build(deps): Bump axios from 1.15.0 to 1.15.1 in the axios group across 1 directory (#184)
Bumps the axios group with 1 update in the / directory:
[axios](https://github.com/axios/axios).
Updates `axios` from 1.15.0 to 1.15.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.15.1</h2>
<p>This release ships a coordinated set of security hardening fixes
across headers, body/redirect limits, multipart handling, and
XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes,
test migrations, and threat-model documentation updates.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Header Injection Hardening:</strong> Tightened validation
and sanitisation across request header construction to close the
header-injection attack surface. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10749">#10749</a></strong>)</li>
<li><strong>CRLF Stripping in Multipart Headers:</strong> Correctly
strips CR/LF from multipart header values to prevent injection via field
names and filenames. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10758">#10758</a></strong>)</li>
<li><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe
<code>in</code> checks with <code>hasOwnProperty</code> to prevent
authentication bypass via prototype pollution on config objects, with
additional regression tests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10761">#10761</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10760">#10760</a></strong>)</li>
<li><strong><code>withXSRFToken</code> Truthy Bypass:</strong>
Short-circuits on any truthy non-boolean value, so an ambiguous config
no longer silently leaks the XSRF token cross-origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10762">#10762</a></strong>)</li>
<li><strong><code>maxBodyLength</code> With Zero Redirects:</strong>
Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code>
is set to <code>0</code>, closing a bypass path for oversized request
bodies. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10753">#10753</a></strong>)</li>
<li><strong>Streamed Response <code>maxContentLength</code>
Bypass:</strong> Applies <code>maxContentLength</code> to streamed
responses that previously bypassed the cap. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10754">#10754</a></strong>)</li>
<li><strong>Follow-up CVE Completion:</strong> Completes an earlier
incomplete CVE fix to fully close the regression window. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10755">#10755</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>AI-Based Docs Translations:</strong> Initial scaffold for
AI-assisted translations of the documentation site. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10705">#10705</a></strong>)</li>
<li><strong><code>Location</code> Request Header Type:</strong> Adds
<code>Location</code> to <code>CommonRequestHeadersList</code> for
accurate typing of redirect-aware requests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7528">#7528</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>FormData Handling:</strong> Removes
<code>Content-Type</code> when no boundary is present on
<code>FormData</code> fetch requests, supports multi-select fields,
cancels <code>request.body</code> instead of the source stream on fetch
abort, and fixes a recursion bug in form-data serialisation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10676">#10676</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10726">#10726</a></strong>)</li>
<li><strong>HTTP Adapter:</strong> Handles socket-only request errors
without leaking keep-alive listeners. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10576">#10576</a></strong>)</li>
<li><strong>Progress Events:</strong> Clamps <code>loaded</code> to
<code>total</code> for computable upload/download progress events.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7458">#7458</a></strong>)</li>
<li><strong>Types:</strong> Aligns <code>runWhen</code> type with the
runtime behaviour in <code>InterceptorManager</code> and makes response
header keys case-insensitive. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7529">#7529</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10677">#10677</a></strong>)</li>
<li><strong><code>buildFullPath</code>:</strong> Uses strict equality in
the base/relative URL check. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</li>
<li><strong><code>AxiosURLSearchParams</code> Regex:</strong> Improves
the regex used for param serialisation to avoid edge-case mismatches.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10736">#10736</a></strong>)</li>
<li><strong>Resilient Value Parsing:</strong> Parses out header/config
values instead of throwing on malformed input. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10687">#10687</a></strong>)</li>
<li><strong>Docs Artefact Cleanup:</strong> Removes the docs content
that was incorrectly committed. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10727">#10727</a></strong>)</li>
</ul>
<h2>🔧 Maintenance & Chores</h2>
<ul>
<li><strong>Threat Model & Security Docs:</strong> Ongoing
refinement of <code>THREATMODEL.md</code>, including Hopper security
update, TLS and tag-replay wording, mitigation descriptions,
decompression-bomb guidance, and further cleanup. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10672">#10672</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10715">#10715</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10718">#10718</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10722">#10722</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10763">#10763</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10765">#10765</a></strong>)</li>
<li><strong>Test Coverage & Migration:</strong> Expanded
<code>shouldBypassProxy</code> coverage for wildcard/IPv6/edge cases,
documented and tested <code>AxiosError.status</code>, and migrated
<code>progressEventReducer</code> tests to Vitest. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10723">#10723</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10741">#10741</a></strong>)</li>
<li><strong>Type Refactor:</strong> Uses TypeScript utility types to
deduplicate literal unions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7520">#7520</a></strong>)</li>
<li><strong>Repo & CI:</strong> Adds <code>CODEOWNERS</code>,
switches v1.x releases to an ephemeral release branch, and removes
orphaned Bower support. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10739">#10739</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10738">#10738</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10746">#10746</a></strong>)</li>
<li><strong>Changelog Backfill:</strong> Added missing version entries
to the changelog. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10704">#10704</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped <code>follow-redirects</code>
(<code>1.15.11</code> → <code>1.16.0</code>) in root and docs,
<code>axios</code> (<code>1.14.0</code> → <code>1.15.0</code>) in docs,
and a group of 5 development dependencies. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10717">#10717</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10716">#10716</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10684">#10684</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10709">#10709</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/curiouscoder-cmd"><code>@curiouscoder-cmd</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</li>
<li><strong><a
href="https://github.com/tryonelove"><code>@tryonelove</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7520">#7520</a></strong>)</li>
<li><strong><a
href="https://github.com/darwin808"><code>@darwin808</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>)</li>
<li><strong><a
href="https://github.com/zoontek"><code>@zoontek</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>)</li>
<li><strong><a
href="https://github.com/AKIB473"><code>@AKIB473</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.15.0...v1.15.1">Full
Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.15.1 - April 19, 2026</h2>
<p>This release ships a coordinated set of security hardening fixes
across headers, body/redirect limits, multipart handling, and
XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes,
test migrations, and threat-model documentation updates.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Header Injection Hardening:</strong> Tightened validation and
sanitisation across request header construction to close the
header-injection attack surface. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10749">#10749</a></strong>)</p>
</li>
<li>
<p><strong>CRLF Stripping in Multipart Headers:</strong> Correctly
strips CR/LF from multipart header values to prevent injection via field
names and filenames. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10758">#10758</a></strong>)</p>
</li>
<li>
<p><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe
<code>in</code> checks with <code>hasOwnProperty</code> to prevent
authentication bypass via prototype pollution on config objects, with
additional regression tests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10761">#10761</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10760">#10760</a></strong>)</p>
</li>
<li>
<p><strong><code>withXSRFToken</code> Truthy Bypass:</strong>
Short-circuits on any truthy non-boolean value, so an ambiguous config
no longer silently leaks the XSRF token cross-origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10762">#10762</a></strong>)</p>
</li>
<li>
<p><strong><code>maxBodyLength</code> With Zero Redirects:</strong>
Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code>
is set to <code>0</code>, closing a bypass path for oversized request
bodies. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10753">#10753</a></strong>)</p>
</li>
<li>
<p><strong>Streamed Response <code>maxContentLength</code>
Bypass:</strong> Applies <code>maxContentLength</code> to streamed
responses that previously bypassed the cap. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10754">#10754</a></strong>)</p>
</li>
<li>
<p><strong>Follow-up CVE Completion:</strong> Completes an earlier
incomplete CVE fix to fully close the regression window. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10755">#10755</a></strong>)</p>
</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li>
<p><strong>AI-Based Docs Translations:</strong> Initial scaffold for
AI-assisted translations of the documentation site. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10705">#10705</a></strong>)</p>
</li>
<li>
<p><strong><code>Location</code> Request Header Type:</strong> Adds
<code>Location</code> to <code>CommonRequestHeadersList</code> for
accurate typing of redirect-aware requests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7528">#7528</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>
<p><strong>FormData Handling:</strong> Removes <code>Content-Type</code>
when no boundary is present on <code>FormData</code> fetch requests,
