@automattic/vip 4.1.4 → 4.1.6

package/node_modules/@types/node/stream/iter.d.ts

@@ -45,14 +45,14 @@ declare module "node:stream/iter" {
         [shareSyncProtocol](options: ShareSyncOptions): SyncShare;
     }
     // IDL dictionaries, enums, typedefs
-    type BackpressurePolicy = "strict" | "block" | "drop-oldest" | "drop-newest";
+    type BackpressurePolicy = "strict" | "unbounded" | "drop-oldest" | "drop-newest";
     type ByteReadableStream = AsyncIterable<Uint8Array[]>;
     type SyncByteReadableStream = Iterable<Uint8Array[]>;
     interface WriteOptions {
         signal?: AbortSignal;
     }
     interface PushStreamOptions {
-        highWaterMark?: number;
+        budget?: number;
         backpressure?: BackpressurePolicy;
         signal?: AbortSignal;
     }
@@ -85,21 +85,21 @@ declare module "node:stream/iter" {
         signal?: AbortSignal;
     }
     interface BroadcastOptions {
-        highWaterMark?: number;
+        budget?: number;
         backpressure?: BackpressurePolicy;
         signal?: AbortSignal;
     }
     interface ShareOptions {
-        highWaterMark?: number;
+        budget?: number;
         backpressure?: BackpressurePolicy;
         signal?: AbortSignal;
     }
     interface ShareSyncOptions {
-        highWaterMark?: number;
+        budget?: number;
         backpressure?: BackpressurePolicy;
     }
     interface DuplexDirectionOptions {
-        highWaterMark?: number;
+        budget?: number;
         backpressure?: BackpressurePolicy;
     }
     interface DuplexOptions {
@@ -142,7 +142,7 @@ declare module "node:stream/iter" {
         broadcast: Broadcast;
     }
     interface Writer extends Disposable, AsyncDisposable {
-        readonly desiredSize: number | null;
+        readonly canWrite: boolean | null;
         write(chunk: Uint8Array | string, options?: WriteOptions): Promise<void>;
         writev(chunks: Array<Uint8Array | string>, options?: WriteOptions): Promise<void>;
         writeSync(chunk: Uint8Array | string): boolean;
@@ -155,7 +155,7 @@ declare module "node:stream/iter" {
         write(chunk: Uint8Array | string, options?: WriteOptions): Promise<void>;
     }
     interface SyncWriter extends Disposable {
-        readonly desiredSize: number | null;
+        readonly canWrite: boolean | null;
         writeSync(chunk: Uint8Array | string): number;
         writevSync(chunks: Array<Uint8Array | string>): number;
         endSync(): number;
@@ -166,19 +166,16 @@ declare module "node:stream/iter" {
     }
     interface Broadcast extends Disposable {
         readonly consumerCount: number;
-        readonly bufferSize: number;
         push(...args: any[]): ByteReadableStream;
         cancel(reason?: any): void;
     }
     interface Share extends Disposable {
         readonly consumerCount: number;
-        readonly bufferSize: number;
         pull(...args: any[]): ByteReadableStream;
         cancel(reason?: any): void;
     }
     interface SyncShare extends Disposable {
         readonly consumerCount: number;
-        readonly bufferSize: number;
         pull(...args: any): SyncByteReadableStream;
         cancel(reason?: any): void;
     }
@@ -329,7 +326,7 @@ declare module "node:stream/iter" {
      * });
      *
      * await pipeTo(from('hello world'),
-     *              fromWritable(writable, { backpressure: 'block' }));
+     *              fromWritable(writable, { backpressure: 'unbounded' }));
      * ```
      * @since v26.1.0
      * @experimental

package/node_modules/@types/node/test/reporters.d.ts

@@ -9,6 +9,7 @@ declare module "node:test/reporters" {
         | { type: "test:enqueue"; data: EventData.TestEnqueue }
         | { type: "test:fail"; data: EventData.TestFail }
         | { type: "test:interrupted"; data: EventData.TestInterrupted }
+        | { type: "test:log"; data: EventData.TestLog }
         | { type: "test:pass"; data: EventData.TestPass }
         | { type: "test:plan"; data: EventData.TestPlan }
         | { type: "test:start"; data: EventData.TestStart }

package/node_modules/@types/node/test.d.ts

@@ -375,6 +375,7 @@ declare module "node:test" {
             "test:enqueue": [data: EventData.TestEnqueue];
             "test:fail": [data: EventData.TestFail];
             "test:interrupted": [data: EventData.TestInterrupted];
+            "test:log": [data: EventData.TestLog];
             "test:pass": [data: EventData.TestPass];
             "test:plan": [data: EventData.TestPlan];
             "test:start": [data: EventData.TestStart];
@@ -455,6 +456,13 @@ declare module "node:test" {
                  * `undefined` if the test was run through the REPL.
                  */
                 column?: number;
+                /**
+                 * The path of the test file that was
+                 * executed as the entry point of the child process that emitted this event.
+                 * Only present when tests run with process isolation. May differ from
+                 * `file` when the test is defined in a module imported by the entry file.
+                 */
+                entryFile?: string;
                 /**
                  * The path of the test file, `undefined` if test was run through the REPL.
                  */
@@ -845,6 +853,36 @@ declare module "node:test" {
                  */
                 tests: TestStart[];
             }
+            interface TestLog extends LocationInfo {
+                /**
+                 * The structured payload passed to `context.log`, or
+                 * `undefined` if none was provided. The test runner does not interpret this
+                 * value.
+                 */
+                data: unknown;
+                /**
+                 * The log message.
+                 */
+                message: string;
+                /**
+                 * The test name.
+                 */
+                name: string;
+                /**
+                 * The nesting level of the test.
+                 */
+                nesting: number;
+                /**
+                 * The `testId` of the enclosing test, or
+                 * `undefined` for top-level tests.
+                 */
+                parentId: number | undefined;
+                /**
+                 * A numeric identifier for the test instance that emitted
+                 * the log message.
+                 */
+                testId: number;
+            }
             interface TestPass extends LocationInfo {
                 /**
                  * Additional execution metadata.
@@ -1130,6 +1168,25 @@ declare module "node:test" {
              * @param message Message to be reported.
              */
             diagnostic(message: string): void;
+            /**
+             * This function is used to write a log message to the output. Unlike
+             * `context.diagnostic`, the resulting `'test:log'` event is emitted
+             * immediately, in the order that the tests execute, rather than being buffered
+             * until the test reports its results. This function does not return a value.
+             *
+             * ```js
+             * test('top level test', (t) => {
+             *   t.log('fetched user', { userId: 42 });
+             *   t.log('retrying flaky endpoint', { attempt: 3 });
+             * });
+             * ```
+             * @since v26.6.0
+             * @param message Message to be reported.
+             * @param data Optional structured payload attached to the message. The test
+             * runner passes it through untouched. When tests run with process isolation,
+             * this value must be compatible with the [HTML structured clone algorithm](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm).
+             */
+            log(message: string, data?: unknown): void;
             /**
              * The absolute path of the test file that created the current test. If a test file imports
              * additional modules that generate tests, the imported tests will return the path of the root test file.
@@ -1492,6 +1549,21 @@ declare module "node:test" {
              * @param message A diagnostic message to output.
              */
             diagnostic(message: string): void;
+            /**
+             * Write a log message to the output. The resulting `'test:log'` event is
+             * emitted immediately, in the order that the tests execute.
+             *
+             * ```js
+             * test.describe('my suite', (suite) => {
+             *   suite.log('Suite log message');
+             * });
+             * ```
+             * @since v26.6.0
+             * @param message Message to be reported.
+             * @param data Optional structured payload attached to the message. The test
+             * runner passes it through untouched.
+             */
+            log(message: string, data?: unknown): void;
         }
         interface TestOptions {
             /**

package/node_modules/@types/node/tls.d.ts

@@ -219,6 +219,13 @@ declare module "node:tls" {
          * @since v0.11.4
          */
         authorized: boolean;
+        /**
+         * The negotiated ALPN protocol. This is `null` before the handshake completes.
+         * Once the handshake completes, it settles as either the negotiated protocol
+         * name, or `false` if the peers did not negotiate an ALPN protocol.
+         * @since v6.0.0
+         */
+        alpnProtocol: string | false | null;
         /**
          * Returns the reason why the peer's certificate was not been verified. This
          * property is set only when `tlsSocket.authorized === false`.
@@ -230,16 +237,6 @@ declare module "node:tls" {
          * @since v0.11.4
          */
         encrypted: true;
-        /**
-         * String containing the selected ALPN protocol.
-         * Before a handshake has completed, this value is always null.
-         * When a handshake is completed but not ALPN protocol was selected, tlsSocket.alpnProtocol equals false.
-         */
-        alpnProtocol: string | false | null;
-        /**
-         * String containing the server name requested via SNI (Server Name Indication) TLS extension.
-         */
-        servername: string | false | null;
         /**
          * Returns an object representing the local certificate. The returned object has
          * some properties corresponding to the fields of the certificate.
@@ -402,6 +399,13 @@ declare module "node:tls" {
             },
             callback: (err: Error | null) => void,
         ): undefined | boolean;
+        /**
+         * The SNI (Server Name Indication) host name associated with the socket. This is
+         * `null` before the handshake completes. Once the handshake completes it settles
+         * as either the host name string, or `false` if SNI was not used.
+         * @since v0.11.3
+         */
+        servername: string | false | null;
         /**
          * The `tlsSocket.setKeyCert()` method sets the private key and certificate to use for the socket.
          * This is mainly useful if you wish to select a server certificate from a TLS server's `ALPNCallback`.

package/node_modules/@types/node/util.d.ts

@@ -1260,16 +1260,19 @@ declare module "node:util" {
      *
      * // 3-digit hex color (shorthand)
      * console.log(styleText('#f00', 'Red text'));
+     *
+     * // Hex color combined with other modifiers
+     * console.log(styleText(['#00f', 'bold'], 'Bold blue text'));
      * ```
      *
      * The full list of formats can be found in [modifiers](https://nodejs.org/docs/latest-v26.x/api/util.html#modifiers).
-     * @param format A text format or an Array of text formats defined in `util.inspect.colors`, or a hex color in `#RGB`
-     * or `#RRGGBB` form.
+     * @param format A text format defined in `util.inspect.colors`, a hex color in `#RGB` or `#RRGGBB` form,
+     * or an Array of text formats and/or hex colors.
      * @param text The text to to be formatted.
      * @since v20.12.0
      */
     export function styleText(
-        format: InspectColor | readonly InspectColor[] | `#${string}`,
+        format: InspectColor | `#${string}` | readonly (InspectColor | `#${string}`)[],
         text: string,
         options?: StyleTextOptions,
     ): string;

package/node_modules/@types/node/vm.d.ts

@@ -886,6 +886,7 @@ declare module "node:vm" {
          * const module = new vm.SourceTextModule(
          *   'Object.getPrototypeOf(import.meta.prop).secret = secret;',
          *   {
+         *     context: contextifiedObject,
          *     initializeImportMeta(meta) {
          *       // Note: this object is created in the top context. As such,
          *       // Object.getPrototypeOf(import.meta.prop) points to the
@@ -904,7 +905,7 @@ declare module "node:vm" {
          * // To fix this problem, replace
          * //     meta.prop = {};
          * // above with
-         * //     meta.prop = vm.runInContext('{}', contextifiedObject);
+         * //     meta.prop = vm.runInContext('({})', contextifiedObject);
          * ```
          * @param code JavaScript Module code to parse
          */

package/node_modules/@types/node/worker_threads.d.ts

@@ -6,6 +6,7 @@ declare module "node:worker_threads" {
         NodeEventTarget,
     } from "node:events";
     import { FileHandle } from "node:fs/promises";
+    import { Server, Socket } from "node:net";
     import { Performance } from "node:perf_hooks";
     import { Readable, Writable } from "node:stream";
     import { ReadableStream, TransformStream, WritableStream } from "node:stream/web";
@@ -514,7 +515,9 @@ declare module "node:worker_threads" {
         | FileHandle
         | ReadableStream
         | WritableStream
-        | TransformStream;
+        | TransformStream
+        | Server
+        | Socket;
     interface LockGrantedCallback<T> {
         (lock: Lock | null): T;
     }

package/node_modules/@types/node/zlib.d.ts

@@ -94,6 +94,12 @@ declare module "node:zlib" {
          * [Zstd parameters](https://nodejs.org/docs/latest-v26.x/api/zlib.html#zstd-constants).
          */
         params?: { [key: number]: number | boolean } | undefined;
+        /**
+         * Expected total size of the uncompressed input. Must match the input size
+         * when compression finishes. Only applicable to Zstd compressors.
+         * @since v22.15.0
+         */
+        pledgedSrcSize?: number | undefined;
         /**
          * Limits output size when using
          * [convenience methods](https://nodejs.org/docs/latest-v26.x/api/zlib.html#convenience-methods).

package/node_modules/axios/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## v1.19.0 — July 22, 2026
+
+This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
+
+## 🔒 Security Fixes
+
+- Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (https://github.com/advisories/GHSA-hmw2-7cc7-3qxx). (#11028)
+
+## 🚀 New Features
+
+- Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
+  adapters, and serializers. (#11043, #11081)
+- Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
+- HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)
+
+## 🐛 Bug Fixes
+
+- Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
+- Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
+- Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
+- Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
+- URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)
+
+- Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
+- Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
+- Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
+- Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)
+
+## 🔧 Maintenance & Chores
+
+- Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
+- Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
+- Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
+- Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
+- Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
+- Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve Axios:
+
+- @afonsojramos (#11028)
+- @MahinAnowar (#11006)
+- @yassertawfik4 (#11024)
+- @AnandSundar (#11029)
+- @lin-hongkuan (#11035)
+- @Wali007-lab (#11054)
+- @magicdawn (#11043)
+- @andrewkernel (#11053)
+- @Sagargupta16 (#11059)
+- @Rpaudel379 (#11078)
+- @kobihikri (#11076)
+- @spokodev (#11061)
+- @shaedrich (#11081)
+- @QodeXcli (#11062)
+- @akahoshi1421 (#11067)
+- @TheHonoredOne914 (#11071)
+- @Ahsan1Murtaza (#11073)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.18.1...v1.19.0)
+
+
 ## v1.18.0 — June 13, 2026
 
 This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.