Additional changes to review2 matched termsMatched wording:removedno longerThese matches may be harmless in context. Expand to see the excerpts.
- The changelog contains “removed”; check what was removed.
CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)
- The changelog contains the phrase “no longer”; its impact needs context.
v1.16.1 — May 13, 2026
This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.
🔒 Security Fixes
- Prototype Pollution Defence-in-Depth: Hardened
formDataToJSONagainst already-pollutedObject.prototypeby walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413) - Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
- CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)
🐛 Bug Fixes
- Data URI Parsing: Updated the
fromDataURIregex to match RFC 2397 more strictly, fixing edge cases indata:URL handling. ()