Bump the 3-3-core-ui-package-updates group across 1 directory with 46 updates

[dependabot]

Bumps the 3-3-core-ui-package-updates group with 46 updates in the /airflow-core/src/airflow/ui directory:

Package	From	To
@chakra-ui/react	3.34.0	3.36.0
@guanmingchiu/sqlparser-ts	0.61.1	0.62.0
@tanstack/react-query	5.90.21	5.101.2
@tanstack/react-virtual	3.13.21	3.14.4
@xyflow/react	12.10.1	12.11.1
axios	1.16.1	1.18.1
chakra-react-select	6.1.1	6.1.3
dayjs	1.11.19	1.11.21
i18next	25.8.16	25.10.10
i18next-http-backend	3.0.5	3.0.6
monaco-editor	0.52.2	0.55.1
react	19.2.6	19.2.7
@types/react	19.2.15	19.2.17
react-dom	19.2.6	19.2.7
react-hook-form	7.71.2	7.80.0
react-hotkeys-hook	4.6.1	4.6.2
react-i18next	16.6.5	16.6.6
react-router-dom	7.13.1	7.18.0
react-syntax-highlighter	15.6.1	15.6.6
use-debounce	10.1.0	10.1.1
yaml	2.8.3	2.9.0
zustand	5.0.11	5.0.14
@eslint/compat	2.0.5	2.1.0
@playwright/test	1.60.0	1.61.1
@rolldown/plugin-babel	0.2.2	0.2.3
@tanstack/eslint-plugin-query	5.91.4	5.101.2
@types/node	24.10.3	24.13.2
@typescript-eslint/eslint-plugin	8.60.0	8.62.0
@typescript-eslint/parser	8.60.0	8.62.0
@typescript-eslint/utils	8.60.0	8.62.0
@vitejs/plugin-react	6.0.1	6.0.3
@vitejs/plugin-react-swc	4.2.3	4.3.1
@vitest/coverage-v8	4.1.4	4.1.9
eslint	10.3.0	10.6.0
eslint-plugin-i18next	6.1.4	6.1.5
eslint-plugin-jsonc	3.1.2	3.2.0
eslint-plugin-perfectionist	5.9.0	5.9.1
eslint-plugin-prettier	5.5.5	5.5.6
eslint-plugin-react-refresh	0.5.2	0.5.3
happy-dom	20.8.9	20.10.6
jsonc-eslint-parser	2.4.1	2.4.2
msw	2.12.10	2.14.6
prettier	3.8.1	3.9.3
typescript-eslint	8.60.0	8.62.0
vite	8.0.16	8.1.0
vitest	4.1.4	4.1.9

Updates @chakra-ui/react from 3.34.0 to 3.36.0

Release notes

Sourced from @​chakra-ui/react's releases.

@​chakra-ui/react@​3.36.0

Minor Changes

• #10752 1ef5800 Thanks @​kalisaNkevin! - [New] FloatingPanel: Add draggable, resizable floating panel component

  import { FloatingPanel } from "@chakra-ui/react/floating-panel"

  <FloatingPanel.Root>
    <FloatingPanel.Trigger />
    <FloatingPanel.Positioner>
      <FloatingPanel.Content>
        <FloatingPanel.Header>
          <FloatingPanel.DragTrigger>
            <FloatingPanel.Title />
          </FloatingPanel.DragTrigger>
          <FloatingPanel.Control>
            <FloatingPanel.StageTrigger />
            <FloatingPanel.CloseTrigger />
          </FloatingPanel.Control>
        </FloatingPanel.Header>
        <FloatingPanel.Body />
        <FloatingPanel.ResizeTriggers />
      </FloatingPanel.Content>
    </FloatingPanel.Positioner>
  </FloatingPanel.Root>

• #10847 238e20a Thanks @​Adebesin-Cell! - Update Ark UI to v5.37.2

  • Splitter: Accept CSS units (px, em, rem, vh, vw) for size props, add per-panel resizeBehavior ("preserve-pixel-size"), and fix focus not moving to a resize trigger on click.
  • Color Picker, Combobox, Date Picker, Hover Card, Menu, Popover, Select, Tooltip: Add data-side to placement-aware parts for placement-based styling.
  • Accordion: Remove redundant aria-disabled from item triggers.
  • Color Picker: Fire onValueChangeEnd when picking a color with the EyeDropper API.
  • Combobox: Don't submit the form on Enter when an item is highlighted or the value is rejected by allowCustomValue: false.
  • Date Picker: Fix range-mode clear not resetting active/hovered state, the native month/year select inside modals (Firefox), and

... (truncated)

Changelog

Sourced from @​chakra-ui/react's changelog.

3.36.0

Minor Changes

• #10752 1ef5800 Thanks @​kalisaNkevin! - [New] FloatingPanel: Add draggable, resizable floating panel component

  import { FloatingPanel } from "@chakra-ui/react/floating-panel"

  <FloatingPanel.Root>
    <FloatingPanel.Trigger />
    <FloatingPanel.Positioner>
      <FloatingPanel.Content>
        <FloatingPanel.Header>
          <FloatingPanel.DragTrigger>
            <FloatingPanel.Title />
          </FloatingPanel.DragTrigger>
          <FloatingPanel.Control>
            <FloatingPanel.StageTrigger />
            <FloatingPanel.CloseTrigger />
          </FloatingPanel.Control>
        </FloatingPanel.Header>
        <FloatingPanel.Body />
        <FloatingPanel.ResizeTriggers />
      </FloatingPanel.Content>
    </FloatingPanel.Positioner>
  </FloatingPanel.Root>

• #10847 238e20a Thanks @​Adebesin-Cell! - Update Ark UI to v5.37.2

  • Splitter: Accept CSS units (px, em, rem, vh, vw) for size props, add per-panel resizeBehavior ("preserve-pixel-size"), and fix focus not moving to a resize trigger on click.
  • Color Picker, Combobox, Date Picker, Hover Card, Menu, Popover, Select, Tooltip: Add data-side to placement-aware parts for placement-based styling.
  • Accordion: Remove redundant aria-disabled from item triggers.
  • Color Picker: Fire onValueChangeEnd when picking a color with the EyeDropper API.
  • Combobox: Don't submit the form on Enter when an item is highlighted or the value is rejected by allowCustomValue: false.
  • Date Picker: Fix range-mode clear not resetting active/hovered state,

... (truncated)

Commits

• 3c00027 Version Packages (#10802)
• 238e20a chore(deps): update @​ark-ui/react to 5.37.2 (#10847)
• 4384e3f docs(react): remove redundant "render" in For children prop (#10842)
• b51f7ae docs(react): update outdated package readme (#10838)
• 06b5f02 fix: semantic token lookup
• 6a3e23c chore: update examples
• 1ef5800 feat: float panel component (#10752)
• 43a016d fix: remove DatePicker placeholder color override to align with global styling
• 82b26be fix: update Link component to use focusVisibleRing for improved accessibility
• c5e1eed docs: update datalist
• Additional commits viewable in compare view

Updates @guanmingchiu/sqlparser-ts from 0.61.1 to 0.62.0

Release notes

Sourced from @​guanmingchiu/sqlparser-ts's releases.

v0.62.0

What's Changed

• Update check-upstream workflow to run daily by @​guan404ming in guan404ming/sqlparser-ts#12
• Flatten project structure and improve CI by @​guan404ming in guan404ming/sqlparser-ts#13
• Update dev deps by @​guan404ming in guan404ming/sqlparser-ts#14
• Refactor test names in dialect tests by @​guan404ming in guan404ming/sqlparser-ts#15
• Refactor benchmark CLI by @​guan404ming in guan404ming/sqlparser-ts#17
• Add news section to README by @​guan404ming in guan404ming/sqlparser-ts#18
• Add parseWithComments with correct span serialization by @​elliots in guan404ming/sqlparser-ts#19
• Update dev dependencies by @​guan404ming in guan404ming/sqlparser-ts#21
• Auto-open upgrade PR instead of checklist issue by @​guan404ming in guan404ming/sqlparser-ts#22
• Fix check-upstream workflow by @​guan404ming in guan404ming/sqlparser-ts#23
• Upgrade to sqlparser v0.62.0 by @​github-actions[bot] in guan404ming/sqlparser-ts#24

New Contributors

• @​elliots made their first contribution in guan404ming/sqlparser-ts#19
• @​github-actions[bot] made their first contribution in guan404ming/sqlparser-ts#24

Full Changelog: guan404ming/sqlparser-ts@v0.61.1...v0.62.0

What's Changed

• Update check-upstream workflow to run daily by @​guan404ming in guan404ming/sqlparser-ts#12
• Flatten project structure and improve CI by @​guan404ming in guan404ming/sqlparser-ts#13
• Update dev deps by @​guan404ming in guan404ming/sqlparser-ts#14
• Refactor test names in dialect tests by @​guan404ming in guan404ming/sqlparser-ts#15
• Refactor benchmark CLI by @​guan404ming in guan404ming/sqlparser-ts#17
• Add news section to README by @​guan404ming in guan404ming/sqlparser-ts#18
• Add parseWithComments with correct span serialization by @​elliots in guan404ming/sqlparser-ts#19
• Update dev dependencies by @​guan404ming in guan404ming/sqlparser-ts#21
• Auto-open upgrade PR instead of checklist issue by @​guan404ming in guan404ming/sqlparser-ts#22
• Fix check-upstream workflow by @​guan404ming in guan404ming/sqlparser-ts#23
• Upgrade to sqlparser v0.62.0 by @​github-actions[bot] in guan404ming/sqlparser-ts#24

New Contributors

• @​elliots made their first contribution in guan404ming/sqlparser-ts#19
• @​github-actions[bot] made their first contribution in guan404ming/sqlparser-ts#24

Full Changelog: guan404ming/sqlparser-ts@v0.61.1...v0.62.0

Commits

• 51e52bc Upgrade to sqlparser v0.62.0 (#24)
• 2cc45e3 Fix check-upstream workflow (#23)
• 5952abb Auto-open upgrade PR instead of checklist issue (#22)
• 404ffe0 Update dev dependencies (#21)
• 6ae6f31 Add parseWithComments with correct span serialization (#19)
• 5a977b1 Add news section to README (#18)
• 3849815 Refactor benchmark CLI (#17)
• ecd99dc Refactor test names in dialect tests (#15)
• 753b55b Update dev deps (#14)
• 98a131a Flatten project structure and improve CI (#13)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.90.21 to 5.101.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.101.2

Patch Changes

• Updated dependencies [f5bf180, 25cdd97, ecd89c8, 01c7634, 49012db]:
  • @​tanstack/query-devtools@​5.101.2
  • @​tanstack/react-query@​5.101.2

@​tanstack/react-query-next-experimental@​5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.2

@​tanstack/react-query-persist-client@​5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.2
  • @​tanstack/react-query@​5.101.2

@​tanstack/react-query@​5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.2

@​tanstack/react-query-devtools@​5.101.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.101.1
  • @​tanstack/react-query@​5.101.1

@​tanstack/react-query-next-experimental@​5.101.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.1

@​tanstack/react-query-persist-client@​5.101.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.1
  • @​tanstack/react-query@​5.101.1

@​tanstack/react-query@​5.101.1

Patch Changes

• Updated dependencies [9eff92e]:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.2

5.101.1

Patch Changes

• Updated dependencies [9eff92e]:
  • @​tanstack/query-core@​5.101.1

5.101.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.0

5.100.14

Patch Changes

• fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)

• Updated dependencies []:

  • @​tanstack/query-core@​5.100.14

5.100.13

Patch Changes

• Updated dependencies [d423168]:
  • @​tanstack/query-core@​5.100.13

5.100.12

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.100.12

5.100.11

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.100.11

... (truncated)

