dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
b4ae648153
Bumps the axios group with 1 update in the / directory: [axios](https://github.com/axios/axios). Updates `axios` from 1.15.0 to 1.15.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.15.1</h2> <p>This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Header Injection Hardening:</strong> Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (<strong><a href="https://redirect.github.com/axios/axios/issues/10749">#10749</a></strong>)</li> <li><strong>CRLF Stripping in Multipart Headers:</strong> Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (<strong><a href="https://redirect.github.com/axios/axios/issues/10758">#10758</a></strong>)</li> <li><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe <code>in</code> checks with <code>hasOwnProperty</code> to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (<strong><a href="https://redirect.github.com/axios/axios/issues/10761">#10761</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10760">#10760</a></strong>)</li> <li><strong><code>withXSRFToken</code> Truthy Bypass:</strong> Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10762">#10762</a></strong>)</li> <li><strong><code>maxBodyLength</code> With Zero Redirects:</strong> Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code> is set to <code>0</code>, closing a bypass path for oversized request bodies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10753">#10753</a></strong>)</li> <li><strong>Streamed Response <code>maxContentLength</code> Bypass:</strong> Applies <code>maxContentLength</code> to streamed responses that previously bypassed the cap. (<strong><a href="https://redirect.github.com/axios/axios/issues/10754">#10754</a></strong>)</li> <li><strong>Follow-up CVE Completion:</strong> Completes an earlier incomplete CVE fix to fully close the regression window. (<strong><a href="https://redirect.github.com/axios/axios/issues/10755">#10755</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>AI-Based Docs Translations:</strong> Initial scaffold for AI-assisted translations of the documentation site. (<strong><a href="https://redirect.github.com/axios/axios/issues/10705">#10705</a></strong>)</li> <li><strong><code>Location</code> Request Header Type:</strong> Adds <code>Location</code> to <code>CommonRequestHeadersList</code> for accurate typing of redirect-aware requests. (<strong><a href="https://redirect.github.com/axios/axios/issues/7528">#7528</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>FormData Handling:</strong> Removes <code>Content-Type</code> when no boundary is present on <code>FormData</code> fetch requests, supports multi-select fields, cancels <code>request.body</code> instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10676">#10676</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10726">#10726</a></strong>)</li> <li><strong>HTTP Adapter:</strong> Handles socket-only request errors without leaking keep-alive listeners. (<strong><a href="https://redirect.github.com/axios/axios/issues/10576">#10576</a></strong>)</li> <li><strong>Progress Events:</strong> Clamps <code>loaded</code> to <code>total</code> for computable upload/download progress events. (<strong><a href="https://redirect.github.com/axios/axios/issues/7458">#7458</a></strong>)</li> <li><strong>Types:</strong> Aligns <code>runWhen</code> type with the runtime behaviour in <code>InterceptorManager</code> and makes response header keys case-insensitive. (<strong><a href="https://redirect.github.com/axios/axios/issues/7529">#7529</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10677">#10677</a></strong>)</li> <li><strong><code>buildFullPath</code>:</strong> Uses strict equality in the base/relative URL check. (<strong><a href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</li> <li><strong><code>AxiosURLSearchParams</code> Regex:</strong> Improves the regex used for param serialisation to avoid edge-case mismatches. (<strong><a href="https://redirect.github.com/axios/axios/issues/10736">#10736</a></strong>)</li> <li><strong>Resilient Value Parsing:</strong> Parses out header/config values instead of throwing on malformed input. (<strong><a href="https://redirect.github.com/axios/axios/issues/10687">#10687</a></strong>)</li> <li><strong>Docs Artefact Cleanup:</strong> Removes the docs content that was incorrectly committed. (<strong><a href="https://redirect.github.com/axios/axios/issues/10727">#10727</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li><strong>Threat Model & Security Docs:</strong> Ongoing refinement of <code>THREATMODEL.md</code>, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (<strong><a href="https://redirect.github.com/axios/axios/issues/10672">#10672</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10715">#10715</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10718">#10718</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10722">#10722</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10763">#10763</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10765">#10765</a></strong>)</li> <li><strong>Test Coverage & Migration:</strong> Expanded <code>shouldBypassProxy</code> coverage for wildcard/IPv6/edge cases, documented and tested <code>AxiosError.status</code>, and migrated <code>progressEventReducer</code> tests to Vitest. (<strong><a href="https://redirect.github.com/axios/axios/issues/10723">#10723</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10741">#10741</a></strong>)</li> <li><strong>Type Refactor:</strong> Uses TypeScript utility types to deduplicate literal unions. (<strong><a href="https://redirect.github.com/axios/axios/issues/7520">#7520</a></strong>)</li> <li><strong>Repo & CI:</strong> Adds <code>CODEOWNERS</code>, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (<strong><a href="https://redirect.github.com/axios/axios/issues/10739">#10739</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10738">#10738</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10746">#10746</a></strong>)</li> <li><strong>Changelog Backfill:</strong> Added missing version entries to the changelog. (<strong><a href="https://redirect.github.com/axios/axios/issues/10704">#10704</a></strong>)</li> <li><strong>Dependencies:</strong> Bumped <code>follow-redirects</code> (<code>1.15.11</code> → <code>1.16.0</code>) in root and docs, <code>axios</code> (<code>1.14.0</code> → <code>1.15.0</code>) in docs, and a group of 5 development dependencies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10717">#10717</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10716">#10716</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10684">#10684</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10709">#10709</a></strong>)</li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/curiouscoder-cmd"><code>@curiouscoder-cmd</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</li> <li><strong><a href="https://github.com/tryonelove"><code>@tryonelove</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7520">#7520</a></strong>)</li> <li><strong><a href="https://github.com/darwin808"><code>@darwin808</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>)</li> <li><strong><a href="https://github.com/zoontek"><code>@zoontek</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>)</li> <li><strong><a href="https://github.com/AKIB473"><code>@AKIB473</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.15.0...v1.15.1">Full Changelog</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.15.1 - April 19, 2026</h2> <p>This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Header Injection Hardening:</strong> Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (<strong><a href="https://redirect.github.com/axios/axios/issues/10749">#10749</a></strong>)</p> </li> <li> <p><strong>CRLF Stripping in Multipart Headers:</strong> Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (<strong><a href="https://redirect.github.com/axios/axios/issues/10758">#10758</a></strong>)</p> </li> <li> <p><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe <code>in</code> checks with <code>hasOwnProperty</code> to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (<strong><a href="https://redirect.github.com/axios/axios/issues/10761">#10761</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10760">#10760</a></strong>)</p> </li> <li> <p><strong><code>withXSRFToken</code> Truthy Bypass:</strong> Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10762">#10762</a></strong>)</p> </li> <li> <p><strong><code>maxBodyLength</code> With Zero Redirects:</strong> Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code> is set to <code>0</code>, closing a bypass path for oversized request bodies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10753">#10753</a></strong>)</p> </li> <li> <p><strong>Streamed Response <code>maxContentLength</code> Bypass:</strong> Applies <code>maxContentLength</code> to streamed responses that previously bypassed the cap. (<strong><a href="https://redirect.github.com/axios/axios/issues/10754">#10754</a></strong>)</p> </li> <li> <p><strong>Follow-up CVE Completion:</strong> Completes an earlier incomplete CVE fix to fully close the regression window. (<strong><a href="https://redirect.github.com/axios/axios/issues/10755">#10755</a></strong>)</p> </li> </ul> <h2>🚀 New Features</h2> <ul> <li> <p><strong>AI-Based Docs Translations:</strong> Initial scaffold for AI-assisted translations of the documentation site. (<strong><a href="https://redirect.github.com/axios/axios/issues/10705">#10705</a></strong>)</p> </li> <li> <p><strong><code>Location</code> Request Header Type:</strong> Adds <code>Location</code> to <code>CommonRequestHeadersList</code> for accurate typing of redirect-aware requests. (<strong><a href="https://redirect.github.com/axios/axios/issues/7528">#7528</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li> <p><strong>FormData Handling:</strong> Removes <code>Content-Type</code> when no boundary is present on <code>FormData</code> fetch requests, supports multi-select fields, cancels <code>request.body</code> instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (<strong><a href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10676">#10676</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10726">#10726</a></strong>)</p> </li> <li> <p><strong>HTTP Adapter:</strong> Handles socket-only request errors without leaking keep-alive listeners. (<strong><a href="https://redirect.github.com/axios/axios/issues/10576">#10576</a></strong>)</p> </li> <li> <p><strong>Progress Events:</strong> Clamps <code>loaded</code> to <code>total</code> for computable upload/download progress events. (<strong><a href="https://redirect.github.com/axios/axios/issues/7458">#7458</a></strong>)</p> </li> <li> <p><strong>Types:</strong> Aligns <code>runWhen</code> type with the runtime behaviour in <code>InterceptorManager</code> and makes response header keys case-insensitive. (<strong><a href="https://redirect.github.com/axios/axios/issues/7529">#7529</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10677">#10677</a></strong>)</p> </li> <li> <p><strong><code>buildFullPath</code>:</strong> Uses strict equality in the base/relative URL check. (<strong><a href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</p> </li> <li> <p><strong><code>AxiosURLSearchParams</code> Regex:</strong> Improves the regex used for param serialisation to avoid edge-case mismatches. (<strong><a href="https://redirect.github.com/axios/axios/issues/10736">#10736</a></strong>)</p> </li> <li> <p><strong>Resilient Value Parsing:</strong> Parses out header/config values instead of throwing on malformed