Skip to content

chore(deps)(deps): bump the frontend-patch group in /frontend with 3 updates - #13

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/frontend/frontend-patch-6d58fb400b
Open

chore(deps)(deps): bump the frontend-patch group in /frontend with 3 updates#13
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/frontend/frontend-patch-6d58fb400b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown

Bumps the frontend-patch group in /frontend with 3 updates: axios, autoprefixer and postcss.

Updates axios from 1.16.0 to 1.21.1

Release notes

Sourced from axios's releases.

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

  • follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)

🐛 Bug Fixes

  • Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)
  • TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#11404)

🔧 Maintenance & Chores

  • Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

    • transformRequest runs for every method, and transformers receive (data, headers, status).
    • responseType and Content-Type have no default value.
    • AxiosHeaders#get and #normalize are described correctly.
    • Errors should be identified with axios.isAxiosError(), not by name.
    • The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.
    • New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

    (#11374, #11373, #11389, #11419, #11429, #11430)

  • Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)

  • Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)

  • CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#11396)

  • Dependencies: Updated development and tooling dependencies, including vitest and @vitest/* (to 5.x at the root), typescript (7.x at the root), vite, rollup, eslint, playwright, @commitlint/*, @rollup/plugin-alias, @rollup/plugin-terser, body-parser, multer, serialize-javascript, fast-uri, qs, zizmorcore/zizmor-action, and follow-redirects in /docs. (#11383, #11375, #11372, #11345, #11392, #11387, #11386, #11385, #11391, #11388, #11395, #11421, #11422, #11426)

  • Release: Prepared the 1.21.1 release. (#11435)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 335e2f8 chore(release): prepare release 1.21.1 (#11435)
  • c07e981 docs: note that FormData parsing has a fixed depth limit (#11430)
  • f0fcec7 test(helpers): cover IDN, CIDR and port edge cases in shouldBypassProxy (#11431)
  • 4f203a9 docs(i18n): add locale prefix to internal links in es, fr, zh docs (#11401)
  • 98156ee docs: correct request config and AxiosHeaders descriptions (#11389)
  • a81d62a test: cover cancellation lifecycle and timeout precedence (#11376)
  • a42a19a docs: add missing error codes to the error tables (#11429)
  • 1fcaf82 chore(deps-dev): refresh development dependencies (#11426)
  • fb88a1b chore(deps-dev): bump the development_dependencies group with 4 updates (#11422)
  • 31cc02a chore(deps): bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 in the github-...
  • Additional commits viewable in compare view

Updates autoprefixer from 10.5.0 to 10.6.2

Release notes

Sourced from autoprefixer's releases.

10.6.2

  • Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
  • Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
  • Fixed selector duplicates on multiple Autoprefixer runs.
  • Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
  • Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
  • Fixed source maps for Grid prefixes (by @​dualfroz).

10.6.1

  • Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

10.5.6

10.5.5

10.5.4

10.5.3

10.5.2

  • Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

Changelog

Sourced from autoprefixer's changelog.

10.6.2

  • Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
  • Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
  • Fixed selector duplicates on multiple Autoprefixer runs.
  • Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
  • Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
  • Fixed source maps for Grid prefixes (by @​dualfroz).

10.6.1

  • Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

10.5.6

10.5.5

10.5.4

10.5.3

10.5.2

  • Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

Commits
  • a7dbf4d Release 10.6.2 version
  • c3cd98d Fix selector duplicates on multiple Autoprefixer runs
  • 5ae399e Keep unprefixed selectors in prefixed grouping rules (#1561)
  • 50ca3e2 Fix -webkit-cross-fade() for images with numbers (#1562)
  • 0efb61b Add /* autoprefixer: ignore next warning */ control comment (#1560)
  • 7ca1fad Set source for Grid prefixes in source maps (#1559)
  • c6d89bc Fix case-insensitive pseudo-selector prefixing (#1558)
  • c99614d Release 10.6.1 version
  • f1d08cb Update dependencies
  • cf1ebcb Fix grid gap inheritance from row-gap and column-gap longhands (#1557)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.


Updates postcss from 8.5.14 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the frontend-patch group
6ba8b50 
Bumps the frontend-patch group in /frontend with 3 updates: [axios](https://github.com/axios/axios), [autoprefixer](https://github.com/postcss/autoprefixer) and [postcss](https://github.com/postcss/postcss).


Updates `axios` from 1.16.0 to 1.21.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.21.1)

Updates `autoprefixer` from 10.5.0 to 10.6.2
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.0...10.6.2)

Updates `postcss` from 8.5.14 to 8.5.32
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.14...8.5.32)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-patch
- dependency-name: autoprefixer
  dependency-version: 10.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-patch
- dependency-name: postcss
  dependency-version: 8.5.32
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies 依赖更新与升级 frontend 前端（React / 样式） labels Nov 13, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies 依赖更新与升级 frontend 前端（React / 样式）

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants