@cognigy/webchat 3.42.0 → 3.44.0

package/OSS_LICENSES.txt

@@ -1,4 +1,4 @@
-Created on 30-04-2026 at 06:59:50
+Created on 16-06-2026 at 13:58:08
 
 {
   "@babel/code-frame@7.29.0": {
@@ -170,7 +170,7 @@ Created on 30-04-2026 at 06:59:50
     "licenseFile": "node_modules/@cognigy/socket-client/LICENSE",
     "copyright": "Copyright (c) 2019 Cognigy GmbH"
   },
-  "@cognigy/webchat@3.42.0": {
+  "@cognigy/webchat@3.44.0": {
     "licenses": "MIT*",
     "repository": "https://github.com/Cognigy/Webchat",
     "publisher": "Cognigy GmbH",
@@ -528,7 +528,7 @@ Created on 30-04-2026 at 06:59:50
     "licenseFile": "node_modules/autolinker/LICENSE",
     "copyright": "Copyright (c) 2014 Gregory Jacobs (http://greg-jacobs.com)"
   },
-  "axios@1.15.0": {
+  "axios@1.15.2": {
     "licenses": "MIT",
     "repository": "https://github.com/axios/axios",
     "publisher": "Matt Zabriskie",

package/dist/webchat.esm.js

@@ -1,7 +1,7 @@
 /*!
- * webchat.esm.js v3.42.0
- * https://github.com/Cognigy/Webchat/tree/v3.42.0
- * https://github.com/Cognigy/Webchat/tree/v3.42.0/OSS_LICENSES.txt
+ * webchat.esm.js v3.44.0
+ * https://github.com/Cognigy/Webchat/tree/v3.44.0
+ * https://github.com/Cognigy/Webchat/tree/v3.44.0/OSS_LICENSES.txt
  */
 import * as __WEBPACK_EXTERNAL_MODULE_react__ from "react";
 import * as __WEBPACK_EXTERNAL_MODULE_react_dom_7dac9eee__ from "react-dom";
@@ -38178,6 +38178,23 @@ class WebchatUI extends react__WEBPACK_IMPORTED_MODULE_0__["default"].PureCompon
       this.props.onShowChatScreen();
     }
   };
+
+  /**
+   * Emits the `webchat/close-button` analytics event.
+   *
+   * Fired only from the close ("X") button handlers — the chat window header
+   * (`handleCloseAndReset`) and the disconnect overlay (`handleClose`). It is
+   * NOT emitted for the toggle button, the home-screen close (which minimizes),
+   * or the programmatic `webchat.close()` / `webchat.toggle()` APIs.
+   *
+   * This lives in the component rather than the redux analytics middleware
+   * (where `webchat/open|close|minimize` are emitted) on purpose: the store only
+   * sees the resulting `SET_OPEN` action and cannot tell which control triggered
+   * the close, so the originating interaction is only known here.
+   */
+  emitCloseButtonAnalytics = () => {
+    this.props.onEmitAnalytics("webchat/close-button");
+  };
   render() {
     const {
       props,
@@ -38242,7 +38259,8 @@ class WebchatUI extends react__WEBPACK_IMPORTED_MODULE_0__["default"].PureCompon
     } = state;
     const {
       widgetSettings: {
-        disableToggleButton
+        disableToggleButton,
+        disableMobileScrollLock
       },
       behavior: {
         enableConnectionStatusIndicator
@@ -38285,12 +38303,15 @@ class WebchatUI extends react__WEBPACK_IMPORTED_MODULE_0__["default"].PureCompon
     const chatRegionAriaLabel = config.settings.customTranslations?.ariaLabels?.chatRegion ?? "Chat window";
     const handleClose = () => {
       onClose();
+      // The disconnect overlay's close ("X") is also a header close button, so
+      // it emits "webchat/close-button" for parity with the chat window header.
+      this.emitCloseButtonAnalytics();
       this.chatToggleButtonRef.current?.focus();
     };
