PRE_RELEASE_CHANGELOG.md
NO_PROXY/no_proxy, including bracketed IPv6 and IPv4-mapped IPv6 normalization, while malformed ranges fail closed. A /0 entry bypasses the proxy for its entire address family.HttpStatusCode.ContentTooLarge for 413 and HttpStatusCode.UnprocessableContent for 422 across the runtime API and ESM/CommonJS declarations. The existing PayloadTooLarge and UnprocessableEntity names remain as deprecated aliases, and numeric reverse lookups retain their existing v1.x names for compatibility. (#11082, closes #11066)OPTIONS, PURGE, LINK, UNLINK, and QUERY defaults apply only to matching requests instead of leaking as literal headers. (#11096)httpVersion values, including non-coercible JavaScript types, now reject with AxiosError and ERR_BAD_OPTION_VALUE while preserving the request config for diagnostics. (#11096)Object.prototype even when its constructor is altered, from becoming request behavior after config merging or interceptor replacement. Methods, headers, adapters, transports, FormData hooks, serializer options, and Fetch Request options are protected. Already-safe writable merged configs retain their identity through dispatch, while frozen, sealed, accessor-based, otherwise restricted, or unsafe-key-bearing replacements become writable filtered snapshots. Interceptor replacements with non-terminal application-defined prototypes remain supported as normalized null-prototype snapshots, terminal null-prototype ancestors are treated as shared boundaries to fail closed, and own __proto__, constructor, and prototype keys remain excluded from materialized configs.Request plus a safe second fetchOptions argument that preserves custom own fields without overriding Axios-managed request fields. The authoritative method, headers, body, signal, duplex, and credentials are available on the Request and omitted from the second argument. maxRedirects: 0 selects manual redirect handling when supported; Node exposes the unfollowed 3xx response, while browsers may expose an opaque redirect with status 0 and inaccessible headers. The no-Request fallback receives the same safe resolved options.ERR_NOT_SUPPORT, while process-environment and HTTP/1-agent proxyEnv settings are ignored because http2.connect() cannot apply them; proxy: false continues to force a direct connection. Failed sessions are removed without leaking an unhandled session error.onDownloadProgress now always receives a final delivery when a completed XHR download reaches its successful loadend handler. The callback runs while that event is still dispatching, so listeners reading incremental data from event.currentTarget observe the complete response. Previously the final delivery happened only when a throttled progress event was still pending, and it replayed an event whose dispatch had already finished — event.currentTarget was null — so text-streaming consumers could lose every chunk after the first in browsers whose progress cadence kept deliveries inside the throttle window. A final callback that cancels the request stops settlement processing cleanly, while a throwing callback does not leave the request pending. Upload progress and flushes triggered by stream errors, abort reasons, or failed XHR downloads retain their prior pending-event behavior. (closes #6796)loadend with status 0 is now rejected as an ECONNABORTED error instead of resolving as a success with an empty body. Firefox 152 stopped firing error and abort for requests canceled by a document navigation, leaving loadend as the only handler that runs, so those requests were settling as successful responses. Rejecting with ECONNABORTED matches what onabort raised on Firefox 151, so the outcome an application sees is unchanged by that update. Reads over file:, which some environments report as status 0 on success, still resolve, whether the scheme appears on the request URL, is inherited from a file: page origin by a relative request URL, or appears only on responseURL. Because no response was received, the rejection is not suppressed by validateStatus, matching how onerror and onabort already behave. (#11094, closes #11093)Error stack instrumentation returns non-string data or throws during optional stack decoration. (#11109, closes #11108)