Commits

• 610e8d1 ci: Version Packages (#10996)
• 1f84256 docs: document the select typing caveat for parallel-queries hooks (#10984)
• b809297 ci: Version Packages (#10977)
• ccc843e test({react,preact}-query/useQueries): move type-only tests to 'useQueries.te...
• 4154613 test({react,preact}-query/useMutation): split 'should handle conditional logi...
• 8bb5fde test({react,preact}-query/useMutation): split 'should pass meta to mutation' ...
• 87426a3 test(react-query): replace deprecated 'toBeCalledTimes' with 'toHaveBeenCalle...
• feb1efd test(*): move 'vi.useRealTimers' to the end of 'afterEach' so cleanup runs un...
• f3d8d2a ci: Version Packages (#10774)
• 532bb29 fix(tests): disable local coverage instrumentation (#10776)
• Additional commits viewable in compare view

Updates @tanstack/react-virtual from 3.13.21 to 3.14.4

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.4

Patch Changes

• Updated dependencies [b04f9ee, 37be284]:
  • @​tanstack/virtual-core@​3.17.2

@​tanstack/react-virtual@​3.14.3

Patch Changes

• #1201 2ba5eb6 - Make directDomUpdates a no-op for direct DOM writes when containerRef is omitted. Previously the virtualizer still wrote item positions while never sizing the container (a broken half-state). Now omitting containerRef skips all direct writes while still skipping re-renders, letting consumers own the DOM updates themselves (e.g. in onChange).

• Updated dependencies [ef69ea3]:

  • @​tanstack/virtual-core@​3.17.1

@​tanstack/react-virtual@​3.14.2

Patch Changes

• Updated dependencies [c0b84c8, fbf3bdb]:
  • @​tanstack/virtual-core@​3.17.0

@​tanstack/react-virtual@​3.14.1

Patch Changes

• Updated dependencies [c746841]:
  • @​tanstack/virtual-core@​3.16.1

@​tanstack/react-virtual@​3.14.0

Minor Changes

• Add opt-in direct DOM updates for scroll positioning with directDomUpdates, directDomUpdatesMode, and containerRef. (#1180)

@​tanstack/react-virtual@​3.13.26

Patch Changes

• Updated dependencies [fc992ab]:
  • @​tanstack/virtual-core@​3.16.0

@​tanstack/react-virtual@​3.13.25

Patch Changes

• Replace the useReducer(() => ({}), {}) force-rerender pattern with an (#1168) incrementing number counter. Same semantics (every dispatch changes the reducer state, forcing a render); zero per-dispatch object allocation. Trivial individual cost, but eliminates one steady-state GC source on scroll-heavy apps.
• Updated dependencies [99355ad, 99355ad, 99355ad, 99355ad, 99355ad, 99355ad, 99355ad]:
  • @​tanstack/virtual-core@​3.15.0

@​tanstack/react-virtual@​3.13.24

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.4

Patch Changes

• Updated dependencies [b04f9ee, 37be284]:
  • @​tanstack/virtual-core@​3.17.2

3.14.3

Patch Changes

• #1201 2ba5eb6 - Make directDomUpdates a no-op for direct DOM writes when containerRef is omitted. Previously the virtualizer still wrote item positions while never sizing the container (a broken half-state). Now omitting containerRef skips all direct writes while still skipping re-renders, letting consumers own the DOM updates themselves (e.g. in onChange).

• Updated dependencies [ef69ea3]:

  • @​tanstack/virtual-core@​3.17.1

3.14.2

Patch Changes

• Updated dependencies [c0b84c8, fbf3bdb]:
  • @​tanstack/virtual-core@​3.17.0

3.14.1

Patch Changes

• Updated dependencies [c746841]:
  • @​tanstack/virtual-core@​3.16.1

3.14.0

Minor Changes

• Add opt-in direct DOM updates for scroll positioning with directDomUpdates, directDomUpdatesMode, and containerRef. (#1180)

3.13.26

Patch Changes

• Updated dependencies [fc992ab]:
  • @​tanstack/virtual-core@​3.16.0

3.13.25

Patch Changes

• Replace the useReducer(() => ({}), {}) force-rerender pattern with an (#1168) incrementing number counter. Same semantics (every dispatch changes the reducer state, forcing a render); zero per-dispatch object allocation.

