Potential breaking changes
- The changelog explicitly labels a breaking change.
⚠️ Breaking Changes & Deprecations
Additional changes to review2 matched termsMatched wording:removedno longerThese matches may be harmless in context. Expand to see the excerpts.
This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.
⚠️ Breaking Changes & Deprecations
- Bower & Committed
dist/Removed:dist/bundles are no longer committed to the repo, andbower.jsonplus the Gruntpackage2bowertask have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)
🔒 Security Fixes
- Prototype Pollution in Header Merge (GHSA-6chq-wfr3-2hj9): Tightened
isFormDatato reject plain/null-prototype objects and requireappend, and guarded the Node HTTP adapter sodata.getHeaders()is only merged when it is not inherited fromObject.prototype. Blocks injected headers via pollutedgetHeaders. (#10750) - Prototype Pollution in Config Merging (GHSA-pf86-5x62-jrwf):
mergeConfig, defaults resolution, and the HTTP adapter now uses own-property checks for , , , , and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. ()