[Release] v0.28.0

[DigitalBrainJS]

Release notes:

Bug Fixes

• fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to v0.x (fix: resolve CVE-2023-45857 in v0.x branch #6091)

Backports from v1.x:

• Allow null indexes on formSerializer and paramsSerializer v0.x (Allow null indexes on formSerializer and paramsSerializer v0.x #4961)
• Fixing content-type header repeated Fixing content-type header repeated #4745
• Fixed timeout error message for HTTP 4738
• Added axios.formToJSON method (Added axios.formToJSON method; #4735)
• URL params serializer (URL params serializer; #4734)
• Fixed toFormData Blob issue on node>v17 Fixed bug #4727 : toFormData Blob issue on node>v17; #4728
• Adding types for progress event callbacks Adding types for progress event callbacks #4675
• Fixed max body length defaults Fix/4263/maxbodylength defaults #4731
• Added data URL support for node.js (Added data URL support for node.js; #4725)
• Added isCancel type assert (fix: add isCancel type assert #4293)
• Added the ability for the url-encoded-form serializer to respect the formSerializer config (Added the ability for the url-encoded-form serializer to respect the formSerializer config; #4721)
• Add string[] to AxiosRequestHeaders type (add string[] to AxiosRequestHeaders type #4322)
• Allow type definition for axios instance methods (types: allow type definition for axios instance methods #4224)
• Fixed AxiosError stack capturing; (Fixed AxiosError stack capturing; #4718)
• Fixed AxiosError status code type; (Fixed AxiosError status code type; #4717)
• Adding Canceler parameters config and request (Adding Canceler parameters config and request #4711)
• fix(types): allow to specify partial default headers for instance creation (fix(types): allow to specify partial default headers for instance cre… #4185)
• Added blob to the list of protocols supported by the browser (Added blob to the list of protocols supported by the browser; #4678)
• Fixing Z_BUF_ERROR when no content (Fixing Z_BUF_ERROR when no content #4701)
• Fixed race condition on immediate requests cancellation (Fixed race condition on immediate requests cancellation #4261)
• Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an Axios instance Interceptor clear #4248
• Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill (Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill #4229)
• Fix TS definition for AxiosRequestTransformer (Fix TS definition for AxiosRequestTransformer #4201)
• Use type alias instead of interface for AxiosPromise (Use type alias instead of interface for AxiosPromise #4505)
• Include request and config when creating a CanceledError instance (Include request and config when creating a CanceledError. #4659)
• Added generic TS types for the exposed toFormData helper (Added generic TS types for the exposed toFormData helper; #4668)
• Optimized the code that checks cancellation (opt: opt judgment code of cancel #4587)
• Replaced webpack with rollup (Replaced Webpack in favor of Rollup. #4596)
• Added stack trace to AxiosError (Updating AxiosError to include stack trace #4624)
• Updated AxiosError.config to be optional in the type definition (Make AxiosError.config optional in the type definition #4665)
• Removed incorrect argument for NetworkError constructor (Removed incorrect argument for NetworkError constructor; #4656)

[bmuenzenmeyer]

so happy to see this progressing!

[10hendersonm]

Any reason the dist/axios.js doesn't seem to be built with Webpack any more?

That's an assumption on my part - the __webpack_require__s are all gone and add/remove of 1,200 lines for a change of constrained scope like this seems offputting.

[DigitalBrainJS]

Any reason the dist/axios.js doesn't seem to be built with Webpack any more?

Yes, that’s right, we switched to rollup almost 2 years ago (#4596), it seems that this and some other commits were originally merged into the 0.x branch and remained unpublished since the 1.x branch was created much later than the merge of these commits. As a result, we have a partial backport from the 1.x branch.

[venusgazer]

Hi @DigitalBrainJS ,

We appreciate your efforts in addressing the vulnerability in the dependent package. Integrating this fix into our project is a priority for us. However, we've encountered challenges during the upgrade process, particularly transitioning from version 0.27.2 to 1.6.7, leading to build failures.

Could you kindly provide an estimated timeline for when this PR will be merged and deployed? This information is crucial for us to plan our next steps effectively and ensure the timely resolution of the vulnerability.

Thank you once again for your attention to this matter 🙏.

[DigitalBrainJS]

@venusgazer Sorry for the delay. I think the release will be published this weekend, as it requires cooperation with other team members who are currently pretty overworked.