     return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__["default"].createElement(react__WEBPACK_IMPORTED_MODULE_0__["default"].Fragment, null, /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__["default"].createElement(_emotion_react__WEBPACK_IMPORTED_MODULE_2__.a, {
       theme: theme
     }, /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__["default"].createElement(react__WEBPACK_IMPORTED_MODULE_0__["default"].Fragment, null, /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__["default"].createElement(react_remove_scroll__WEBPACK_IMPORTED_MODULE_14__/* ["default"] */ .A, {
-      enabled: open && isMobile,
+      enabled: open && isMobile && !disableMobileScrollLock,
       allowPinchZoom: true
     }, /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__["default"].createElement(_presentational_WebchatWrapper__WEBPACK_IMPORTED_MODULE_17__/* ["default"] */ .A, _extends({
       "data-cognigy-webchat-root": true
@@ -38419,6 +38440,10 @@ class WebchatUI extends react__WEBPACK_IMPORTED_MODULE_0__["default"].PureCompon
     const handleCloseAndReset = () => {
       onSetShowHomeScreen(true);
       onClose();
+      // `onClose()` emits the generic "webchat/close" (which also fires for the
+      // toggle button); this additionally emits "webchat/close-button" so
+      // integrations can react to an explicit header close only.
+      this.emitCloseButtonAnalytics();
       // Restore focus to chat toggle button
       this.chatToggleButtonRef?.current?.focus?.();
     };
@@ -42142,29 +42167,51 @@ const ScreenReaderLiveRegion = ({
       return message !== null && typeof message === "object" && "animationState" in message;
     };
     const timeout = setTimeout(() => {
-      const firstUnannouncedMsg = unannouncedMessages[0]; // Only announce one at a time
-      const id = `webchatMessageId-${firstUnannouncedMsg.timestamp}`;
+      // Scan for the first unannounced message that is currently announceable.
+      // We must NOT stop at index 0 for non-rendered (data-only) messages,
+      // otherwise a permanently data-only message would block all later ones.
+      for (const candidate of unannouncedMessages) {
+        const id = `webchatMessageId-${candidate.timestamp}`;
+
+        // A streaming message that hasn't finished blocks later announcements
+        // (preserves in-order announcement of streamed output).
+        const isStreaming = isProgressiveRenderingEnabled && isStreamingMessage(candidate) && (candidate.animationState === "start" || candidate.animationState === "animating");
+        if (isStreaming) return;
+
+        // Event status pills announce themselves via aria-live="assertive".
+        // Mark handled and continue; they must not block later real messages.
+        if (liveContent[id] === `IGNORE-${id}`) {
+          announcedIdsRef.current.add(id);
+          continue;
+        }
+
+        // Prefer chat-components' live content; otherwise read the DOM.
+        // getTextFromDOM returns null when no <article data-message-id>
+        // node exists, which is the signal for a not-rendered message.
+        const liveText = liveContent[id];
+        const domText = liveText ? null : (0,_utils_live_region_announcement__WEBPACK_IMPORTED_MODULE_2__/* .getTextFromDOM */ .g9)(id);
 