input. (<strong><a href="https://redirect.github.com/axios/axios/issues/10687">#10687</a></strong>)</p> </li> <li> <p><strong>Docs Artefact Cleanup:</strong> Removes the docs content that was incorrectly committed. (<strong><a href="https://redirect.github.com/axios/axios/issues/10727">#10727</a></strong>)</p> </li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Threat Model & Security Docs:</strong> Ongoing refinement of <code>THREATMODEL.md</code>, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (<strong><a href="https://redirect.github.com/axios/axios/issues/10672">#10672</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10715">#10715</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10718">#10718</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10722">#10722</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10763">#10763</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10765">#10765</a></strong>)</p> </li> <li> <p><strong>Test Coverage & Migration:</strong> Expanded <code>shouldBypassProxy</code> coverage for wildcard/IPv6/edge cases, documented and tested <code>AxiosError.status</code>, and migrated <code>progressEventReducer</code> tests to Vitest. (<strong><a href="https://redirect.github.com/axios/axios/issues/10723">#10723</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10741">#10741</a></strong>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/ac42446be51300fe214ba3c6e40cc95f34fd6871"><code>ac42446</code></a> chore(release): prepare release 1.15.1 (<a href="https://redirect.github.com/axios/axios/issues/10767">#10767</a>)</li> <li><a href="https://github.com/axios/axios/commit/908f2206b6bfeff67236784abce85935698ac1d9"><code>908f220</code></a> docs: update threatmodel (<a href="https://redirect.github.com/axios/axios/issues/10765">#10765</a>)</li> <li><a href="https://github.com/axios/axios/commit/f93f8155250c2e066205521eda05ae22983a1f6d"><code>f93f815</code></a> docs: added docs around potential decompressions bomb (<a href="https://redirect.github.com/axios/axios/issues/10763">#10763</a>)</li> <li><a href="https://github.com/axios/axios/commit/1728aa1b15b8857f970611fd8983c06b423fc486"><code>1728aa1</code></a> fix: short-circuits on any truthy non-boolean in withXSRFToken (<a href="https://redirect.github.com/axios/axios/issues/10762">#10762</a>)</li> <li><a href="https://github.com/axios/axios/commit/42eb721eebc95cfded8d6c70cf62f3fbe83f3246"><code>42eb721</code></a> fix: replace in with has own prop util (<a href="https://redirect.github.com/axios/axios/issues/10761">#10761</a>)</li> <li><a href="https://github.com/axios/axios/commit/75873270a59bd5d895322eee145738e95fb89258"><code>7587327</code></a> fix: strip crlf correctly (<a href="https://redirect.github.com/axios/axios/issues/10758">#10758</a>)</li> <li><a href="https://github.com/axios/axios/commit/f0b98673b32677643a3b608431270d36e997473c"><code>f0b9867</code></a> chore: added additional testing for this issue (<a href="https://redirect.github.com/axios/axios/issues/10760">#10760</a>)</li> <li><a href="https://github.com/axios/axios/commit/e033f243a08e3514c03e510f76658da1e0fac3bd"><code>e033f24</code></a> fix: incomplete fix for cve (<a href="https://redirect.github.com/axios/axios/issues/10755">#10755</a>)</li> <li><a href="https://github.com/axios/axios/commit/e8904af03385b040e53f1263a444e825db4335d9"><code>e8904af</code></a> fix: stream response bypassed max content length (<a href="https://redirect.github.com/axios/axios/issues/10754">#10754</a>)</li> <li><a href="https://github.com/axios/axios/commit/1c7f6d76e58359daddf38a6e636dd801ffd9c61b"><code>1c7f6d7</code></a> fix: enforce max body length when max redirects is 0 (<a href="https://redirect.github.com/axios/axios/issues/10753">#10753</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.15.0...v1.15.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
GitHub Stats Extended
Dynamically generate GitHub stats for your READMEs.
This project is an extended version of github-readme-stats. It generates various stats cards, e.g. about your GitHub contributions, your top languages, etc. You can customize the cards via multiple parameters.
Table of Contents
Quick Start
- Copy and paste this into your markdown:
[](https://github.com/stats-organization/github-stats-extended) - Change the
?username=value to your GitHub username. - Done!
As more comfortable alternative, use the GitHub-Stats-Extended Wizard to create your custom stats card. Copy the generated markdown code and paste it into your GitHub profile README. Done!
Card Types
-
Show your GitHub statistics:
-
...your top languages...:
-
...and development time:
-
Pin more than 6 repos in your GitHub profile:
-
Pin Gists in your GitHub profile:
-
Customize all the cards:
Advanced Customization
The GitHub-Stats-Extended Wizard offers some essential customization options. For more advanced customization check out the advanced documentation.
Acknowledgements
This project is based on github-readme-stats. On top of their functionality I added several new features and improvements. See Fork Information for a list of changes. The frontend I added to the project is based on GitHub Trends. Big thanks to @anuraghazra, @avgupta456, @rickstaa, @qwerty541 and everyone else who worked on these projects! ❤️
Self-Hosting
Since the GitHub API only allows a limited number of requests per hour, the public instance of GitHub-Stats-Extended at https://github-stats-extended.vercel.app/api could possibly hit the rate limiter. If you host your own instance you do not have to worry about anything. Also, if you don't want to give my GitHub-Stats-Extended instance access to your private contributions but still want to include these contributions in your stats, you can simply host your own instance.
See Deploy on your own for various deployment options.
Contributing
Contributions are welcome!