... (truncated)

Commits

• d73a538 ci: Version Packages (#1210)
• 75ae896 ci: Version Packages (#1202)
• 2ba5eb6 fix(react-virtual): make directDomUpdates a no-op without containerRef (#1201)
• ef69ea3 fix(virtual-core): adjust scroll on first measurement during backward scroll ...
• 932c358 test(react-virtual): add e2e test for React Compiler with directDomUpdates, b...
• b983b21 ci: Version Packages (#1184)
• fbf3bdb feat(virtual-core): add useCachedMeasurements option to preserve sizes when...
• 13dec39 docs: add directDomUpdates and directDomUpdatesMode options (#1185)
• c33902f ci: Version Packages (#1182)
• d789c6e ci: Version Packages (#1181)
• Additional commits viewable in compare view

Updates @xyflow/react from 12.10.1 to 12.11.1

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.11.1

Patch Changes

• #5815 87da45c - Fix FinalConnectionState type so it preserves the discriminated union.

• #5823 a6afc91 - Update attribution link

• #5824 6b1dac5 - Do not fire on pane click when connection ends on pane

• #5818 4ddc2d8 - Provide the shared handle config (connectOnClick, noPanClassName, rfId) through context instead of subscribing to the store in every Handle, so a store update no longer runs a selector once per handle

• #5817 8df250b - Reduce per-handle work on store updates by returning a shared connection state while no connection is in progress.

• #5822 a6249de - Return stable reference for edge position when connected node gets deleted

• Updated dependencies [ceb8604, 87da45c]:

  • @​xyflow/system@​0.0.78

@​xyflow/react@​12.11.0

12.11.0

Minor Changes

• #5677 e6661de - Add autoPanOnSelection to auto-pan when user drags a selection close to the edge of the viewport.

Patch Changes

• #5791 732c8eb - Adds a type error when handleId is used without handleType in useNodeConnections

• #5793 c5c853d - Dev Warnings now use library-specific messaging with the correct documentation links.

• #5776 0441e9f - Export NodeHandle type

• #5755 88737f9 - Add @types/react and @types/react-dom as optional peer dependencies to prevent issues with pnpm strict mode (hoist: false)

... (truncated)

Changelog

Sourced from @​xyflow/react's changelog.

12.11.1

Patch Changes

• #5815 87da45c - Fix FinalConnectionState type so it preserves the discriminated union.

• #5823 a6afc91 - Update attribution link

• #5824 6b1dac5 - Do not fire on pane click when connection ends on pane

• #5818 4ddc2d8 - Provide the shared handle config (connectOnClick, noPanClassName, rfId) through context instead of subscribing to the store in every Handle, so a store update no longer runs a selector once per handle

• #5817 8df250b - Reduce per-handle work on store updates by returning a shared connection state while no connection is in progress.

• #5822 a6249de - Return stable reference for edge position when connected node gets deleted

• Updated dependencies [ceb8604, 87da45c]:

  • @​xyflow/system@​0.0.78

12.11.0

Minor Changes

• #5677 e6661de - Add autoPanOnSelection to auto-pan when user drags a selection close to the edge of the viewport.

Patch Changes

• #5791 732c8eb - Adds a type error when handleId is used without handleType in useNodeConnections

• #5793 c5c853d - Dev Warnings now use library-specific messaging with the correct documentation links.

... (truncated)

Commits

• eedbc81 chore(packages): bump
• c7bdce4 chore(pane): cleanup
• cd5ec45 chore(react/pane): cleanup
• f919daa fix(pane): do not fire pane click when connection ends on pane
• 36c8a1a chore(attribution): update link
• 50fd4b4 Merge pull request #5823 from xyflow/refactor/attribution
• 5f1a206 chore(attr): update link
• 4710765 Merge pull request #5822 from xyflow/refactor/edge-deleted-nodes
• 503fc15 Merge branch 'main' into perf/handle-config-context
• ae1b237 refactor(edges): don't create new object when edge returns early because conn...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​xyflow/react since your current version.

Updates axios from 1.16.1 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​drori12 (#10984)
• @​eyupcanakman (#10899)
• @​Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

• Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
• Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

• HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

• Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929,

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

[potiuk]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.