-      // Check if this is a streaming message that hasn't finished
-      const isStreaming = isProgressiveRenderingEnabled && isStreamingMessage(firstUnannouncedMsg) && (firstUnannouncedMsg.animationState === "start" || firstUnannouncedMsg.animationState === "animating");
+        // "Rendered" iff chat-components produced live content for it,
+        // or an <article data-message-id> node exists in the DOM.
+        const isRendered = Boolean(liveText) || domText !== null;
 
-      // If streaming, don't announce yet
-      if (isStreaming) return;
-      announcedIdsRef.current.add(id);
+        // Data-only / unsupported message: not in the chat log UI.
+        // Skip WITHOUT marking announced so it can still be announced
+        // if it becomes rendered later (e.g. progressive rendering).
+        if (!isRendered) {
+          continue;
+        }
 
-      // Skip announcement if the message is marked as "IGNORE". Done by ChatEvent message component, as it has aria-live="assertive"
-      if (liveContent[id] === `IGNORE-${id}`) {
-        setLiveMessage(null);
+        // Rendered: announce exactly one message per effect run.
+        // Fall back to "A new message" for rendered-but-textless nodes.
+        announcedIdsRef.current.add(id);
+        const text = (0,_utils_live_region_announcement__WEBPACK_IMPORTED_MODULE_2__/* .cleanUpText */ .Yx)(liveText || domText || "A new message");
+        setLiveMessage({
+          id,
+          text
+        });
         return;
       }
-
-      // Use live content if available, otherwise extract from DOM
-      const rawText = liveContent[id] || (0,_utils_live_region_announcement__WEBPACK_IMPORTED_MODULE_2__/* .getTextFromDOM */ .g9)(id);
-      const text = (0,_utils_live_region_announcement__WEBPACK_IMPORTED_MODULE_2__/* .cleanUpText */ .Yx)(rawText || "A new message");
-      setLiveMessage({
-        id,
-        text
-      });
     }, 100);
     return () => clearTimeout(timeout);
   }, [messages, liveContent, isProgressiveRenderingEnabled]);
@@ -44180,12 +44227,17 @@ const extractTextForScreenReader = root => {
  * - Querying the DOM for the element with the specified ID
  * - Using the extractTextForScreenReader function to get the text content
  *
+ * The <article data-message-id="..."> node only exists when chat-components'
+ * Message matcher matched at least one plugin. Data-only / unsupported
+ * messages produce no DOM node, so callers can use a `null` return to tell a
+ * not-rendered message apart from a rendered-but-textless one.
+ *
  * @param id - The message ID to extract text for
- * @returns The extracted text or a default message if not found
+ * @returns The extracted text, or `null` if no element exists for the id
  */
 const getTextFromDOM = id => {
   const messageElement = document.querySelector(`[data-message-id="${id}"]`);
-  return messageElement ? extractTextForScreenReader(messageElement) : "A new message";
+  return messageElement ? extractTextForScreenReader(messageElement) : null;
 };
 
 /***/ },
@@ -45597,6 +45649,7 @@ Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod
       disableTextInputSanitization: false,
       disableToggleButton: false,
       disableTeaserMarkdownRemoval: false,
+      disableMobileScrollLock: false,
       enableAutoFocus: false,
       enableInjectionWithoutEmptyHistory: false,
       enableFocusTrap: false,
@@ -45892,10 +45945,23 @@ const createInputCollationMiddleware = () => {
         messages
       } = store.getState().inputCollation;
       const text = messages.map(message => message.text).join(" ");
+
+      /**
+       * Preserve file upload attachments while collating. Each collatable input
+       * carries its attachments in `data.attachments`, so we merge them across all
+       * buffered messages. Without this, uploaded files are silently dropped when
+       * input collation is enabled (no file payload reaches the flow).
+       */
+      const attachments = messages.flatMap(message => {
+        const fileAttachments = message.data?.attachments;
+        return Array.isArray(fileAttachments) ? fileAttachments : [];
+      });
       const message = {
         ...messages[0],
         text,
-        data: undefined
+        data: attachments.length > 0 ? {
+          attachments
+        } : undefined
       };
       return message;
     };
@@ -135860,16 +135926,18 @@ const factory = env => {
   const encodeText = isFetchSupported && (typeof TextEncoder === 'function' ? (encoder => str => encoder.encode(str))(new TextEncoder()) : async str => new Uint8Array(await new Request(str).arrayBuffer()));
   const supportsRequestStream = isRequestSupported && isReadableStreamSupported && test(() => {
     let duplexAccessed = false;
-    const body = new ReadableStream();
-    const hasContentType = new Request(_platform_index_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.origin, {
-      body,
+    const request = new Request(_platform_index_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.origin, {
+      body: new ReadableStream(),
       method: 'POST',
       get duplex() {
         duplexAccessed = true;
         return 'half';
       }
-    }).headers.has('Content-Type');
-    body.cancel();
+    });
+    const hasContentType = request.headers.has('Content-Type');
+    if (request.body != null) {
+      request.body.cancel();
+    }
     return duplexAccessed && !hasContentType;
   });
   const supportsResponseStream = isResponseSupported && isReadableStreamSupported && test(() => _utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isReadableStream(new Response('').body));
@@ -135961,6 +136029,15 @@ const factory = env => {
       // Cloudflare Workers throws when credentials are defined
       // see https://github.com/cloudflare/workerd/issues/902
       const isCredentialsSupported = isRequestSupported && 'credentials' in Request.prototype;
+
+      // If data is FormData and Content-Type is multipart/form-data without boundary,
+      // delete it so fetch can set it correctly with the boundary
+      if (_utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isFormData(data)) {
+        const contentType = headers.getContentType();
+        if (contentType && /^multipart\/form-data/i.test(contentType) && !/boundary=/i.test(contentType)) {
+          headers.delete('content-type');
+        }
+      }
       const resolvedOptions = {
         ...fetchOptions,
         signal: composedSignal,
@@ -136853,6 +136930,7 @@ AxiosError.ERR_BAD_REQUEST = 'ERR_BAD_REQUEST';
 AxiosError.ERR_CANCELED = 'ERR_CANCELED';
 AxiosError.ERR_NOT_SUPPORT = 'ERR_NOT_SUPPORT';
 AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL';
+AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED';
 /* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (AxiosError);
 
 /***/ },
@@ -136870,38 +136948,37 @@ AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL';
 
 
 const $internals = Symbol('internals');
-const isValidHeaderValue = value => !/[\r\n]/.test(value);
-function assertValidHeaderValue(value, header) {
-  if (value === false || value == null) {
-    return;
-  }
-  if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(value)) {
-    value.forEach(v => assertValidHeaderValue(v, header));
-    return;
+const INVALID_HEADER_VALUE_CHARS_RE = /[^\x09\x20-\x7E\x80-\xFF]/g;
+function trimSPorHTAB(str) {
+  let start = 0;
+  let end = str.length;
+  while (start < end) {
+    const code = str.charCodeAt(start);
+    if (code !== 0x09 && code !== 0x20) {
+      break;
+    }
+    start += 1;
   }
-  if (!isValidHeaderValue(String(value))) {
-    throw new Error(`Invalid character in header content ["${header}"]`);
+  while (end > start) {
+    const code = str.charCodeAt(end - 1);
+    if (code !== 0x09 && code !== 0x20) {
+      break;
+    }
+    end -= 1;
   }
+  return start === 0 && end === str.length ? str : str.slice(start, end);
 }
 function normalizeHeader(header) {
   return header && String(header).trim().toLowerCase();
 }
-function stripTrailingCRLF(str) {
-  let end = str.length;
-  while (end > 0) {
-    const charCode = str.charCodeAt(end - 1);
-    if (charCode !== 10 && charCode !== 13) {
-      break;
-    }
-    end -= 1;
-  }
-  return end === str.length ? str : str.slice(0, end);
+function sanitizeHeaderValue(str) {
+  return trimSPorHTAB(str.replace(INVALID_HEADER_VALUE_CHARS_RE, ''));
 }
 function normalizeValue(value) {
   if (value === false || value == null) {
     return value;
   }
-  return _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(value) ? value.map(normalizeValue) : stripTrailingCRLF(String(value));
+  return _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(value) ? value.map(normalizeValue) : sanitizeHeaderValue(String(value));
 }
 function parseTokens(str) {
   const tokens = Object.create(null);
@@ -136957,7 +137034,6 @@ class AxiosHeaders {
       }
       const key = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.findKey(self, lHeader);
       if (!key || self[key] === undefined || _rewrite === true || _rewrite === undefined && self[key] !== false) {
-        assertValidHeaderValue(_value, _header);
         self[key || _header] = normalizeValue(_value);
       }
     }
@@ -137235,7 +137311,7 @@ class InterceptorManager {
  */
 function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
   let isRelativeUrl = !(0,_helpers_isAbsoluteURL_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A)(requestedURL);
-  if (baseURL && (isRelativeUrl || allowAbsoluteUrls == false)) {
+  if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
     return (0,_helpers_combineURLs_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A)(baseURL, requestedURL);
   }
   return requestedURL;
@@ -137348,7 +137424,18 @@ const headersToObject = thing => thing instanceof _AxiosHeaders_js__WEBPACK_IMPO
 function mergeConfig(config1, config2) {
   // eslint-disable-next-line no-param-reassign
   config2 = config2 || {};
-  const config = {};
+
+  // Use a null-prototype object so that downstream reads such as `config.auth`
+  // or `config.baseURL` cannot inherit polluted values from Object.prototype
+  // (see GHSA-q8qp-cvcw-x6jj). `hasOwnProperty` is restored as a non-enumerable
+  // own slot to preserve ergonomics for user code that relies on it.
+  const config = Object.create(null);
+  Object.defineProperty(config, 'hasOwnProperty', {
+    value: Object.prototype.hasOwnProperty,
+    enumerable: false,
+    writable: true,
+    configurable: true
+  });
   function getMergedValue(target, source, prop, caseless) {
     if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isPlainObject(target) && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isPlainObject(source)) {
       return _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.merge.call({
@@ -137387,9 +137474,9 @@ function mergeConfig(config1, config2) {
 
   // eslint-disable-next-line consistent-return
   function mergeDirectKeys(a, b, prop) {
-    if (prop in config2) {
+    if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config2, prop)) {
       return getMergedValue(a, b);
-    } else if (prop in config1) {
+    } else if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config1, prop)) {
       return getMergedValue(undefined, a);
     }
   }
@@ -137420,6 +137507,7 @@ function mergeConfig(config1, config2) {
     httpsAgent: defaultToConfig2,
     cancelToken: defaultToConfig2,
     socketPath: defaultToConfig2,
+    allowedSocketPaths: defaultToConfig2,
     responseEncoding: defaultToConfig2,
     validateStatus: mergeDirectKeys,
     headers: (a, b, prop) => mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true)
@@ -137430,7 +137518,9 @@ function mergeConfig(config1, config2) {
   }), function computeConfigValue(prop) {
     if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
     const merge = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
-    const configValue = merge(config1[prop], config2[prop], prop);
+    const a = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config1, prop) ? config1[prop] : undefined;
+    const b = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(config2, prop) ? config2[prop] : undefined;
+    const configValue = merge(a, b, prop);
     _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isUndefined(configValue) && merge !== mergeDirectKeys || (config[prop] = configValue);
   });
   return config;
@@ -137528,6 +137618,7 @@ function transformData(fns, response) {
 
 
 
+const own = (obj, key) => obj != null && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(obj, key) ? obj[key] : undefined;
 
 /**
  * It takes a string, tries to parse it, and if it fails, it returns the stringified version
@@ -137578,14 +137669,16 @@ const defaults = {
     }
     let isFileList;
     if (isObjectPayload) {
+      const formSerializer = own(this, 'formSerializer');
       if (contentType.indexOf('application/x-www-form-urlencoded') > -1) {
-        return (0,_helpers_toURLEncodedForm_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(data, this.formSerializer).toString();
+        return (0,_helpers_toURLEncodedForm_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(data, formSerializer).toString();
       }
       if ((isFileList = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isFileList(data)) || contentType.indexOf('multipart/form-data') > -1) {
-        const _FormData = this.env && this.env.FormData;
+        const env = own(this, 'env');
+        const _FormData = env && env.FormData;
         return (0,_helpers_toFormData_js__WEBPACK_IMPORTED_MODULE_3__/* ["default"] */ .A)(isFileList ? {
           'files[]': data
-        } : data, _FormData && new _FormData(), this.formSerializer);
+        } : data, _FormData && new _FormData(), formSerializer);
       }
     }
     if (isObjectPayload || hasJSONContentType) {
@@ -137595,21 +137688,22 @@ const defaults = {
     return data;
   }],
   transformResponse: [function transformResponse(data) {
-    const transitional = this.transitional || defaults.transitional;
+    const transitional = own(this, 'transitional') || defaults.transitional;
     const forcedJSONParsing = transitional && transitional.forcedJSONParsing;
-    const JSONRequested = this.responseType === 'json';
+    const responseType = own(this, 'responseType');
+    const JSONRequested = responseType === 'json';
     if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isResponse(data) || _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isReadableStream(data)) {
       return data;
     }
-    if (data && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isString(data) && (forcedJSONParsing && !this.responseType || JSONRequested)) {
+    if (data && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isString(data) && (forcedJSONParsing && !responseType || JSONRequested)) {
       const silentJSONParsing = transitional && transitional.silentJSONParsing;
       const strictJSONParsing = !silentJSONParsing && JSONRequested;
       try {
-        return JSON.parse(data, this.parseReviver);
+        return JSON.parse(data, own(this, 'parseReviver'));
       } catch (e) {
         if (strictJSONParsing) {
           if (e.name === 'SyntaxError') {
-            throw _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.from(e, _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.ERR_BAD_RESPONSE, this, null, this.response);
+            throw _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.from(e, _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.ERR_BAD_RESPONSE, this, null, own(this, 'response'));
           }
           throw e;
         }
@@ -137670,7 +137764,7 @@ _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.forEach(['delete', 'g
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   x: () => (/* binding */ VERSION)
 /* harmony export */ });
-const VERSION = "1.15.0";
+const VERSION = "1.15.2";
 
 /***/ },
 
@@ -137700,10 +137794,9 @@ function encode(str) {
     '(': '%28',
     ')': '%29',
     '~': '%7E',
-    '%20': '+',
-    '%00': '\x00'
+    '%20': '+'
   };
-  return encodeURIComponent(str).replace(/[!'()~]|%20|%00/g, function replacer(match) {
+  return encodeURIComponent(str).replace(/[!'()~]|%20/g, function replacer(match) {
     return charMap[match];
   });
 }
@@ -138096,7 +138189,7 @@ function formDataToJSON(formData) {
     name = !name && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(target) ? target.length : name;
     if (isLast) {
       if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasOwnProp(target, name)) {
-        target[name] = [target[name], value];
+        target[name] = _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isArray(target[name]) ? target[name].concat(value) : [target[name], value];
       } else {
         target[name] = value;
       }
@@ -138291,19 +138384,19 @@ const progressEventReducer = (listener, isDownloadStream, freq = 3) => {
   let bytesNotified = 0;
   const _speedometer = (0,_speedometer_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A)(50, 250);
   return (0,_throttle_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A)(e => {
-    const loaded = e.loaded;
+    const rawLoaded = e.loaded;
     const total = e.lengthComputable ? e.total : undefined;
-    const progressBytes = loaded - bytesNotified;
+    const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+    const progressBytes = Math.max(0, loaded - bytesNotified);
     const rate = _speedometer(progressBytes);
-    const inRange = loaded <= total;
-    bytesNotified = loaded;
+    bytesNotified = Math.max(bytesNotified, loaded);
     const data = {
       loaded,
       total,
       progress: total ? loaded / total : undefined,
       bytes: progressBytes,
       rate: rate ? rate : undefined,
-      estimated: rate && total && inRange ? (total - loaded) / rate : undefined,
+      estimated: rate && total ? (total - loaded) / rate : undefined,
       event: e,
       lengthComputable: total != null,
       [isDownloadStream ? 'download' : 'upload']: true
@@ -138347,16 +138440,21 @@ const asyncDecorator = fn => (...args) => _utils_js__WEBPACK_IMPORTED_MODULE_2__
 
 /* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (config => {
   const newConfig = (0,_core_mergeConfig_js__WEBPACK_IMPORTED_MODULE_5__/* ["default"] */ .A)({}, config);
-  let {
-    data,
-    withXSRFToken,
-    xsrfHeaderName,
-    xsrfCookieName,
-    headers,
-    auth
-  } = newConfig;
+
+  // Read only own properties to prevent prototype pollution gadgets
+  // (e.g. Object.prototype.baseURL = 'https://evil.com'). See GHSA-q8qp-cvcw-x6jj.
+  const own = key => _utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.hasOwnProp(newConfig, key) ? newConfig[key] : undefined;
+  const data = own('data');
+  let withXSRFToken = own('withXSRFToken');
+  const xsrfHeaderName = own('xsrfHeaderName');
+  const xsrfCookieName = own('xsrfCookieName');
+  let headers = own('headers');
+  const auth = own('auth');
+  const baseURL = own('baseURL');
+  const allowAbsoluteUrls = own('allowAbsoluteUrls');
+  const url = own('url');
   newConfig.headers = headers = _core_AxiosHeaders_js__WEBPACK_IMPORTED_MODULE_6__/* ["default"] */ .A.from(headers);
-  newConfig.url = (0,_buildURL_js__WEBPACK_IMPORTED_MODULE_7__/* ["default"] */ .A)((0,_core_buildFullPath_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(newConfig.baseURL, newConfig.url, newConfig.allowAbsoluteUrls), config.params, config.paramsSerializer);
+  newConfig.url = (0,_buildURL_js__WEBPACK_IMPORTED_MODULE_7__/* ["default"] */ .A)((0,_core_buildFullPath_js__WEBPACK_IMPORTED_MODULE_4__/* ["default"] */ .A)(baseURL, url, allowAbsoluteUrls), config.params, config.paramsSerializer);
 
   // HTTP basic authentication
   if (auth) {
@@ -138383,9 +138481,15 @@ const asyncDecorator = fn => (...args) => _utils_js__WEBPACK_IMPORTED_MODULE_2__
   // Specifically not if we're in a web worker, or react-native.
 
   if (_platform_index_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.hasStandardBrowserEnv) {
-    withXSRFToken && _utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isFunction(withXSRFToken) && (withXSRFToken = withXSRFToken(newConfig));
-    if (withXSRFToken || withXSRFToken !== false && (0,_isURLSameOrigin_js__WEBPACK_IMPORTED_MODULE_2__/* ["default"] */ .A)(newConfig.url)) {
-      // Add xsrf header
+    if (_utils_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.isFunction(withXSRFToken)) {
+      withXSRFToken = withXSRFToken(newConfig);
+    }
+
+    // Strict boolean check — prevents proto-pollution gadgets (e.g. Object.prototype.withXSRFToken = 1)
+    // and misconfigurations (e.g. "false") from short-circuiting the same-origin check and leaking
+    // the XSRF token cross-origin. See GHSA-xx6v-rp6x-q39c.
+    const shouldSendXSRF = withXSRFToken === true || withXSRFToken == null && (0,_isURLSameOrigin_js__WEBPACK_IMPORTED_MODULE_2__/* ["default"] */ .A)(newConfig.url);
+    if (shouldSendXSRF) {
       const xsrfValue = xsrfHeaderName && xsrfCookieName && _cookies_js__WEBPACK_IMPORTED_MODULE_3__/* ["default"] */ .A.read(xsrfCookieName);
       if (xsrfValue) {
         headers.set(xsrfHeaderName, xsrfValue);
@@ -138650,6 +138754,7 @@ function toFormData(obj, formData, options) {
   const dots = options.dots;
   const indexes = options.indexes;
   const _Blob = options.Blob || typeof Blob !== 'undefined' && Blob;
+  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
   const useBlob = _Blob && _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isSpecCompliantForm(formData);
   if (!_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isFunction(visitor)) {
     throw new TypeError('visitor must be a function');
@@ -138716,8 +138821,11 @@ function toFormData(obj, formData, options) {
     convertValue,
     isVisitable
   });
-  function build(value, path) {
+  function build(value, path, depth = 0) {
     if (_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isUndefined(value)) return;
+    if (depth > maxDepth) {
+      throw new _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A('Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth, _core_AxiosError_js__WEBPACK_IMPORTED_MODULE_1__/* ["default"] */ .A.ERR_FORM_DATA_DEPTH_EXCEEDED);
+    }
     if (stack.indexOf(value) !== -1) {
       throw Error('Circular reference detected in ' + path.join('.'));
     }
@@ -138725,7 +138833,7 @@ function toFormData(obj, formData, options) {
     _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.forEach(value, function each(el, key) {
       const result = !(_utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isUndefined(el) || el === null) && visitor.call(formData, el, _utils_js__WEBPACK_IMPORTED_MODULE_0__/* ["default"] */ .A.isString(key) ? key.trim() : key, path, exposedHelpers);
       if (result === true) {
-        build(el, path ? path.concat(key) : [key]);
+        build(el, path ? path.concat(key) : [key], depth + 1);
       }
     });
     stack.pop();
@@ -138935,7 +139043,9 @@ function assertOptions(options, schema, allowUnknown) {
   let i = keys.length;
   while (i-- > 0) {
     const opt = keys[i];
-    const validator = schema[opt];
+    // Use hasOwnProperty so a polluted Object.prototype.<opt> cannot supply
+    // a non-function validator and cause a TypeError. See GHSA-q8qp-cvcw-x6jj.
+    const validator = Object.prototype.hasOwnProperty.call(schema, opt) ? schema[opt] : undefined;
     if (validator) {
       const value = options[opt];
       const result = value === undefined || validator(value, opt, options);
@@ -139342,10 +139452,16 @@ function getGlobal() {
 const G = getGlobal();
 const FormDataCtor = typeof G.FormData !== 'undefined' ? G.FormData : undefined;
 const isFormData = thing => {
-  let kind;
-  return thing && (FormDataCtor && thing instanceof FormDataCtor || isFunction(thing.append) && ((kind = kindOf(thing)) === 'formdata' ||
+  if (!thing) return false;
+  if (FormDataCtor && thing instanceof FormDataCtor) return true;
+  // Reject plain objects inheriting directly from Object.prototype so prototype-pollution gadgets can't spoof FormData (GHSA-6chq-wfr3-2hj9).
+  const proto = getPrototypeOf(thing);
+  if (!proto || proto === Object.prototype) return false;
+  if (!isFunction(thing.append)) return false;
+  const kind = kindOf(thing);
+  return kind === 'formdata' ||
   // detect form-data instance
-  kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]'));
+  kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]';
 };
 
 /**