PRE_RELEASE_CHANGELOG.md
HttpStatusCode.WebServerReturnsAnUnknownError for Cloudflare status 520 across the runtime API and ESM/CommonJS declarations. (#11067)AxiosRequestConfig and propagated it through params serializers, internal configs, default response and AxiosPromise shapes, errors, cancellation guards (CanceledError/isCancel), request methods, callable instances, adapters, and mergeConfig() across ESM and CommonJS declarations. Default request and typed promise results retain the request-data and params types on response.config, while explicit custom response types and the existing generic argument positions remain compatible. Untyped call sites retain the previous behavior through the P = any default. (#11081, closes #4954)AxiosHeaders.parseParameters() as an opt-in parser for AxiosHeaders#get(). It returns a hardened null-prototype parameter map, removes RFC quoted-string delimiters, decodes quoted-pair escapes, preserves commas and semicolons inside quoted values, and trims only optional SP/HTAB whitespace while leaving the legacy get(name, true) parser unchanged. (#11051, closes #11050)onRejected handling while preventing request dispatch when the handler throws or returns a rejected Promise. Fulfilled recovery handlers continue with the last valid request config, and terminal interceptor errors now reach response rejection interceptors. (#11071)formDataHeaderPolicy: 'content-only' now tolerate custom FormData#getHeaders() implementations that return no headers instead of throwing while filtering them. (#11062)data: URL size estimation so percent-embedded input cannot bypass maxContentLength. The Node HTTP adapter now bounds the raw Buffer allocation, including ignored characters and content after padding, while the fetch adapter preserves percent-decoded base64 semantics and excludes URL fragments from the payload estimate. (#11061)AxiosError.from() now synthesizes a message from nested AggregateError entries when the outer message is blank, preserving dual-stack connection failure details in structured logs. (#11059, closes #6721)AxiosError#toJSON() now serializes Set values in request config snapshots as arrays instead of empty objects. (#11044, refs #5910)onDownloadProgress callback before streamed responses emit close, preventing trailing progress notifications after consumers observe the stream as closed. (closes #6878)combineURLs() now removes repeated trailing slashes from baseURL before joining a relative request URL, avoiding unintended double slashes in the final request path. (#11038)AxiosHeaders#getSetCookie() now always returns an array for present set-cookie values, including programmatic single-value headers. (#11037)mergeConfig() now preserves own enumerable symbol keys, allowing symbol-keyed custom request config fields to reach interceptors and adapters. (#11043, closes #11042)paramsSerializer.encode functions now receive the active AxiosURLSearchParams instance as this, matching the intended encoder.call(this, value, defaultEncode) behavior during query string construction. (#11019)CanceledError, CancelToken, AxiosHeaders, SerializerOptions, and Cloudflare 52x status-code members that already exist at runtime. (#10959)proxyEnv support. (#10942, closes #7299)'/foo') now work again with config.socketPath, fixing the TypeError [ERR_INVALID_URL] regression introduced in 1.7.4 when new URL() was added to the dispatch path. A synthetic http://localhost base is supplied only when an own socketPath is set, so absolute URLs, non-socket requests, and prototype-polluted socketPath values are unaffected. (#6611)AbortSignals now abort immediately when any input signal is already aborted, so pre-canceled fetch-adapter requests preserve cancellation semantics instead of starting work. (#11035)shouldBypassProxy now honors * when it appears as one entry in a comma- or space-separated NO_PROXY list, not only when the entire variable is exactly *. (#11053)shouldBypassProxy now canonicalises NO_PROXY entries and request hostnames written in Node's URL-parser-accepted shorthand, octal (0177.0.0.1), and hex (0x7f.0.0.1) forms to dotted-decimal before comparison, including shorthand tails such as 127.65535 -> 127.0.255.255. Invalid octets, 1-part inputs, 5+ parts, and out-of-range tails remain fail-closed. (#11029)ERR_INVALID_URL error thrown for http:/https: URLs missing the // after the protocol (added in the malformed-URL SSRF hardening, #11000) now includes the offending URL, e.g. Invalid URL "https:example.com": missing "//" after protocol. This makes the rejection self-diagnosable; the control-character-normalized form of the URL is reported, with userinfo (credentials), query parameter values, and fragment contents redacted (parameter names, host and path are kept) so secrets are not leaked into the always-serialized AxiosError.message. (closes #11008)Buffer fallback code from toFormData ArrayBuffer/TypedArray handling, avoiding unnecessary browser buffer polyfills while preserving Node.js Buffer conversion for non-spec FormData implementations. (#11018, closes #10990)formDataToJSON/formToJSON no longer split field names on -, spaces, +, *, or &; only bracket and dot notation create nested keys, so a key like user-name stays literal. (#11006, closes #5402)data is request-specific and is not inherited or deep-merged from global or instance defaults. Shared body fields should be added with a request interceptor or transformRequest, scoped carefully to avoid sending sensitive values to unintended endpoints.setKeepAlive is unavailable. (#10917, closes #10908)