@openclaw/slack 2026.7.2-beta.3 → 2026.7.2-beta.4

package/node_modules/agent-base/src/index.ts

@@ -0,0 +1,345 @@
+import net from 'net';
+import http from 'http';
+import https from 'https';
+import { Duplex } from 'stream';
+import { EventEmitter } from 'events';
+import createDebug from 'debug';
+import promisify from './promisify';
+
+const debug = createDebug('agent-base');
+
+function isAgent(v: any): v is createAgent.AgentLike {
+	return Boolean(v) && typeof v.addRequest === 'function';
+}
+
+function isSecureEndpoint(): boolean {
+	const { stack } = new Error();
+	if (typeof stack !== 'string') return false;
+	return stack.split('\n').some(l => l.indexOf('(https.js:') !== -1  || l.indexOf('node:https:') !== -1);
+}
+
+function createAgent(opts?: createAgent.AgentOptions): createAgent.Agent;
+function createAgent(
+	callback: createAgent.AgentCallback,
+	opts?: createAgent.AgentOptions
+): createAgent.Agent;
+function createAgent(
+	callback?: createAgent.AgentCallback | createAgent.AgentOptions,
+	opts?: createAgent.AgentOptions
+) {
+	return new createAgent.Agent(callback, opts);
+}
+
+namespace createAgent {
+	export interface ClientRequest extends http.ClientRequest {
+		_last?: boolean;
+		_hadError?: boolean;
+		method: string;
+	}
+
+	export interface AgentRequestOptions {
+		host?: string;
+		path?: string;
+		// `port` on `http.RequestOptions` can be a string or undefined,
+		// but `net.TcpNetConnectOpts` expects only a number
+		port: number;
+	}
+
+	export interface HttpRequestOptions
+		extends AgentRequestOptions,
+			Omit<http.RequestOptions, keyof AgentRequestOptions> {
+		secureEndpoint: false;
+	}
+
+	export interface HttpsRequestOptions
+		extends AgentRequestOptions,
+			Omit<https.RequestOptions, keyof AgentRequestOptions> {
+		secureEndpoint: true;
+	}
+
+	export type RequestOptions = HttpRequestOptions | HttpsRequestOptions;
+
+	export type AgentLike = Pick<createAgent.Agent, 'addRequest'> | http.Agent;
+
+	export type AgentCallbackReturn = Duplex | AgentLike;
+
+	export type AgentCallbackCallback = (
+		err?: Error | null,
+		socket?: createAgent.AgentCallbackReturn
+	) => void;
+
+	export type AgentCallbackPromise = (
+		req: createAgent.ClientRequest,
+		opts: createAgent.RequestOptions
+	) =>
+		| createAgent.AgentCallbackReturn
+		| Promise<createAgent.AgentCallbackReturn>;
+
+	export type AgentCallback = typeof Agent.prototype.callback;
+
+	export type AgentOptions = {
+		timeout?: number;
+	};
+
+	/**
+	 * Base `http.Agent` implementation.
+	 * No pooling/keep-alive is implemented by default.
+	 *
+	 * @param {Function} callback
+	 * @api public
+	 */
+	export class Agent extends EventEmitter {
+		public timeout: number | null;
+		public maxFreeSockets: number;
+		public maxTotalSockets: number;
+		public maxSockets: number;
+		public sockets: {
+			[key: string]: net.Socket[];
+		};
+		public freeSockets: {
+			[key: string]: net.Socket[];
+		};
+		public requests: {
+			[key: string]: http.IncomingMessage[];
+		};
+		public options: https.AgentOptions;
+		private promisifiedCallback?: createAgent.AgentCallbackPromise;
+		private explicitDefaultPort?: number;
+		private explicitProtocol?: string;
+
+		constructor(
+			callback?: createAgent.AgentCallback | createAgent.AgentOptions,
+			_opts?: createAgent.AgentOptions
+		) {
+			super();
+
+			let opts = _opts;
+			if (typeof callback === 'function') {
+				this.callback = callback;
+			} else if (callback) {
+				opts = callback;
+			}
+
+			// Timeout for the socket to be returned from the callback
+			this.timeout = null;
+			if (opts && typeof opts.timeout === 'number') {
+				this.timeout = opts.timeout;
+			}
+
+			// These aren't actually used by `agent-base`, but are required
+			// for the TypeScript definition files in `@types/node` :/
+			this.maxFreeSockets = 1;
+			this.maxSockets = 1;
+			this.maxTotalSockets = Infinity;
+			this.sockets = {};
+			this.freeSockets = {};
+			this.requests = {};
+			this.options = {};
+		}
+
+		get defaultPort(): number {
+			if (typeof this.explicitDefaultPort === 'number') {
+				return this.explicitDefaultPort;
+			}
+			return isSecureEndpoint() ? 443 : 80;
+		}
+
+		set defaultPort(v: number) {
+			this.explicitDefaultPort = v;
+		}
+
+		get protocol(): string {
+			if (typeof this.explicitProtocol === 'string') {
+				return this.explicitProtocol;
+			}
+			return isSecureEndpoint() ? 'https:' : 'http:';
+		}
+
+		set protocol(v: string) {
+			this.explicitProtocol = v;
+		}
+
+		callback(
+			req: createAgent.ClientRequest,
+			opts: createAgent.RequestOptions,
+			fn: createAgent.AgentCallbackCallback
+		): void;
+		callback(
+			req: createAgent.ClientRequest,
+			opts: createAgent.RequestOptions
+		):
+			| createAgent.AgentCallbackReturn
+			| Promise<createAgent.AgentCallbackReturn>;
+		callback(
+			req: createAgent.ClientRequest,
+			opts: createAgent.AgentOptions,
+			fn?: createAgent.AgentCallbackCallback
+		):
+			| createAgent.AgentCallbackReturn
+			| Promise<createAgent.AgentCallbackReturn>
+			| void {
+			throw new Error(
+				'"agent-base" has no default implementation, you must subclass and override `callback()`'
+			);
+		}
+
+		/**
+		 * Called by node-core's "_http_client.js" module when creating
+		 * a new HTTP request with this Agent instance.
+		 *
+		 * @api public
+		 */
+		addRequest(req: ClientRequest, _opts: RequestOptions): void {
+			const opts: RequestOptions = { ..._opts };
+
+			if (typeof opts.secureEndpoint !== 'boolean') {
+				opts.secureEndpoint = isSecureEndpoint();
+			}
+
+			if (opts.host == null) {
+				opts.host = 'localhost';
+			}
+
+			if (opts.port == null) {
+				opts.port = opts.secureEndpoint ? 443 : 80;
+			}
+
+			if (opts.protocol == null) {
+				opts.protocol = opts.secureEndpoint ? 'https:' : 'http:';
+			}
+
+			if (opts.host && opts.path) {
+				// If both a `host` and `path` are specified then it's most
+				// likely the result of a `url.parse()` call... we need to
+				// remove the `path` portion so that `net.connect()` doesn't
+				// attempt to open that as a unix socket file.
+				delete opts.path;
+			}
+
+			delete opts.agent;
+			delete opts.hostname;
+			delete opts._defaultAgent;
+			delete opts.defaultPort;
+			delete opts.createConnection;
+
+			// Hint to use "Connection: close"
+			// XXX: non-documented `http` module API :(
+			req._last = true;
+			req.shouldKeepAlive = false;
+
+			let timedOut = false;
+			let timeoutId: ReturnType<typeof setTimeout> | null = null;
+			const timeoutMs = opts.timeout || this.timeout;
+
+			const onerror = (err: NodeJS.ErrnoException) => {
+				if (req._hadError) return;
+				req.emit('error', err);
+				// For Safety. Some additional errors might fire later on
+				// and we need to make sure we don't double-fire the error event.
+				req._hadError = true;
+			};
+
+			const ontimeout = () => {
+				timeoutId = null;
+				timedOut = true;
+				const err: NodeJS.ErrnoException = new Error(
+					`A "socket" was not created for HTTP request before ${timeoutMs}ms`
+				);
+				err.code = 'ETIMEOUT';
+				onerror(err);
+			};
+
+			const callbackError = (err: NodeJS.ErrnoException) => {
+				if (timedOut) return;
+				if (timeoutId !== null) {
+					clearTimeout(timeoutId);
+					timeoutId = null;
+				}
+				onerror(err);
+			};
+
+			const onsocket = (socket: AgentCallbackReturn) => {
+				if (timedOut) return;
+				if (timeoutId != null) {
+					clearTimeout(timeoutId);
+					timeoutId = null;
+				}
+
+				if (isAgent(socket)) {
+					// `socket` is actually an `http.Agent` instance, so
+					// relinquish responsibility for this `req` to the Agent
+					// from here on
+					debug(
+						'Callback returned another Agent instance %o',
+						socket.constructor.name
+					);
+					(socket as createAgent.Agent).addRequest(req, opts);
+					return;
+				}
+
+				if (socket) {
+					socket.once('free', () => {
+						this.freeSocket(socket as net.Socket, opts);
+					});
+					req.onSocket(socket as net.Socket);
+					return;
+				}
+
+				const err = new Error(
+					`no Duplex stream was returned to agent-base for \`${req.method} ${req.path}\``
+				);
+				onerror(err);
+			};
+
+			if (typeof this.callback !== 'function') {
+				onerror(new Error('`callback` is not defined'));
+				return;
+			}
+
+			if (!this.promisifiedCallback) {
+				if (this.callback.length >= 3) {
+					debug('Converting legacy callback function to promise');
+					this.promisifiedCallback = promisify(this.callback);
+				} else {
+					this.promisifiedCallback = this.callback;
+				}
+			}
+
+			if (typeof timeoutMs === 'number' && timeoutMs > 0) {
+				timeoutId = setTimeout(ontimeout, timeoutMs);
+			}
+
+			if ('port' in opts && typeof opts.port !== 'number') {
+				opts.port = Number(opts.port);
+			}
+
+			try {
+				debug(
+					'Resolving socket for %o request: %o',
+					opts.protocol,
+					`${req.method} ${req.path}`
+				);
+				Promise.resolve(this.promisifiedCallback(req, opts)).then(
+					onsocket,
+					callbackError
+				);
+			} catch (err) {
+				Promise.reject(err).catch(callbackError);
+			}
+		}
+
+		freeSocket(socket: net.Socket, opts: AgentOptions) {
+			debug('Freeing socket %o %o', socket.constructor.name, opts);
+			socket.destroy();
+		}
+
+		destroy() {
+			debug('Destroying agent %o', this.constructor.name);
+		}
+	}
+
+	// So that `instanceof` works correctly
+	createAgent.prototype = createAgent.Agent.prototype;
+}
+
+export = createAgent;

package/node_modules/agent-base/src/promisify.ts

@@ -0,0 +1,33 @@
+import {
+	Agent,
+	ClientRequest,
+	RequestOptions,
+	AgentCallbackCallback,
+	AgentCallbackPromise,
+	AgentCallbackReturn
+} from './index';
+
+type LegacyCallback = (
+	req: ClientRequest,
+	opts: RequestOptions,
+	fn: AgentCallbackCallback
+) => void;
+
+export default function promisify(fn: LegacyCallback): AgentCallbackPromise {
+	return function(this: Agent, req: ClientRequest, opts: RequestOptions) {
+		return new Promise((resolve, reject) => {
+			fn.call(
+				this,
+				req,
+				opts,
+				(err: Error | null | undefined, rtn?: AgentCallbackReturn) => {
+					if (err) {
+						reject(err);
+					} else {
+						resolve(rtn);
+					}
+				}
+			);
+		});
+	};
+}

package/node_modules/axios/CHANGELOG.md

@@ -1,5 +1,201 @@
 # Changelog
 
+## v1.18.0 — June 13, 2026
+
+This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.
+
+## 🔒 Security Fixes
+
+* **Redirect Header Safety:** Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (__#10892__)
+
+* **URL And Request Hardening:** Rejects malformed `http:` and `https:` URLs that omit `//` with `ERR_INVALID_URL`, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local `NO_PROXY` matching. (__#11000__)
+
+## 🐛 Bug Fixes
+
+* **Status Validation:** Added `transitional.validateStatusUndefinedResolves` so applications can opt in to treating `validateStatus: undefined` like the option was omitted, while `validateStatus: null` remains the explicit way to accept every status. (__#10899__)
+
+## 🔧 Maintenance & Chores
+
+* **Documentation:** Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the `proxy` request config as Node.js-only in the advanced docs. (__#10984__, __#10988__, __#10992__, __#10995__)
+
+* **Dependencies:** Bumped `@babel/core`, `@babel/preset-env`, `@commitlint/cli`, `@commitlint/config-conventional`, `@rollup/plugin-babel`, `@rollup/plugin-commonjs`, `@vitest/browser`, `@vitest/browser-playwright`, `eslint`, `lint-staged`, `rollup`, `vitest`, and `actions/checkout`. (__#10989__, __#10996__, __#10997__)
+
+* **Release Metadata:** Prepared the 1.18.0 release by updating package metadata and the runtime `VERSION` value. (__#11003__)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve axios:
+
+* __@drori12__ (__#10984__)
+* __@eyupcanakman__ (__#10899__)
+* __@Adi-Beker__ (__#10995__)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.17.0...v1.18.0)
+
+## v1.17.0 — June 1, 2026
+
+This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
+
+## 🔒 Security Fixes
+
+* **Config Hardening:** Guarded `socketPath`, `params`, and `paramsSerializer` reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (__#10901__, __#10922__)
+* **Release Publishing:** Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (__#10926__)
+
+## 🚀 New Features
+
+* **HTTP Compression:** Added Node HTTP adapter support for zstd response decompression, with `transitional.advertiseZstdAcceptEncoding` controlling whether `zstd` is advertised in `Accept-Encoding`. (__#6792__, __#10920__)
+
+## 🐛 Bug Fixes
+
+* **Authentication Handling:** Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (__#10929__, __#10896__)
+* **Proxy TLS:** Preserved user `httpsAgent` TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (__#10957__)
+* **React Native FormData:** Cleared default `Content-Type` for React Native `FormData` so multipart boundaries can be generated correctly. (__#10898__)
+* **Headers:** Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (__#10875__)
+* **Request Data Merging:** Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (__#10812__)
+* **Bundler Compatibility:** Converted `resolveConfig` from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (__#10891__)
+* **Types:** Corrected `AxiosHeaders.toJSON()` return types and updated CommonJS `isCancel` typings to narrow to `CanceledError<T>`. (__#10956__, __#10952__)
+* **Build Tooling:** Avoided emitting a null `Authorization` header from the GitHub build helper when `GITHUB_TOKEN` is unset. (__#10931__)
+
+## 🔧 Maintenance & Chores
+
+* **HTTP/2 Internals:** Extracted `Http2Sessions` into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (__#10861__)
+* **Package Publishing:** Reduced published package size by switching to a `files` allowlist and dropping unneeded unminified bundle source maps. (__#10939__)
+* **CI and Release Automation:** Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (__#10907__, __#10911__, __#10916__, __#10927__, __#10935__, __#10983__)
+* **Developer Workflow:** Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (__#10925__, __#10914__, __#10958__)
+* **Documentation and Policy:** Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (__#10890__, __#10889__, __#10921__, __#10945__, __#10905__, __#10933__, __#10915__, __#10887__, __#10955__)
+* **Dependencies:** Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, `fs-extra`, `qs`, docs dependencies, and GitHub Actions dependencies including `actions/dependency-review-action` and `zizmorcore/zizmor-action`. (__#10871__, __#10879__, __#10918__, __#10919__, __#10934__, __#10947__, __#10954__, __#10960__)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve axios:
+
+* __@BasixKOR__ (__#6792__)
+* __@carladams1299-lab__ (__#10861__)
+* __@LaplaceYoung__ (__#10812__)
+* __@JamieMagee__ (__#10939__)
+* __@RonGamzu__ (__#10905__)
+* __@sapirbaruch__ (__#10891__)
+* __@nezukoagent__ (__#10901__)
+* __@devareddy05__ (__#10929__)
+* __@Mohammad-Faiz-Cloud-Engineer__ (__#10922__)
+* __@azandabot__ (__#10931__)
+* __@niksy__ (__#10896__)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.16.1...v1.17.0)
+
+## v1.16.1 — May 13, 2026
+
+This release ships a defence-in-depth fix for prototype pollution in `formDataToJSON`, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.
+
+## 🔒 Security Fixes
+
+* **Prototype Pollution Defence-in-Depth:** Hardened `formDataToJSON` against already-polluted `Object.prototype` by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (__#7413__)
+* **Proxy Cleartext Leak:** Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (__#10858__)
+* **CI Cache Removal:** Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (__#10882__)
+
+## 🐛 Bug Fixes
+
+* **Data URI Parsing:** Updated the `fromDataURI` regex to match RFC 2397 more strictly, fixing edge cases in `data:` URL handling. (__#10829__)
+* **Unicode Headers:** Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (__#10850__)
+* **XHR Upload Progress:** Guarded against malformed `ProgressEvent` payloads emitted by some environments during XHR upload, preventing crashes when `loaded` / `total` are missing or invalid. (__#10868__)
+* **Webpack 4 Fetch Adapter:** Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (__#10864__)
+* **Type Definitions:** Made `parseReviver` `context.source` optional in the type definitions to align with the ES2023 specification. (__#10837__)
+* **URL Object Support Reverted:** Reverted the change that allowed passing a `URL` object as `config.url` (originally __#10866__) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (__#10874__)
+
+## 🔧 Maintenance & Chores
+
+* **Cycle Detection Refactor:** Replaced the array-based cycle tracker in `toJSONObject` with a `WeakSet`, improving performance and memory behaviour on large nested structures. (__#10832__)
+* **composeSignals Cleanup:** Refactored `composeSignals` to use a clearer early-return structure, simplifying the cancellation/abort composition path. (__#10844__)
+* **AI Readiness & Repo Docs:** Added `AGENTS.md` and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (__#10835__, __#10841__)
+* **Docs Improvements:** Clarified the GET request example, fixed the interceptor `eject` example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (__#10836__, __#10853__, __#10856__)
+* **Sponsorship Tooling:** Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (__#10843__, __#10859__, __#10869__)
+* **Dependencies:** Bumped `@commitlint/cli` from 20.5.0 to 20.5.2. (__#10846__)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve axios:
+
+* __@hpinmetaverse__ (__#10836__)
+* __@tommyhgunz14__ (__#7413__)
+* __@abhu85__ (__#10829__)
+* __@divyanshuraj1095__ (__#10853__)
+* __@sagodi97__ (__#10856__)
+* __@rkdfx__ (__#10868__)
+* __@Liuwei1125__ (__#10866__)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.16.0...v1.16.1)
+
+## v1.16.0 — May 2, 2026
+
+This release adds support for the QUERY HTTP method and a new `ECONNREFUSED` error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.
+
+## ⚠️ Notable Changes
+
+A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:
+
+- **Fetch adapter now enforces `maxBodyLength` and `maxContentLength`.** These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (**#10795**)
+- **Proxy requests now preserve user-supplied `Host` headers.** Previously, the proxy path could overwrite a custom `Host`. Virtual-host-style routing through a proxy will now behave correctly. (**#10822**)
+- **Basic auth credentials embedded in URLs are now URL-decoded.** If you have percent-encoded credentials in a URL (e.g. `https://user:p%40ss@host`), the decoded value is what now goes on the wire. (**#10825**)
+- **`parseProtocol` now strictly requires a colon in the protocol separator.** Strings that loosely parsed as protocols before may no longer match. (**#10729**)
+- **Deprecated `unescape()` replaced with modern UTF-8 encoding.** Non-ASCII URL handling is now spec-correct; consumers depending on legacy `unescape()` quirks may see different output bytes. (**#7378**)
+- **`transformRequest` input typing change was reverted.** The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (**#10745**, **#10810**)
+
+## 🚀 New Features
+
+- **QUERY HTTP Method:** Added support for the QUERY HTTP method across adapters and type definitions. (**#10802**)
+- **ECONNREFUSED Error Constant:** Exposed `ECONNREFUSED` as a constant on `AxiosError` so callers can match connection-refused failures without comparing string literals (closes #6485). (**#10680**)
+- **Encode Helper Export:** Exported the internal `encode` helper from `buildURL` so userland param serializers can reuse the same encoding logic that axios uses internally. (**#6897**)
+
+## 🐛 Bug Fixes
+
+- **HTTP Adapter — Redirects & Headers:** Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing `requestDetails` argument on `beforeRedirect`, preserved user-supplied `Host` headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (**#10794**, **#10800**, **#6241**, **#10822**, **#10825**)
+- **HTTP Adapter — Streams & Timeouts:** Preserved the partial response object on `AxiosError` when a stream is aborted after headers arrive, honoured the `timeout` option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and `maxRedirects: 0`. (**#10708**, **#10819**, **#7149**)
+- **Fetch Adapter:** Enforced `maxBodyLength` / `maxContentLength` in the fetch adapter, set the `User-Agent` header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a `TypeError` in restricted environments. (**#10795**, **#10772**, **#10806**, **#7260**)
+- **XHR Adapter:** Unsubscribed the `cancelToken` and `AbortSignal` listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (**#10787**)
+- **Error Handling:** Attached the parsed response to `AxiosError` when `JSON.parse` fails inside `dispatchRequest`, prevented `settle` from emitting `undefined` error codes, and tightened the `parseProtocol` regex to require a colon in the protocol separator. (**#10724**, **#7276**, **#10729**)
+- **Types & Exports:** Aligned the CommonJS `CancelToken` typings with the ESM build, fixed a compiler error caused by `RawAxiosHeaders`, and re-exported `create` from the package index. (**#7414**, **#6389**, **#6460**)
+- **UTF-8 Encoding:** Replaced the deprecated `unescape()` call with a modern UTF-8 encoding implementation. (**#7378**)
+- **Misc Cleanup:** Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (**#10833**)
+
+## 🔧 Maintenance & Chores
+
+- **Refactor — ES6 Modernisation:** Modernised the `utils` module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (**#10588**, **#7419**)
+- **Tests:** Hardened the HTTP test server lifecycle to fix flaky `FormData` EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (**#10820**, **#10791**, **#10796**)
+- **Docs:** Documented `paramsSerializer.encode` for strict RFC 3986 query encoding, updated the `parseReviver` TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (**#10821**, **#10782**, **#10759**, **#10804**)
+- **Reverted:** Reverted the `transformRequest` input typing change from #10745 after follow-up review. (**#10745**, **#10810**)
+- **Dependencies:** Bumped `actions/setup-node`, the `github-actions` group, and `postcss` (in `/docs`) to their latest versions. (**#10785**, **#10813**, **#10814**)
+- **Release:** Updated changelog and packages, and prepared the 1.16.0 release. (**#10790**, **#10834**)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve axios:
+
+- **@singhankit001** (**#10588**)
+- **@cuiweixie** (**#7419**)
+- **@iruizsalinas** (**#10787**)
+- **@MarcosNocetti** (**#10680**)
+- **@deepview-autofix** (**#10729**)
+- **@atharvasingh7007** (**#10745**)
+- **@OfekDanny** (**#10772**)
+- **@mnahkies** (**#7414**)
+- **@tboyila** (**#10759**)
+- **@Kingo64** (**#6897**)
+- **@ramram1048** (**#6389**)
+- **@FLNacif** (**#6460**)
+- **@zozo123** (**#10806**)
+- **@pierluigilenoci** (**#10802**)
+- **@afurm** (**#10708**)
+- **@karan-lrn** (**#7378**)
+- **@ebeigarts** (**#7149**)
+- **@Raymondo97** (**#10782**)
+- **@mixelburg** (**#10821**)
+- **@ashishkr96** (**#10822**)
+- **@cyphercodes** (**#10819**)
+- **@Jye10032** (**#7260**)
+- **@VeerShah41** (**#7276**)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)
+
 ## v1.15.2 - April 21, 2026
 
 This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in `allowedSocketPaths` allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.
@@ -1319,7 +1515,7 @@ This functionality is considered as a fix.
 
 - fix: improve AxiosHeaders class [#5224](https://github.com/axios/axios/pull/5224)
 - fix: TypeScript type definitions for commonjs [#5196](https://github.com/axios/axios/pull/5196)
-- fix: type definition of use method on AxiosInterceptorManager to match the the README [#5071](https://github.com/axios/axios/pull/5071)
+- fix: type definition of use method on AxiosInterceptorManager to match the README [#5071](https://github.com/axios/axios/pull/5071)
 - fix: \_\_dirname is not defined in the sandbox [#5269](https://github.com/axios/axios/pull/5269)
 - fix: AxiosError.toJSON method to avoid circular references [#5247](https://github.com/axios/axios/pull/5247)
 - fix: Z_BUF_ERROR when content-encoding is set but the response body is empty [#5250](https://github.com/axios/axios/pull/5250)