supports multi-select fields, cancels <code>request.body</code> instead
of the source stream on fetch abort, and fixes a recursion bug in
form-data serialisation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10676">#10676</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10726">#10726</a></strong>)</p>
</li>
<li>
<p><strong>HTTP Adapter:</strong> Handles socket-only request errors
without leaking keep-alive listeners. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10576">#10576</a></strong>)</p>
</li>
<li>
<p><strong>Progress Events:</strong> Clamps <code>loaded</code> to
<code>total</code> for computable upload/download progress events.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7458">#7458</a></strong>)</p>
</li>
<li>
<p><strong>Types:</strong> Aligns <code>runWhen</code> type with the
runtime behaviour in <code>InterceptorManager</code> and makes response
header keys case-insensitive. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7529">#7529</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10677">#10677</a></strong>)</p>
</li>
<li>
<p><strong><code>buildFullPath</code>:</strong> Uses strict equality in
the base/relative URL check. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</p>
</li>
<li>
<p><strong><code>AxiosURLSearchParams</code> Regex:</strong> Improves
the regex used for param serialisation to avoid edge-case mismatches.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10736">#10736</a></strong>)</p>
</li>
<li>
<p><strong>Resilient Value Parsing:</strong> Parses out header/config
values instead of throwing on malformed input. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10687">#10687</a></strong>)</p>
</li>
<li>
<p><strong>Docs Artefact Cleanup:</strong> Removes the docs content that
was incorrectly committed. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10727">#10727</a></strong>)</p>
</li>
</ul>
<h2>🔧 Maintenance & Chores</h2>
<ul>
<li>
<p><strong>Threat Model & Security Docs:</strong> Ongoing refinement
of <code>THREATMODEL.md</code>, including Hopper security update, TLS
and tag-replay wording, mitigation descriptions, decompression-bomb
guidance, and further cleanup. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10672">#10672</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10715">#10715</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10718">#10718</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10722">#10722</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10763">#10763</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10765">#10765</a></strong>)</p>
</li>
<li>
<p><strong>Test Coverage & Migration:</strong> Expanded
<code>shouldBypassProxy</code> coverage for wildcard/IPv6/edge cases,
documented and tested <code>AxiosError.status</code>, and migrated
<code>progressEventReducer</code> tests to Vitest. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10723">#10723</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10741">#10741</a></strong>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/ac42446be51300fe214ba3c6e40cc95f34fd6871"><code>ac42446</code></a>
chore(release): prepare release 1.15.1 (<a
href="https://redirect.github.com/axios/axios/issues/10767">#10767</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/908f2206b6bfeff67236784abce85935698ac1d9"><code>908f220</code></a>
docs: update threatmodel (<a
href="https://redirect.github.com/axios/axios/issues/10765">#10765</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/f93f8155250c2e066205521eda05ae22983a1f6d"><code>f93f815</code></a>
docs: added docs around potential decompressions bomb (<a
href="https://redirect.github.com/axios/axios/issues/10763">#10763</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/1728aa1b15b8857f970611fd8983c06b423fc486"><code>1728aa1</code></a>
fix: short-circuits on any truthy non-boolean in withXSRFToken (<a
href="https://redirect.github.com/axios/axios/issues/10762">#10762</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/42eb721eebc95cfded8d6c70cf62f3fbe83f3246"><code>42eb721</code></a>
fix: replace in with has own prop util (<a
href="https://redirect.github.com/axios/axios/issues/10761">#10761</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/75873270a59bd5d895322eee145738e95fb89258"><code>7587327</code></a>
fix: strip crlf correctly (<a
href="https://redirect.github.com/axios/axios/issues/10758">#10758</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/f0b98673b32677643a3b608431270d36e997473c"><code>f0b9867</code></a>
chore: added additional testing for this issue (<a
href="https://redirect.github.com/axios/axios/issues/10760">#10760</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e033f243a08e3514c03e510f76658da1e0fac3bd"><code>e033f24</code></a>
fix: incomplete fix for cve (<a
href="https://redirect.github.com/axios/axios/issues/10755">#10755</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e8904af03385b040e53f1263a444e825db4335d9"><code>e8904af</code></a>
fix: stream response bypassed max content length (<a
href="https://redirect.github.com/axios/axios/issues/10754">#10754</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/1c7f6d76e58359daddf38a6e636dd801ffd9c61b"><code>1c7f6d7</code></a>
fix: enforce max body length when max redirects is 0 (<a
href="https://redirect.github.com/axios/axios/issues/10753">#10753</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.15.0...v1.15.1">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
b4ae648153