Skip to content

build(deps): bump the js-minor-patch group in /config-ui with 4 updates - #9393

Merged
klesh merged 1 commit into
mainfrom
dependabot/npm_and_yarn/config-ui/js-minor-patch-aea13841b9
Nov 14, 2026
Merged

build(deps): bump the js-minor-patch group in /config-ui with 4 updates#9393
klesh merged 1 commit into
mainfrom
dependabot/npm_and_yarn/config-ui/js-minor-patch-aea13841b9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the js-minor-patch group in /config-ui with 4 updates: axios, @vitejs/plugin-react, typescript-eslint and vite.

Updates axios from 1.21.0 to 1.21.1

Release notes

Sourced from axios's releases.

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

  • follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)

🐛 Bug Fixes

  • Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)
  • TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#11404)

🔧 Maintenance & Chores

  • Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

    • transformRequest runs for every method, and transformers receive (data, headers, status).
    • responseType and Content-Type have no default value.
    • AxiosHeaders#get and #normalize are described correctly.
    • Errors should be identified with axios.isAxiosError(), not by name.
    • The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.
    • New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

    (#11374, #11373, #11389, #11419, #11429, #11430)

  • Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)

  • Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)

  • CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#11396)

  • Dependencies: Updated development and tooling dependencies, including vitest and @vitest/* (to 5.x at the root), typescript (7.x at the root), vite, rollup, eslint, playwright, @commitlint/*, @rollup/plugin-alias, @rollup/plugin-terser, body-parser, multer, serialize-javascript, fast-uri, qs, zizmorcore/zizmor-action, and follow-redirects in /docs. (#11383, #11375, #11372, #11345, #11392, #11387, #11386, #11385, #11391, #11388, #11395, #11421, #11422, #11426)

  • Release: Prepared the 1.21.1 release. (#11435)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 335e2f8 chore(release): prepare release 1.21.1 (#11435)
  • c07e981 docs: note that FormData parsing has a fixed depth limit (#11430)
  • f0fcec7 test(helpers): cover IDN, CIDR and port edge cases in shouldBypassProxy (#11431)
  • 4f203a9 docs(i18n): add locale prefix to internal links in es, fr, zh docs (#11401)
  • 98156ee docs: correct request config and AxiosHeaders descriptions (#11389)
  • a81d62a test: cover cancellation lifecycle and timeout precedence (#11376)
  • a42a19a docs: add missing error codes to the error tables (#11429)
  • 1fcaf82 chore(deps-dev): refresh development dependencies (#11426)
  • fb88a1b chore(deps-dev): bump the development_dependencies group with 4 updates (#11422)
  • 31cc02a chore(deps): bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 in the github-...
  • Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.2.1 to 6.3.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.3.0

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.3.0 (2026-11-09)

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

Commits
  • 0e95069 release: plugin-react@6.3.0 (#1557)
  • 8a7d0d4 feat(plugin-react): make reactCompilerPreset work with @​rolldown/plugin-babel...
  • See full diff in compare view

Updates typescript-eslint from 8.72.1 to 8.72.2

Release notes

Sourced from typescript-eslint's releases.

v8.72.2

8.72.2 (2026-11-09)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] parse RegExps with the v flag in unicode sets mode (#13102)
  • eslint-plugin: [no-deprecated] stop on circular alias chains (#13117)
  • eslint-plugin: [no-unnecessary-type-assertion] don't report number to enum assertions (#13104)
  • eslint-plugin: [prefer-nullish-coalescing] treat unconstrained type parameters as possibly nullish (#12994)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.2 (2026-11-09)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vite from 8.3.6 to 8.3.7

Release notes

Sourced from vite's releases.

v8.3.7

Bug Fixes

Miscellaneous Chores

Tests

Build System

Changelog

Sourced from vite's changelog.

8.3.7 (2026-11-09)

Bug Fixes

Miscellaneous Chores

Tests

Build System

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the js-minor-patch group in /config-ui with 4 updates
cd2dc14 
Bumps the js-minor-patch group in /config-ui with 4 updates: [axios](https://github.com/axios/axios), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `axios` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.21.0...v1.21.1)

Updates `@vitejs/plugin-react` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.3.0/packages/plugin-react)

Updates `typescript-eslint` from 8.72.1 to 8.72.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.2/packages/typescript-eslint)

Updates `vite` from 8.3.6 to 8.3.7
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.7/packages/vite)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: typescript-eslint
  dependency-version: 8.72.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: vite
  dependency-version: 8.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 14, 2026
@klesh
klesh merged commit 5894562 into main Nov 14, 2026
8 checks passed
@klesh
klesh deleted the dependabot/npm_and_yarn/config-ui/js-minor-patch-aea13841b9 branch November 14, 2026 07:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@klesh klesh klesh approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@klesh