

Release notes:

Bug Fixes

  • fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)

Contributors to this release

... (truncated)

Changelog

Sourced from axios's changelog.

1.13.1 (2025-10-28)

Bug Fixes

  • http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

1.13.0 (2025-10-27)

Bug Fixes

  • fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
  • resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes

... (truncated)

Commits
  • 1ef8e72 chore(release): v1.13.1 (#7194)
  • bcd5581 fix(http): fixed a regression that caused the data stream to be interrupted f...
  • c9b3371 chore: enhance styling and responsiveness in client.html (#7173)
  • 9ead04d [Release] v1.13.0 (#7189)
  • d000fbf fix(http2): fix possible race condition when handling http2 stream on almost ...
  • 08db960 docs: added example for improved network error handling (with Wrapper/Middlew...
  • 46e1981 refactor: form data handling in index.html (#7170)
  • 889f8ef docs: fix mismatched return type (#7172)
  • 7b197ef fix: sandbox ui updated (#7175)
  • 6dff629 chore: fix typos in examples (#7166)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by jasonsaayman, a new releaser for axios since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump axios from 0.16.2 to 1.13.1
5635125 
Bumps [axios](https://github.com/axios/axios) from 0.16.2 to 1.13.1.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.16.2...v1.13.1)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 29, 2025
@dependabot dependabot Bot mentioned this pull request Oct 29, 2025
Closed
@fossabot

fossabot Bot commented Oct 29, 2025 •
edited
Loading

Copy link
Copy Markdown

fossabot is Thinking

@fossabot

fossabot Bot commented Oct 29, 2025 •
edited
Loading

Copy link
Copy Markdown

Needs Review

I recommend reviewing this upgrade before merging because this is a major version jump from v0.16.2 to v1.13.1 that includes 11 breaking changes affecting TypeScript types, headers handling, and FormData behavior. While the codebase uses only basic axios methods (GET, POST, PUT, DELETE) that are compatible, the upgrade also addresses 21 critical security vulnerabilities including CVE-2024-39338 (SSRF), CVE-2025-27152 (credential leakage), and CVE-2025-54371 (form-data vulnerability). The security fixes are essential, but the breaking changes in type definitions and API behavior require verification that TypeScript compilation succeeds and all HTTP requests function correctly after the upgrade. Testing is recommended to ensure the basic CRUD operations in the five API modules continue working as expected.

What we checked

  • Axios upgraded from 0.16.2 to 1.13.1 - a major version jump spanning multiple breaking changes [1]
  • POST request using axios.post() - verify this continues to work with v1.x headers structure changes [2]
  • GET request using axios.get() - verify response.data structure remains compatible with v1.x [3]
  • PUT request using axios.put() - ensure compatibility with v1.x changes to request handling [4]
  • TypeScript strict mode enabled - must verify axios v1.x type definitions work with strict type checking given breaking changes to AxiosRequestConfig and type interfaces [5]
  • Breaking change: TypeScript types renamed RawAxiosRequestConfig back to AxiosRequestConfig in v1.2.3 [6]
  • Breaking change: Removed functionality that removed Content-Type header when passing FormData in v0.27.0 [7]
  • Security fix: CVE-2023-45857 CSRF vulnerability patched - requires testing CSRF protection behavior [8]
  • Security fix: CVE-2024-39338 Server-Side Request Forgery vulnerability patched [9]
  • Community migration guide available documenting headers structure, TypeScript interface changes, and import statement updates required for v1.0.0+ [10]

Dependency Usage

axios serves as the core HTTP client for the application's user management API layer, powering all CRUD operations (create, fetch, update, delete) across five dedicated client-side API modules in the src/client/api directory. This dependency enables complete REST API communication for user resource management, with each module handling a specific HTTP method (GET, POST, PUT, DELETE) to interact with the backend users endpoint. The architecture follows a modular pattern where axios is consistently used for promise-based HTTP requests, providing the foundation for all external API interactions in the application's client layer.

View 1 more usage
Less Important Usages (5)

These usages were analyzed but no breaking changes were detected:

axios

Changes

axios upgraded with 18 security fixes addressing critical vulnerabilities including CVE-2024-39338, CSRF vulnerability CVE-2023-45857, formToJSON prototype pollution, follow-redirects security issues, ReDoS vulnerability, and XSS prevention fixes. The upgrade also includes 11 breaking changes primarily affecting TypeScript types (RawAxiosRequestConfig renamed, AxiosRequestConfig interface changes), removal of webpack and unused imports, and changes to FormData Content-Type handling behavior.

  • types: removed duplicated code (9e62056) (v1.5.0, changelog)
  • types: renamed RawAxiosRequestConfig back to AxiosRequestConfig; (#5486) (2a71f49) (v1.2.3, changelog)
  • Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an axios instance #4248 (v1.0.0, changelog)
View 923 more changes
References (10)

[1]: Axios upgraded from 0.16.2 to 1.13.1 - a major version jump spanning multiple breaking changes

dependabot-metadata-test/package.json

Line 17 in 5635125

"axios": "1.13.1",

[2]: POST request using axios.post() - verify this continues to work with v1.x headers structure changes

dependabot-metadata-test/src/client/api/createUser.ts

Line 7 in 5635125

const response = await axios.post(`${API_URL}/users`, userData);

[3]: GET request using axios.get() - verify response.data structure remains compatible with v1.x

dependabot-metadata-test/src/client/api/fetchUser.ts

Line 7 in 5635125

const response = await axios.get(`${API_URL}/users/${id}`);

[4]: PUT request using axios.put() - ensure compatibility with v1.x changes to request handling

dependabot-metadata-test/src/client/api/updateUser.ts

Line 7 in 5635125

const response = await axios.put(`${API_URL}/users/${id}`, userData);

[5]: TypeScript strict mode enabled - must verify axios v1.x type definitions work with strict type checking given breaking changes to AxiosRequestConfig and type interfaces

dependabot-metadata-test/tsconfig.json

Line 18 in 5635125

"strict": true,

[6]: Breaking change: TypeScript types renamed RawAxiosRequestConfig back to AxiosRequestConfig in v1.2.3 (source link)

[7]: Breaking change: Removed functionality that removed Content-Type header when passing FormData in v0.27.0 (source link)

[8]: Security fix: CVE-2023-45857 CSRF vulnerability patched - requires testing CSRF protection behavior (source link)

[9]: Security fix: CVE-2024-39338 Server-Side Request Forgery vulnerability patched (source link)

[10]: Community migration guide available documenting headers structure, TypeScript interface changes, and import statement updates required for v1.0.0+ (source link)

fossabot analyzed this PR using static analysis and dependency research.

@github-actions

github-actions Bot commented Oct 29, 2025

Copy link
Copy Markdown

🤖 Dependabot Metadata:

  • Dependency Names: axios
  • Package Ecosystem: npm_and_yarn
  • From version: 0.16.2
  • To version: 1.13.1
  • URL: ``
  • Compatibility Score: 0
  • Maintainer Changes: true
  • Update Type: version-update:semver-major
  • Updated Dependencies JSON: [{"dependencyName":"axios","dependencyType":"direct:production","updateType":"version-update:semver-major","directory":"/","packageEcosystem":"npm_and_yarn","targetBranch":"main","prevVersion":"0.16.2","newVersion":"1.13.1","compatScore":0,"maintainerChanges":true,"dependencyGroup":"","alertState":"","ghsaId":"","cvss":0}]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

compatibility-score:0 dependencies Pull requests that update a dependency file dependency-names:axios from:0.16.2 javascript Pull requests that update Javascript code to:1.13.1 update-type:version-update:semver-major

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants