@automattic/vip 4.1.5 → 4.1.8

package/node_modules/axios/dist/axios.js

@@ -1,4 +1,4 @@
-/*! Axios v1.18.1 Copyright (c) 2026 Matt Zabriskie and contributors */
+/*! Axios v1.20.0 Copyright (c) 2026 Matt Zabriskie and contributors */
 (function (global, factory) {
   typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
   typeof define === 'function' && define.amd ? define(factory) :
@@ -561,13 +561,61 @@
       return hasOwnProperty.call(obj, prop);
     };
   }(Object.prototype);
+  var isUnsafeObjectKey = function isUnsafeObjectKey(prop) {
+    return typeof prop === 'string' && (prop === '__proto__' || prop === 'constructor' || prop === 'prototype');
+  };
+
+  /**
+   * Determine whether an inherited object must be treated as a shared-prototype
+   * boundary. Cross-realm Object.prototype objects cannot be distinguished
+   * reliably from application-created null-prototype objects because their
+   * properties are mutable, so all inherited terminal prototypes are excluded
+   * as a fail-closed boundary. A null-prototype source still keeps its own
+   * properties, as produced by mergeConfig and other safe materialization paths.
+   *
+   * @param {*} obj The object to inspect
+   * @param {*} prototype The object's prototype
+   * @param {boolean} source Whether obj is the original traversal source
+   *
+   * @returns {boolean} True when obj is a safe prototype traversal boundary
+   */
+  var isPrototypeBoundary = function isPrototypeBoundary(obj, prototype, source) {
+    return obj === Object.prototype || !source && prototype === null;
+  };
 
   /**
-   * Walk the prototype chain (excluding the shared Object.prototype) looking for
-   * an own `prop`. This distinguishes genuine own/inherited members — including
-   * class accessors and template prototypes — from members injected via
-   * Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which
-   * live on Object.prototype itself and are therefore never matched.
+   * Determine whether an object can retain its identity through code paths that
+   * add, replace, and remove config properties without bypassing unsafe-key
+   * filtering. Immutable objects, unsafe-key-bearing objects, and objects with
+   * accessor or restricted data properties must be materialized instead.
+   *
+   * @param {*} obj The object to inspect
+   *
+   * @returns {boolean} True when every own property is safe and fully mutable
+   */
+  var isSafeAndFullyMutable = function isSafeAndFullyMutable(obj) {
+    if (!Object.isExtensible(obj)) {
+      return false;
+    }
+    var props = Object.getOwnPropertyNames(obj);
+    if (Object.getOwnPropertySymbols) {
+      props.push.apply(props, _toConsumableArray(Object.getOwnPropertySymbols(obj)));
+    }
+    return props.every(function (prop) {
+      if (isUnsafeObjectKey(prop)) {
+        return false;
+      }
+      var descriptor = Object.getOwnPropertyDescriptor(obj, prop);
+      return !!descriptor && descriptor.configurable && descriptor.writable === true;
+    });
+  };
+
+  /**
+   * Walk the prototype chain (excluding the source realm's Object.prototype)
+   * looking for an own `prop`. This distinguishes genuine own/inherited members
+   * — including class accessors and template prototypes — from members injected
+   * via Object.prototype pollution (e.g. `Object.prototype.username = '...'`),
+   * which live on Object.prototype itself and are therefore never matched.
    *
    * @param {*} thing The value whose chain to inspect
    * @param {string|symbol} prop The property key to look for
@@ -577,15 +625,19 @@
   var hasOwnInPrototypeChain = function hasOwnInPrototypeChain(thing, prop) {
     var obj = thing;
     var seen = [];
-    while (obj != null && obj !== Object.prototype) {
+    while (obj != null) {
       if (seen.indexOf(obj) !== -1) {
         return false;
       }
       seen.push(obj);
+      var prototype = getPrototypeOf(obj);
+      if (isPrototypeBoundary(obj, prototype, obj === thing)) {
+        return false;
+      }
       if (hasOwnProperty(obj, prop)) {
         return true;
       }
-      obj = getPrototypeOf(obj);
+      obj = prototype;
     }
     return false;
   };
@@ -604,6 +656,65 @@
   var getSafeProp = function getSafeProp(obj, prop) {
     return obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : undefined;
   };
+
+  /**
+   * Flatten an object and its application-defined prototype chain into a
+   * null-prototype object. Members inherited only from the source realm's
+   * Object.prototype are deliberately excluded, while class/template members
+   * below that boundary are preserved.
+   *
+   * @param {*} thing The value to flatten
+   *
+   * @returns {*} A null-prototype copy, or the original value when it is already
+   * structurally safe or is not an object
+   */
+  var toSafeFlatObject = function toSafeFlatObject(thing) {
+    if (thing == null || _typeof(thing) !== 'object' && typeof thing !== 'function') {
+      return thing;
+    }
+    var sourcePrototype = getPrototypeOf(thing);
+    if (sourcePrototype === null && isSafeAndFullyMutable(thing)) {
+      return thing;
+    }
+    var result = Object.create(null);
+    var merged = Object.create(null);
+    var seen = [];
+    var current = thing;
+    while (current != null) {
+      if (seen.indexOf(current) !== -1) {
+        break;
+      }
+      seen.push(current);
+      var prototype = current === thing ? sourcePrototype : getPrototypeOf(current);
+      if (isPrototypeBoundary(current, prototype, current === thing)) {
+        break;
+      }
+      var props = Object.getOwnPropertyNames(current);
+      if (Object.getOwnPropertySymbols) {
+        props.push.apply(props, _toConsumableArray(Object.getOwnPropertySymbols(current)));
+      }
+      var _iterator2 = _createForOfIteratorHelper(props),
+        _step;
+      try {
+        for (_iterator2.s(); !(_step = _iterator2.n()).done;) {
+          var prop = _step.value;
+          if (isUnsafeObjectKey(prop)) {
+            continue;
+          }
+          if (!hasOwnProperty(merged, prop)) {
+            result[prop] = thing[prop];
+            merged[prop] = true;
+          }
+        }
+      } catch (err) {
+        _iterator2.e(err);
+      } finally {
+        _iterator2.f();
+      }
+      current = prototype;
+    }
+    return result;
+  };
   var kindOf = function (cache) {
     return function (thing) {
       var str = toString.call(thing);
@@ -737,9 +848,9 @@
     }
     var prototype = getPrototypeOf(val);
     return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) &&
-    // Treat any genuine (non-Object.prototype-polluted) Symbol.toStringTag or
-    // Symbol.iterator as evidence the value is a tagged/iterable type rather
-    // than a plain object, while ignoring keys injected onto Object.prototype.
+    // Treat safe own/inherited Symbol.toStringTag or Symbol.iterator members as
+    // evidence the value is tagged/iterable, while ignoring members reachable
+    // only through shared or terminal prototype boundaries.
     !hasOwnInPrototypeChain(val, toStringTag) && !hasOwnInPrototypeChain(val, iterator);
   };
 
@@ -825,6 +936,7 @@
    * @returns {boolean} True if value is a FileList, otherwise false
    */
   var isFileList = kindOfTest('FileList');
+  var isSet = kindOfTest('Set');
 
   /**
    * Determine if a value is a Stream
@@ -1354,11 +1466,29 @@
         if (!('toJSON' in source)) {
           // add-on descent / delete-on-ascent: preserves path semantics, so DAG nodes serialise at every occurrence (see #7230).
           visited.add(source);
-          var target = isArray(source) ? [] : {};
-          forEach(source, function (value, key) {
-            var reducedValue = _visit(value);
-            !isUndefined(reducedValue) && (target[key] = reducedValue);
-          });
+          var target;
+          if (isSet(source)) {
+            target = [];
+            var _iterator3 = _createForOfIteratorHelper(source),
+              _step2;
+            try {
+              for (_iterator3.s(); !(_step2 = _iterator3.n()).done;) {
+                var value = _step2.value;
+                var reducedValue = _visit(value);
+                !isUndefined(reducedValue) && target.push(reducedValue);
+              }
+            } catch (err) {
+              _iterator3.e(err);
+            } finally {
+              _iterator3.f();
+            }
+          } else {
+            target = isArray(source) ? [] : {};
+            forEach(source, function (value, key) {
+              var reducedValue = _visit(value);
+              !isUndefined(reducedValue) && (target[key] = reducedValue);
+            });
+          }
           visited["delete"](source);
           return target;
         }
@@ -1493,6 +1623,7 @@
     // an alias to avoid ESLint no-prototype-builtins detection
     hasOwnInPrototypeChain: hasOwnInPrototypeChain,
     getSafeProp: getSafeProp,
+    toSafeFlatObject: toSafeFlatObject,
     reduceDescriptors: reduceDescriptors,
     freezeMethods: freezeMethods,
     toObjectSet: toObjectSet,
@@ -1539,17 +1670,18 @@
       i = line.indexOf(':');
       key = line.substring(0, i).trim().toLowerCase();
       val = line.substring(i + 1).trim();
-      if (!key || parsed[key] && ignoreDuplicateOf[key]) {
+      var hasKey = utils$1.hasOwnProp(parsed, key);
+      if (!key || hasKey && utils$1.hasOwnProp(ignoreDuplicateOf, key)) {
         return;
       }
       if (key === 'set-cookie') {
-        if (parsed[key]) {
+        if (hasKey) {
           parsed[key].push(val);
         } else {
           parsed[key] = [val];
         }
       } else {
-        parsed[key] = parsed[key] ? parsed[key] + ', ' + val : val;
+        parsed[key] = hasKey ? parsed[key] + ', ' + val : val;
       }
     });
     return parsed;
@@ -1602,7 +1734,7 @@
     return byteStringHeaders;
   }
 
-  var $internals = Symbol('internals');
+  var $internals$1 = Symbol('internals');
   function normalizeHeader(header) {
     return header && String(header).trim().toLowerCase();
   }
@@ -1621,6 +1753,90 @@
     }
     return tokens;
   }
+  var parameterNameRE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+  function trimOWS(value) {
+    var start = 0;
+    var end = value.length;
+    while (start < end) {
+      var code = value.charCodeAt(start);
+      if (code !== 0x09 && code !== 0x20) {
+        break;
+      }
+      start += 1;
+    }
+    while (end > start) {
+      var _code = value.charCodeAt(end - 1);
+      if (_code !== 0x09 && _code !== 0x20) {
+        break;
+      }
+      end -= 1;
+    }
+    return start === 0 && end === value.length ? value : value.slice(start, end);
+  }
+  function decodeQuotedString(value) {
+    var last = value.length - 1;
+    if (last < 1 || value.charCodeAt(0) !== 0x22 || value.charCodeAt(last) !== 0x22) {
+      return value;
+    }
+    var decoded = '';
+    for (var i = 1; i < last; i++) {
+      var code = value.charCodeAt(i);
+      if (code === 0x22) {
+        return value;
+      }
+      if (code === 0x5c) {
+        i += 1;
+        if (i >= last) {
+          return value;
+        }
+      }
+      decoded += value[i];
+    }
+    return decoded;
+  }
+  function _parseParameters(value) {
+    var parameters = Object.create(null);
+    var str = String(value);
+    var start = 0;
+    var quoted = false;
+    var escaped = false;
+    function parseParameter(end) {
+      var part = trimOWS(str.slice(start, end));
+      var equals = part.indexOf('=');
+      if (equals < 1) {
+        return;
+      }
+      var name = trimOWS(part.slice(0, equals));
+      if (!parameterNameRE.test(name)) {
+        return;
+      }
+      var normalizedName = name.toLowerCase();
+      if (normalizedName === '__proto__' || normalizedName === 'constructor' || normalizedName === 'prototype') {
+        return;
+      }
+      var parameterValue = trimOWS(part.slice(equals + 1));
+      parameters[normalizedName] = decodeQuotedString(parameterValue);
+    }
+    for (var i = 0; i < str.length; i++) {
+      var code = str.charCodeAt(i);
+      if (quoted) {
+        if (escaped) {
+          escaped = false;
+        } else if (code === 0x5c) {
+          escaped = true;
+        } else if (code === 0x22) {
+          quoted = false;
+        }
+      } else if (code === 0x22) {
+        quoted = true;
+      } else if (code === 0x2c || code === 0x3b) {
+        parseParameter(i);
+        start = i + 1;
+      }
+    }
+    parseParameter(str.length);
+    return parameters;
+  }
   var isValidHeaderName = function isValidHeaderName(str) {
     return /^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(str.trim());
   };
@@ -1845,7 +2061,8 @@
     }, {
       key: "getSetCookie",
       value: function getSetCookie() {
-        return this.get('set-cookie') || [];
+        var value = this.get('set-cookie');
+        return utils$1.isArray(value) ? value : value == null || value === false ? [] : [value];
       }
     }, {
       key: Symbol.toStringTag,
@@ -1857,6 +2074,11 @@
       value: function from(thing) {
         return thing instanceof this ? thing : new this(thing);
       }
+    }, {
+      key: "parseParameters",
+      value: function parseParameters(value) {
+        return _parseParameters(value);
+      }
     }, {
       key: "concat",
       value: function concat(first) {
@@ -1872,7 +2094,7 @@
     }, {
       key: "accessor",
       value: function accessor(header) {
-        var internals = this[$internals] = this[$internals] = {
+        var internals = this[$internals$1] = this[$internals$1] = {
           accessors: {}
         };
         var accessors = internals.accessors;
@@ -1967,6 +2189,23 @@
     };
     return _visit(config);
   }
+  function stringifySafely$1(value) {
+    try {
+      return String(value);
+    } catch (err) {
+      return '';
+    }
+  }
+  function aggregateErrorMessage(error) {
+    var message = error.errors.map(function (entry) {
+      try {
+        return entry && entry.message ? stringifySafely$1(entry.message) : stringifySafely$1(entry);
+      } catch (err) {
+        return '';
+      }
+    }).filter(Boolean).join('; ');
+    return message || error.name || 'AggregateError';
+  }
   var AxiosError = /*#__PURE__*/function (_Error) {
     /**
      * Create an Error with the specified message, config, error code, request and response.
@@ -2039,7 +2278,14 @@
     }], [{
       key: "from",
       value: function from(error, code, config, request, response, customProps) {
-        var axiosError = new AxiosError(error.message, code || error.code, config, request, response);
+        // `AggregateError` (thrown by Node on dual-stack/Happy-Eyeballs connection
+        // failures) has an empty `message`; its detail lives in `errors[]`. Without
+        // this, the wrapped error surfaces with a blank message (see #6721).
+        var message = error.message;
+        if (!message && utils$1.isArray(error.errors) && error.errors.length) {
+          message = aggregateErrorMessage(error);
+        }
+        var axiosError = new AxiosError(message, code || error.code, config, request, response);
         // Match native `Error` `cause` semantics: non-enumerable. The wrapped
         // error often carries circular internals (sockets, requests, agents), so
         // an enumerable `cause` makes structured loggers (pino/winston) and any
@@ -2170,23 +2416,17 @@
 
     // eslint-disable-next-line no-param-reassign
     formData = formData || new (FormData)();
-
-    // eslint-disable-next-line no-param-reassign
-    options = utils$1.toFlatObject(options, {
-      metaTokens: true,
-      dots: false,
-      indexes: false
-    }, false, function defined(option, source) {
-      // eslint-disable-next-line no-eq-null,eqeqeq
-      return !utils$1.isUndefined(source[option]);
-    });
-    var metaTokens = options.metaTokens;
+    var option = function option(name, fallback) {
+      var value = utils$1.getSafeProp(options, name);
+      return utils$1.isUndefined(value) ? fallback : value;
+    };
+    var metaTokens = option('metaTokens', true);
     // eslint-disable-next-line no-use-before-define
-    var visitor = options.visitor || defaultVisitor;
-    var dots = options.dots;
-    var indexes = options.indexes;
-    var _Blob = options.Blob || typeof Blob !== 'undefined' && Blob;
-    var maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;
+    var visitor = option('visitor') || defaultVisitor;
+    var dots = option('dots', false);
+    var indexes = option('indexes', false);
+    var _Blob = option('Blob') || typeof Blob !== 'undefined' && Blob;
+    var maxDepth = option('maxDepth', DEFAULT_FORM_DATA_MAX_DEPTH);
     var useBlob = _Blob && utils$1.isSpecCompliantForm(formData);
     var stack = [];
     if (!utils$1.isFunction(visitor)) {
@@ -2207,9 +2447,6 @@
         if (useBlob && typeof _Blob === 'function') {
           return new _Blob([value]);
         }
-        if (typeof Buffer !== 'undefined') {
-          return Buffer.from(value);
-        }
         throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT);
       }
       return value;
@@ -2403,10 +2640,52 @@
     return url;
   }
 
+  var $internals = Symbol('internals');
+
+  // `handlers` is public and may be replaced with a nullish value by user code;
+  // `clear()` has always tolerated that. Treat it as an empty stack rather than
+  // dereferencing it.
+  function countHandlers(handlers) {
+    return handlers ? handlers.length : 0;
+  }
+  function trimHandlers(handlers) {
+    if (!handlers) {
+      return;
+    }
+    while (handlers.length && handlers[handlers.length - 1] === null) {
+      handlers.pop();
+    }
+  }
+  function syncHandlerEntries(manager, internals) {
+    var handlers = manager.handlers;
+    var length = countHandlers(handlers);
+    if (handlers !== internals.handlersRef) {
+      internals.handlersRef = handlers;
+      internals.handlerEntries.clear();
+    } else if (length !== internals.handlersLength) {
+      if (!length) {
+        internals.handlerEntries.clear();
+      } else {
+        internals.handlerEntries.forEach(function removeStaleEntry(entry, id) {
+          if (handlers[entry.index] !== entry.handler) {
+            internals.handlerEntries["delete"](id);
+          }
+        });
+      }
+    }
+    internals.handlersLength = length;
+  }
   var InterceptorManager = /*#__PURE__*/function () {
     function InterceptorManager() {
       _classCallCheck(this, InterceptorManager);
       this.handlers = [];
+      this[$internals] = {
+        handlersRef: this.handlers,
+        handlersLength: this.handlers.length,
+        handlerEntries: new Map(),
+        iterationDepth: 0,
+        nextId: 0
+      };
     }
 
     /**
@@ -2421,13 +2700,25 @@
     return _createClass(InterceptorManager, [{
       key: "use",
       value: function use(fulfilled, rejected, options) {
-        this.handlers.push({
+        var handler = {
           fulfilled: fulfilled,
           rejected: rejected,
           synchronous: options ? options.synchronous : false,
           runWhen: options ? options.runWhen : null
+        };
+        var internals = this[$internals];
+        if (this.handlers == null) {
+          this.handlers = [];
+        }
+        syncHandlerEntries(this, internals);
+        var id = internals.nextId++;
+        this.handlers.push(handler);
+        internals.handlerEntries.set(id, {
+          handler: handler,
+          index: this.handlers.length - 1
         });
-        return this.handlers.length - 1;
+        internals.handlersLength = this.handlers.length;
+        return id;
       }
 
       /**
@@ -2440,8 +2731,23 @@
     }, {
       key: "eject",
       value: function eject(id) {
-        if (this.handlers[id]) {
-          this.handlers[id] = null;
+        var internals = this[$internals];
+        syncHandlerEntries(this, internals);
+        var entry = internals.handlerEntries.get(id);
+        if (entry) {
+          internals.handlerEntries["delete"](id);
+
+          // Ignore IDs invalidated by clear or direct replacement of handlers.
+          if (this.handlers[entry.index] !== entry.handler) {
+            return;
+          }
+          this.handlers[entry.index] = null;
+
+          // Do not reuse an index while forEach is walking its length snapshot.
+          if (!internals.iterationDepth) {
+            trimHandlers(this.handlers);
+            internals.handlersLength = this.handlers.length;
+          }
         }
       }
 
@@ -2455,6 +2761,7 @@
       value: function clear() {
         if (this.handlers) {
           this.handlers = [];
+          syncHandlerEntries(this, this[$internals]);
         }
       }
 
@@ -2471,11 +2778,22 @@
     }, {
       key: "forEach",
       value: function forEach(fn) {
-        utils$1.forEach(this.handlers, function forEachHandler(h) {
-          if (h !== null) {
-            fn(h);
+        var internals = this[$internals];
+        syncHandlerEntries(this, internals);
+        internals.iterationDepth++;
+        try {
+          utils$1.forEach(this.handlers, function forEachHandler(h) {
+            if (h !== null) {
+              fn(h);
+            }
+          });
+        } finally {
+          if (! --internals.iterationDepth) {
+            syncHandlerEntries(this, internals);
+            trimHandlers(this.handlers);
+            internals.handlersLength = countHandlers(this.handlers);
           }
-        });
+        }
       }
     }]);
   }();
@@ -2581,12 +2899,18 @@
    * @returns An array of strings.
    */
   function parsePropPath(name) {
-    // foo[x][y][z]
-    // foo.x.y.z
-    // foo-x-y-z
-    // foo x y z
+    // foo[x][y][z] -> ['foo', 'x', 'y', 'z']
+    // foo.x.y.z    -> ['foo', 'x', 'y', 'z']
+    // A path is split on `.` and on `[...]` groups. A segment — whether written
+    // in dot notation or captured inside brackets — may contain any character
+    // except `.`, `[` and `]`, so a key like `user-name` or `user name` is kept
+    // literal instead of being split (#5402). `.`, `[` and `]` keep their existing
+    // meaning, e.g. `foo[bar.baz]` -> ['foo', 'bar', 'baz'] and `[]` is an array push.
+    // Excluding `[` from the bracket group also makes the match fail fast at the
+    // next `[`, so a malformed name cannot rescan to the end of the string from
+    // every unmatched `[` — parsing stays linear in the length of the name.
     var path = [];
-    var pattern = /\w+|\[(\w*)]/g;
+    var pattern = /[^.[\]]+|\[([^.[\]]*)]/g;
     var match;
     while ((match = pattern.exec(name)) !== null) {
       throwIfDepthExceeded(path.length);
@@ -2657,6 +2981,8 @@
     return null;
   }
 
+  var methodList = Object.freeze(['get', 'delete', 'head', 'options', 'post', 'put', 'patch', 'purge', 'link', 'unlink', 'query']);
+
   var own = function own(obj, key) {
     return obj != null && utils$1.hasOwnProp(obj, key) ? obj[key] : undefined;
   };
@@ -2775,7 +3101,7 @@
       }
     }
   };
-  utils$1.forEach(['delete', 'get', 'head', 'post', 'put', 'patch', 'query'], function (method) {
+  utils$1.forEach(methodList, function (method) {
     defaults.headers[method] = {};
   });
 
@@ -2843,6 +3169,26 @@
     }
   }
 
+  var urlParserControlCharacters = /[\t\n\r]/g;
+
+  /**
+   * Match WHATWG URL preprocessing before checking a URL's protocol.
+   *
+   * @param {string} url
+   *
+   * @returns {string}
+   */
+  function normalizeURLForProtocolCheck(url) {
+    if (typeof url !== 'string') {
+      return url;
+    }
+    var start = 0;
+    while (start < url.length && url.charCodeAt(start) <= 0x20) {
+      start++;
+    }
+    return url.slice(start).replace(urlParserControlCharacters, '');
+  }
+
   function parseProtocol(url) {
     var match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url);
     return match && match[1] || '';
@@ -2892,7 +3238,7 @@
    * Throttle decorator
    * @param {Function} fn
    * @param {Number} freq
-   * @return {Function}
+   * @return {Array<Function>}
    */
   function throttle(fn, freq) {
     var timestamp = 0;
@@ -2930,7 +3276,13 @@
     var flush = function flush() {
       return lastArgs && invoke(lastArgs);
     };
-    return [throttled, flush];
+    var flushWith = function flushWith() {
+      for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {
+        args[_key2] = arguments[_key2];
+      }
+      return invoke(args);
+    };
+    return [throttled, flush, flushWith];
   }
 
   var progressEventReducer = function progressEventReducer(listener, isDownloadStream) {
@@ -2938,12 +3290,12 @@
     var bytesNotified = 0;
     var _speedometer = speedometer(50, 250);
     return throttle(function (e) {
-      if (!e || typeof e.loaded !== 'number') {
+      if (!e || !utils$1.isNumber(e.loaded)) {
         return;
       }
       var rawLoaded = e.loaded;
       var total = e.lengthComputable ? e.total : undefined;
-      var loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+      var loaded = Math.max(0, total != null ? Math.min(rawLoaded, total) : rawLoaded);
       var progressBytes = Math.max(0, loaded - bytesNotified);
       var rate = _speedometer(progressBytes);
       bytesNotified = Math.max(bytesNotified, loaded);
@@ -2971,11 +3323,12 @@
     }, throttled[1]];
   };
   var asyncDecorator = function asyncDecorator(fn) {
+    var scheduler = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : utils$1.asap;
     return function () {
       for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
         args[_key] = arguments[_key];
       }
-      return utils$1.asap(function () {
+      return scheduler(function () {
         return fn.apply(void 0, args);
       });
     };
@@ -3073,24 +3426,51 @@
    * @returns {string} The combined URL
    */
   function combineURLs(baseURL, relativeURL) {
-    return relativeURL ? baseURL.replace(/\/?\/$/, '') + '/' + relativeURL.replace(/^\/+/, '') : baseURL;
+    if (!relativeURL) {
+      return baseURL;
+    }
+    var end = baseURL.length;
+    while (end > 0 && baseURL.charCodeAt(end - 1) === 47) {
+      end--;
+    }
+    return baseURL.slice(0, end) + '/' + relativeURL.replace(/^\/+/, '');
   }
 
   var malformedHttpProtocol = /^https?:(?!\/\/)/i;
-  var httpProtocolControlCharacters = /[\t\n\r]/g;
-  function stripLeadingC0ControlOrSpace(url) {
-    var i = 0;
-    while (i < url.length && url.charCodeAt(i) <= 0x20) {
-      i++;
+
+  // Redact the parts of a URL that can carry secrets before it is embedded in an
+  // error message. AxiosError.toJSON() serializes `message` verbatim and errors
+  // are commonly logged, while the opt-in `config.redact` model only cleans
+  // config keys — it cannot reach the message. Redact only the genuinely
+  // sensitive substrings — userinfo (credentials), query parameter values and
+  // fragment contents — with the same REDACTED marker the config redaction uses,
+  // while keeping the scheme, host, path and parameter names so the offending
+  // request stays accurately identifiable.
+  function redactFragment(fragment) {
+    if (!fragment) {
+      return fragment;
     }
-    return url.slice(i);
+    return fragment.replace(/(^|&)([^=&]*=)?[^&]+/g, function (match, separator) {
+      var parameterName = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : '';
+      return "".concat(separator).concat(parameterName).concat(REDACTED);
+    });
   }
-  function normalizeURLForProtocolCheck(url) {
-    return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, '');
+  function redactSensitiveURLParts(url) {
+    var redactedURL = url.replace(/^(https?:\/{0,2})[^/?#]*@/i, "$1".concat(REDACTED, "@"));
+    var fragmentIndex = redactedURL.indexOf('#');
+    var urlWithoutFragment = fragmentIndex === -1 ? redactedURL : redactedURL.slice(0, fragmentIndex);
+    var redactedURLWithoutFragment = urlWithoutFragment.replace(/([?&][^=&#]*=)[^&#]*/g, "$1".concat(REDACTED));
+    if (fragmentIndex === -1) {
+      return redactedURLWithoutFragment;
+    }
+    return "".concat(redactedURLWithoutFragment, "#").concat(redactFragment(redactedURL.slice(fragmentIndex + 1)));
   }
   function assertValidHttpProtocolURL(url, config) {
-    if (typeof url === 'string' && malformedHttpProtocol.test(normalizeURLForProtocolCheck(url))) {
-      throw new AxiosError('Invalid URL: missing "//" after protocol', AxiosError.ERR_INVALID_URL, config);
+    if (typeof url === 'string') {
+      var normalizedURL = normalizeURLForProtocolCheck(url);
+      if (malformedHttpProtocol.test(normalizedURL)) {
+        throw new AxiosError("Invalid URL ".concat(JSON.stringify(redactSensitiveURLParts(normalizedURL)), ": missing \"//\" after protocol"), AxiosError.ERR_INVALID_URL, config);
+      }
     }
   }
 
@@ -3117,6 +3497,14 @@
   var headersToObject = function headersToObject(thing) {
     return thing instanceof AxiosHeaders ? _objectSpread2({}, thing) : thing;
   };
+  var ownEnumerableKeys = function ownEnumerableKeys(thing) {
+    if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) {
+      return Object.keys(thing).concat(Object.getOwnPropertySymbols(thing).filter(function (symbol) {
+        return Object.getOwnPropertyDescriptor(thing, symbol).enumerable;
+      }));
+    }
+    return Object.keys(thing);
+  };
 
   /**
    * Config-specific merge-function which creates a new config-object
@@ -3216,7 +3604,7 @@
       transformResponse: defaultToConfig2,
       paramsSerializer: defaultToConfig2,
       timeout: defaultToConfig2,
-      timeoutMessage: defaultToConfig2,
+      timeoutErrorMessage: defaultToConfig2,
       withCredentials: defaultToConfig2,
       withXSRFToken: defaultToConfig2,
       adapter: defaultToConfig2,
@@ -3241,7 +3629,7 @@
         return mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true);
       }
     };
-    utils$1.forEach(Object.keys(_objectSpread2(_objectSpread2({}, config1), config2)), function computeConfigValue(prop) {
+    utils$1.forEach(ownEnumerableKeys(_objectSpread2(_objectSpread2({}, config1), config2)), function computeConfigValue(prop) {
       if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
       var merge = utils$1.hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
       var a = utils$1.hasOwnProp(config1, prop) ? config1[prop] : undefined;
@@ -3260,6 +3648,18 @@
   }
 
   var FORM_DATA_CONTENT_HEADERS = ['content-type', 'content-length'];
+
+  /**
+   * Apply the headers generated by a FormData implementation to the request headers,
+   * honoring the `formDataHeaderPolicy` option: with 'content-only', copy only the
+   * content-* headers; otherwise merge all of them.
+   *
+   * @param {AxiosHeaders} headers - the request headers to mutate
+   * @param {Object | null | undefined} formHeaders - headers produced by the FormData implementation
+   * @param {String} [policy] - the resolved `formDataHeaderPolicy` config value
+   *
+   * @returns {void}
+   */
   function setFormDataHeaders(headers, formHeaders, policy) {
     if (policy !== 'content-only') {
       headers.set(formHeaders);
@@ -3319,11 +3719,12 @@
       }
     }
     if (utils$1.isFormData(data)) {
+      var getHeaders = utils$1.getSafeProp(data, 'getHeaders');
       if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv || utils$1.isReactNative(data)) {
         headers.setContentType(undefined); // browser/web worker/RN handles it
-      } else if (utils$1.isFunction(data.getHeaders)) {
+      } else if (utils$1.isFunction(getHeaders)) {
         // Node.js FormData (like form-data package)
-        setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy'));
+        setFormDataHeaders(headers, getHeaders.call(data), own('formDataHeaderPolicy'));
       }
     }
 
@@ -3361,7 +3762,7 @@
         onDownloadProgress = _config.onDownloadProgress;
       var onCanceled;
       var uploadThrottled, downloadThrottled;
-      var flushUpload, flushDownload;
+      var flushUpload, flushDownload, flushDownloadWithEvent;
       function done() {
         flushUpload && flushUpload(); // flush events
         flushDownload && flushDownload(); // flush events
@@ -3374,10 +3775,50 @@
 
       // Set the request timeout in MS
       request.timeout = _config.timeout;
-      function onloadend() {
+      function onloadend(event) {
+        if (!request) {
+          return;
+        }
+
+        // Status 0 means no response was received, which onerror and onabort normally
+        // reject before this runs. Firefox 152 fires only readystatechange and loadend for
+        // navigation-canceled requests (https://bugzilla.mozilla.org/show_bug.cgi?id=1505389),
+        // leaving settle() to resolve them as an empty success. ECONNABORTED is the error
+        // onabort raised on Firefox 151. Reads over file:, which some environments report as
+        // status 0 on success, are excluded by the request URL's scheme after browser-style
+        // preprocessing, by the page origin's scheme for relative URLs (which inherit it), or
+        // by responseURL where implemented.
+        if (request.status === 0 && (parseProtocol(normalizeURLForProtocolCheck(_config.url)) || parseProtocol(platform.origin)) !== 'file' && !(request.responseURL && request.responseURL.startsWith('file:'))) {
+          reject(new AxiosError('Request aborted', AxiosError.ECONNABORTED, config, request));
+          done();
+
+          // Clean up request
+          request = null;
+          return;
+        }
+
+        // When loadend is still dispatching, flushing with it gives progress
+        // listeners a final delivery whose event has a live target. The legacy
+        // ready-state fallback has no event, so replay its pending progress.
+        // A throwing listener must not block settlement; rethrow asynchronously,
+        // matching how listener errors surface on the throttle timer path.
+        try {
+          if (event) {
+            flushDownloadWithEvent && flushDownloadWithEvent(event);
+          } else {
+            flushDownload && flushDownload();
+          }
+        } catch (err) {
+          setTimeout(function () {
+            throw err;
+          });
+        }
+
+        // A final progress callback can cancel the request synchronously.
         if (!request) {
           return;
         }
+
         // Prepare the response
         var responseHeaders = AxiosHeaders.from('getAllResponseHeaders' in request && request.getAllResponseHeaders());
         var responseData = !responseType || responseType === 'text' || responseType === 'json' ? request.responseText : request.response;
@@ -3486,9 +3927,10 @@
       // Handle progress if needed
       if (onDownloadProgress) {
         var _progressEventReducer = progressEventReducer(onDownloadProgress, true);
-        var _progressEventReducer2 = _slicedToArray(_progressEventReducer, 2);
+        var _progressEventReducer2 = _slicedToArray(_progressEventReducer, 3);
         downloadThrottled = _progressEventReducer2[0];
         flushDownload = _progressEventReducer2[1];
+        flushDownloadWithEvent = _progressEventReducer2[2];
         request.addEventListener('progress', downloadThrottled);
       }
 
@@ -3561,7 +4003,14 @@
       signals = null;
     };
     signals.forEach(function (signal) {
-      return signal.addEventListener('abort', onabort, {
+      if (aborted) {
+        return;
+      }
+      if (signal.aborted) {
+        onabort.call(signal);
+        return;
+      }
+      signal.addEventListener('abort', onabort, {
         once: true
       });
     });
@@ -3776,13 +4225,11 @@
   };
 
   /**
-   * Estimate decoded byte length of a data:// URL *without* allocating large buffers.
-   * - For base64: compute exact decoded size using length and padding;
-   *               handle %XX at the character-count level (no string allocation).
-   * - For non-base64: compute the exact percent-decoded UTF-8 byte length.
-   *
-   * @param {string} url
-   * @returns {number}
+   * Estimate data: URL byte lengths *without* allocating large buffers.
+   * - Fetch percent-decodes a base64 body before decoding it.
+   * - Node's Buffer.from(body, 'base64') sizes its backing allocation from the
+   *   raw body, including ignored characters and content after padding.
+   * - Non-base64 data is percent-decoded and then encoded as UTF-8.
    */
   var isHexDigit = function isHexDigit(charCode) {
     return charCode >= 48 && charCode <= 57 || charCode >= 65 && charCode <= 70 || charCode >= 97 && charCode <= 102;
@@ -3790,7 +4237,80 @@
   var isPercentEncodedByte = function isPercentEncodedByte(str, i, len) {
     return i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2));
   };
-  function estimateDataURLDecodedBytes(url) {
+  var hexValue = function hexValue(charCode) {
+    return charCode <= 57 ? charCode - 48 : (charCode & 0xdf) - 55;
+  };
+  var isBase64Char = function isBase64Char(charCode) {
+    return charCode >= 65 && charCode <= 90 ||
+    // A-Z
+    charCode >= 97 && charCode <= 122 ||
+    // a-z
+    charCode >= 48 && charCode <= 57 ||
+    // 0-9
+    charCode === 43 ||
+    // +
+    charCode === 47 ||
+    // /
+    charCode === 45 ||
+    // - (base64url)
+    charCode === 95;
+  }; // _ (base64url)
+
+  var isBase64Whitespace = function isBase64Whitespace(charCode) {
+    return charCode === 9 || charCode === 10 || charCode === 12 || charCode === 13 || charCode === 32;
+  };
+  var base64Bytes = function base64Bytes(significant) {
+    var groups = Math.floor(significant / 4);
+    var remainder = significant % 4;
+    return groups * 3 + (remainder === 2 ? 1 : remainder === 3 ? 2 : 0);
+  };
+
+  // Buffer.byteLength(body, 'base64') uses the raw string length as an allocation
+  // upper bound even when Buffer.from later ignores characters or stops at '='.
+  var estimateBase64BufferAllocation = function estimateBase64BufferAllocation(body) {
+    var len = body.length;
+    var padding = 0;
+    if (len > 0 && body.charCodeAt(len - 1) === 61 /* '=' */) {
+      padding++;
+      if (len > 1 && body.charCodeAt(len - 2) === 61 /* '=' */) {
+        padding++;
+      }
+    }
+    return Math.floor((len - padding) * 3 / 4);
+  };
+  var estimatePercentDecodedBase64Bytes = function estimatePercentDecodedBase64Bytes(body) {
+    var len = body.length;
+    var significant = 0;
+    var padding = 0;
+    var invalid = false;
+    for (var i = 0; i < len; i++) {
+      var code = body.charCodeAt(i);
+      if (code === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) {
+        code = hexValue(body.charCodeAt(i + 1)) * 16 + hexValue(body.charCodeAt(i + 2));
+        i += 2;
+      }
+      if (isBase64Whitespace(code)) {
+        continue;
+      }
+      if (code === 61 /* '=' */) {
+        padding++;
+        continue;
+      }
+      if (!isBase64Char(code) || padding > 0) {
+        invalid = true;
+        continue;
+      }
+      significant++;
+    }
+
+    // Fetch rejects malformed forgiving-base64 input. Returning the raw-size
+    // allocation bound keeps that invalid input from becoming a pre-check bypass.
+    if (invalid || padding > 2 || padding > 0 && (significant + padding) % 4 !== 0 || significant % 4 === 1) {
+      return estimateBase64BufferAllocation(body);
+    }
+    return base64Bytes(significant);
+  };
+  var estimateDataURLBytes = function estimateDataURLBytes(url, estimateBase64) {
     if (!url || typeof url !== 'string') return 0;
     if (!url.startsWith('data:')) return 0;
     var comma = url.indexOf(',');
@@ -3799,49 +4319,7 @@
     var body = url.slice(comma + 1);
     var isBase64 = /;base64/i.test(meta);
     if (isBase64) {
-      var effectiveLen = body.length;
-      var len = body.length; // cache length
-
-      for (var i = 0; i < len; i++) {
-        if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) {
-          var a = body.charCodeAt(i + 1);
-          var b = body.charCodeAt(i + 2);
-          var isHex = isHexDigit(a) && isHexDigit(b);
-          if (isHex) {
-            effectiveLen -= 2;
-            i += 2;
-          }
-        }
-      }
-      var pad = 0;
-      var idx = len - 1;
-      var tailIsPct3D = function tailIsPct3D(j) {
-        return j >= 2 && body.charCodeAt(j - 2) === 37 &&
-        // '%'
-        body.charCodeAt(j - 1) === 51 && (
-        // '3'
-        body.charCodeAt(j) === 68 || body.charCodeAt(j) === 100);
-      }; // 'D' or 'd'
-
-      if (idx >= 0) {
-        if (body.charCodeAt(idx) === 61 /* '=' */) {
-          pad++;
-          idx--;
-        } else if (tailIsPct3D(idx)) {
-          pad++;
-          idx -= 3;
-        }
-      }
-      if (pad === 1 && idx >= 0) {
-        if (body.charCodeAt(idx) === 61 /* '=' */) {
-          pad++;
-        } else if (tailIsPct3D(idx)) {
-          pad++;
-        }
-      }
-      var groups = Math.floor(effectiveLen / 4);
-      var _bytes = groups * 3 - (pad || 0);
-      return _bytes > 0 ? _bytes : 0;
+      return estimateBase64(body);
     }
 
     // Compute UTF-8 byte length directly from UTF-16 code units without allocating
@@ -3849,20 +4327,20 @@
     // Valid %XX triplets count as one decoded byte; this matches the bytes that
     // decodeURIComponent(body) would produce before Buffer re-encodes the string.
     var bytes = 0;
-    for (var _i = 0, _len = body.length; _i < _len; _i++) {
-      var c = body.charCodeAt(_i);
-      if (c === 37 /* '%' */ && isPercentEncodedByte(body, _i, _len)) {
+    for (var i = 0, len = body.length; i < len; i++) {
+      var c = body.charCodeAt(i);
+      if (c === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) {
         bytes += 1;
-        _i += 2;
+        i += 2;
       } else if (c < 0x80) {
         bytes += 1;
       } else if (c < 0x800) {
         bytes += 2;
-      } else if (c >= 0xd800 && c <= 0xdbff && _i + 1 < _len) {
-        var next = body.charCodeAt(_i + 1);
+      } else if (c >= 0xd800 && c <= 0xdbff && i + 1 < len) {
+        var next = body.charCodeAt(i + 1);
         if (next >= 0xdc00 && next <= 0xdfff) {
           bytes += 4;
-          _i++;
+          i++;
         } else {
           bytes += 3;
         }
@@ -3871,11 +4349,34 @@
       }
     }
     return bytes;
+  };
+
+  /**
+   * Estimate the percent-decoded payload size used by Fetch data: URLs.
+   *
+   * @param {string} url
+   * @returns {number}
+   */
+  function estimateDataURLDecodedBytes(url) {
+    // Fetch removes URL fragments before processing a data: URL.
+    var fragmentIndex = typeof url === 'string' ? url.indexOf('#') : -1;
+    return estimateDataURLBytes(fragmentIndex === -1 ? url : url.slice(0, fragmentIndex), estimatePercentDecodedBase64Bytes);
   }
 
-  var VERSION = "1.18.1";
+  var VERSION = "1.20.0";
 
   var DEFAULT_CHUNK_SIZE = 64 * 1024;
+  var DEFAULT_REQUEST_OPTIONS = {
+    cache: 'default',
+    redirect: 'follow',
+    referrer: 'about:client',
+    referrerPolicy: '',
+    mode: 'cors',
+    integrity: '',
+    keepalive: false,
+    priority: 'auto',
+    window: null
+  };
   var isFunction = utils$1.isFunction;
 
   /**
@@ -4077,11 +4578,11 @@
     }();
     return /*#__PURE__*/function () {
       var _ref4 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(config) {
-        var _resolveConfig, url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, _resolveConfig$withCr, withCredentials, fetchOptions, maxContentLength, maxBodyLength, hasMaxContentLength, hasMaxBodyLength, own, _fetch, composedSignal, request, unsubscribe, requestContentLength, pendingBodyError, maxBodyLengthError, auth, configAuth, username, password, parsedURL, urlUsername, urlPassword, estimated, outboundLength, mustEnforceStreamBody, trackRequestStream, _request, contentTypeHeader, _ref5, _ref6, onProgress, flush, isCredentialsSupported, contentType, resolvedOptions, response, responseHeaders, declaredLength, isStreamResponse, options, responseContentLength, _ref7, _ref8, _onProgress, _flush, bytesRead, onChunkProgress, responseData, materializedSize, canceledError, networkError, _t3, _t4;
+        var _resolveConfig, url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, _resolveConfig$withCr, withCredentials, fetchOptions, maxContentLength, maxBodyLength, maxRedirects, hasMaxContentLength, hasMaxBodyLength, own, _fetch, composedSignal, request, unsubscribe, requestContentLength, pendingBodyError, maxBodyLengthError, auth, configAuth, username, password, parsedURL, urlUsername, urlPassword, estimated, outboundLength, mustEnforceStreamBody, trackRequestStream, _request, contentTypeHeader, _ref5, _ref6, onProgress, flush, isCredentialsSupported, contentType, safeFetchOptions, resolvedOptions, response, responseHeaders, declaredLength, isStreamResponse, options, responseContentLength, _ref7, _ref8, _onProgress, _flush, bytesRead, onChunkProgress, responseData, materializedSize, canceledError, networkError, _t3, _t4;
         return _regenerator().w(function (_context4) {
           while (1) switch (_context4.p = _context4.n) {
             case 0:
-              _resolveConfig = resolveConfig(config), url = _resolveConfig.url, method = _resolveConfig.method, data = _resolveConfig.data, signal = _resolveConfig.signal, cancelToken = _resolveConfig.cancelToken, timeout = _resolveConfig.timeout, onDownloadProgress = _resolveConfig.onDownloadProgress, onUploadProgress = _resolveConfig.onUploadProgress, responseType = _resolveConfig.responseType, headers = _resolveConfig.headers, _resolveConfig$withCr = _resolveConfig.withCredentials, withCredentials = _resolveConfig$withCr === void 0 ? 'same-origin' : _resolveConfig$withCr, fetchOptions = _resolveConfig.fetchOptions, maxContentLength = _resolveConfig.maxContentLength, maxBodyLength = _resolveConfig.maxBodyLength;
+              _resolveConfig = resolveConfig(config), url = _resolveConfig.url, method = _resolveConfig.method, data = _resolveConfig.data, signal = _resolveConfig.signal, cancelToken = _resolveConfig.cancelToken, timeout = _resolveConfig.timeout, onDownloadProgress = _resolveConfig.onDownloadProgress, onUploadProgress = _resolveConfig.onUploadProgress, responseType = _resolveConfig.responseType, headers = _resolveConfig.headers, _resolveConfig$withCr = _resolveConfig.withCredentials, withCredentials = _resolveConfig$withCr === void 0 ? 'same-origin' : _resolveConfig$withCr, fetchOptions = _resolveConfig.fetchOptions, maxContentLength = _resolveConfig.maxContentLength, maxBodyLength = _resolveConfig.maxBodyLength, maxRedirects = _resolveConfig.maxRedirects;
               hasMaxContentLength = utils$1.isNumber(maxContentLength) && maxContentLength > -1;
               hasMaxBodyLength = utils$1.isNumber(maxBodyLength) && maxBodyLength > -1;
               own = function own(key) {
@@ -4247,7 +4748,18 @@
 
               // Set User-Agent header if not already set (fetch defaults to 'node' in Node.js)
               headers.set('User-Agent', 'axios/' + VERSION, false);
-              resolvedOptions = _objectSpread2(_objectSpread2({}, fetchOptions), {}, {
+              safeFetchOptions = fetchOptions == null ? fetchOptions : Object.assign(Object.create(null), fetchOptions);
+              if (safeFetchOptions) {
+                // These options are owned by Axios and are already reflected in the
+                // resolved Request passed to fetch.
+                delete safeFetchOptions.body;
+                delete safeFetchOptions.headers;
+                delete safeFetchOptions.method;
+                delete safeFetchOptions.signal;
+                delete safeFetchOptions.duplex;
+                delete safeFetchOptions.credentials;
+              }
+              resolvedOptions = Object.assign(Object.create(null), safeFetchOptions, {
                 signal: composedSignal,
                 method: method.toUpperCase(),
                 headers: toByteStringHeaderObject(headers.normalize()),
@@ -4255,9 +4767,28 @@
                 duplex: 'half',
                 credentials: isCredentialsSupported ? withCredentials : undefined
               });
+              if (isRequestSupported) {
+                utils$1.forEach(DEFAULT_REQUEST_OPTIONS, function (value, key) {
+                  if (resolvedOptions[key] === undefined) {
+                    resolvedOptions[key] = value;
+                  }
+                });
+                if (resolvedOptions.signal === undefined) {
+                  resolvedOptions.signal = null;
+                }
+                if (resolvedOptions.body === undefined) {
+                  resolvedOptions.body = null;
+                }
+              }
+              if (maxRedirects === 0) {
+                resolvedOptions.redirect = 'manual';
+                if (safeFetchOptions) {
+                  safeFetchOptions.redirect = 'manual';
+                }
+              }
               request = isRequestSupported && new Request(url, resolvedOptions);
               _context4.n = 11;
-              return isRequestSupported ? _fetch(request, fetchOptions) : _fetch(url, resolvedOptions);
+              return isRequestSupported ? _fetch(request, safeFetchOptions) : _fetch(url, resolvedOptions);
             case 11:
               response = _context4.v;
               responseHeaders = AxiosHeaders.from(response.headers); // Cheap pre-check: if the server honestly declares a content-length that
@@ -4565,9 +5096,13 @@
    *
    * @returns {Promise} The Promise to be fulfilled
    */
-  function dispatchRequest(config) {
+  function dispatchRequest(_config) {
+    // Interceptors may replace the merged config with an ordinary object. Flatten
+    // it at the dispatch boundary so shared prototype members cannot become
+    // request behavior, while preserving intentional template/class members.
+    var config = utils$1.toSafeFlatObject(_config);
     throwIfCancellationRequested(config);
-    config.headers = AxiosHeaders.from(config.headers);
+    config.headers = AxiosHeaders.from(utils$1.getSafeProp(config, 'headers'));
 
     // Transform request data
     config.data = transformData.call(config, config.transformRequest);
@@ -4723,7 +5258,7 @@
       key: "request",
       value: (function () {
         var _request2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(configOrUrl, config) {
-          var dummy, stack, firstNewlineIndex, secondNewlineIndex, stackWithoutTwoTopLines, _t;
+          var dummy, dummyStack, stack, firstNewlineIndex, _firstNewlineIndex, secondNewlineIndex, stackWithoutTwoTopLines, _t;
           return _regenerator().w(function (_context) {
             while (1) switch (_context.p = _context.n) {
               case 0:
@@ -4736,31 +5271,28 @@
                 _context.p = 2;
                 _t = _context.v;
                 if (_t instanceof Error) {
-                  dummy = {};
-                  Error.captureStackTrace ? Error.captureStackTrace(dummy) : dummy = new Error();
-
-                  // slice off the Error: ... line
-                  stack = function () {
-                    if (!dummy.stack) {
-                      return '';
-                    }
-                    var firstNewlineIndex = dummy.stack.indexOf('\n');
-                    return firstNewlineIndex === -1 ? '' : dummy.stack.slice(firstNewlineIndex + 1);
-                  }();
                   try {
+                    dummy = {};
+                    Error.captureStackTrace ? Error.captureStackTrace(dummy) : dummy = new Error();
+                    dummyStack = dummy.stack;
+                    stack = ''; // slice off the Error: ... line
+                    if (typeof dummyStack === 'string') {
+                      firstNewlineIndex = dummyStack.indexOf('\n');
+                      stack = firstNewlineIndex === -1 ? '' : dummyStack.slice(firstNewlineIndex + 1);
+                    }
                     if (!_t.stack) {
                       _t.stack = stack;
                       // match without the 2 top stack lines
                     } else if (stack) {
-                      firstNewlineIndex = stack.indexOf('\n');
-                      secondNewlineIndex = firstNewlineIndex === -1 ? -1 : stack.indexOf('\n', firstNewlineIndex + 1);
+                      _firstNewlineIndex = stack.indexOf('\n');
+                      secondNewlineIndex = _firstNewlineIndex === -1 ? -1 : stack.indexOf('\n', _firstNewlineIndex + 1);
                       stackWithoutTwoTopLines = secondNewlineIndex === -1 ? '' : stack.slice(secondNewlineIndex + 1);
                       if (!String(_t.stack).endsWith(stackWithoutTwoTopLines)) {
                         _t.stack += '\n' + stack;
                       }
                     }
                   } catch (e) {
-                    // ignore the case where "stack" is an un-writable property
+                    // Ignore failures from custom stack hooks or un-writable stack properties.
                   }
                 }
                 throw _t;
@@ -4777,6 +5309,7 @@
     }, {
       key: "_request",
       value: function _request(configOrUrl, config) {
+        var _this = this;
         /*eslint no-param-reassign:0*/
         // Allow for axios('example/url'[, config]) a la fetch API
         if (typeof configOrUrl === 'string') {
@@ -4825,11 +5358,11 @@
         }, true);
 
         // Set config.method
-        config.method = (config.method || this.defaults.method || 'get').toLowerCase();
+        config.method = (utils$1.getSafeProp(config, 'method') || utils$1.getSafeProp(this.defaults, 'method') || 'get').toLowerCase();
 
         // Flatten headers
         var contextHeaders = headers && utils$1.merge(headers.common, headers[config.method]);
-        headers && utils$1.forEach(['delete', 'get', 'head', 'post', 'put', 'patch', 'query', 'common'], function (method) {
+        headers && utils$1.forEach(methodList.concat('common'), function (method) {
           delete headers[method];
         });
         config.headers = AxiosHeaders.concat(contextHeaders, headers);
@@ -4874,16 +5407,31 @@
           var onFulfilled = requestInterceptorChain[i++];
           var onRejected = requestInterceptorChain[i++];
           try {
-            newConfig = onFulfilled(newConfig);
+            newConfig = onFulfilled ? onFulfilled(newConfig) : newConfig;
           } catch (error) {
-            onRejected.call(this, error);
+            if (!onRejected) {
+              promise = Promise.reject(error);
+              break;
+            }
+            try {
+              var rejectedResult = onRejected.call(this, error);
+              if (utils$1.isThenable(rejectedResult)) {
+                promise = Promise.resolve(rejectedResult).then(function () {
+                  return dispatchRequest.call(_this, newConfig);
+                });
+              }
+            } catch (rejectedError) {
+              promise = Promise.reject(rejectedError);
+            }
             break;
           }
         }
-        try {
-          promise = dispatchRequest.call(this, newConfig);
-        } catch (error) {
-          return Promise.reject(error);
+        if (!promise) {
+          try {
+            promise = dispatchRequest.call(this, newConfig);
+          } catch (error) {
+            promise = Promise.reject(error);
+          }
         }
         i = 0;
         len = responseInterceptorChain.length;
@@ -5136,14 +5684,22 @@
     Gone: 410,
     LengthRequired: 411,
     PreconditionFailed: 412,
+    /**
+     * @deprecated Use `ContentTooLarge` instead.
+     */
     PayloadTooLarge: 413,
+    ContentTooLarge: 413,
     UriTooLong: 414,
     UnsupportedMediaType: 415,
     RangeNotSatisfiable: 416,
     ExpectationFailed: 417,
     ImATeapot: 418,
     MisdirectedRequest: 421,
+    /**
+     * @deprecated Use `UnprocessableContent` instead.
+     */
     UnprocessableEntity: 422,
+    UnprocessableContent: 422,
     Locked: 423,
     FailedDependency: 424,
     TooEarly: 425,
@@ -5163,6 +5719,7 @@
     LoopDetected: 508,
     NotExtended: 510,
     NetworkAuthenticationRequired: 511,
+    WebServerReturnsAnUnknownError: 520,
     WebServerIsDown: 521,
     ConnectionTimedOut: 522,
     OriginIsUnreachable: 523,
@@ -5174,7 +5731,9 @@
     var _ref2 = _slicedToArray(_ref, 2),
       key = _ref2[0],
       value = _ref2[1];
-    HttpStatusCode[value] = key;
+    if (HttpStatusCode[value] === undefined) {
+      HttpStatusCode[value] = key;
+    }
   });
 
   /**
@@ -5246,4 +5805,3 @@
   return axios;
 
 }));
-//# sourceMappingURL=axios.js.map