@zowe/db2-for-zowe-cli 6.1.17 → 6.1.18

package/README.md

@@ -25,19 +25,21 @@ Before you install and use the plug-in:
 
 -   [Install Zowe CLI](https://docs.zowe.org/stable/user-guide/cli-installcli.html) on your computer.
 
+-   Use Node.js 22 or newer. CI covers Node.js 22, 24, and 26.
+
 -   Have a license file for IBM Db2 Database for z/OS.
 
     For connectivity to Db2 for z/OS, the Db2 region should be `db2connectactivated` or a `db2connect` license file should be provided. Copy the `db2connect` license file to the `[db2 plugin folder]/node_modules/ibm_db/installer/clidriver/license/` folder. For more information, see [Addressing the license requirement](https://docs.zowe.org/stable/user-guide/cli-db2plugin.html#addressing-the-license-requirement) on the Zowe Docs site. 
 
-- **(Linux and MacOS only)** Download and install [node-gyp](https://www.npmjs.com/package/node-gyp) globally by running `npm install -g node-gyp`
+- **(Linux and MacOS source builds only)** Download and install [node-gyp](https://www.npmjs.com/package/node-gyp) globally by running `npm install -g node-gyp`
 
-- **(MacOS only)** Download and Install [Xcode](https://developer.apple.com/xcode/resources/) and [Python 3](https://www.python.org/downloads/mac-osx/).
+- **(MacOS source builds only)** Download and Install [Xcode](https://developer.apple.com/xcode/resources/) and [Python 3](https://www.python.org/downloads/mac-osx/).
 
-- **(Linux only - Debian, Ubuntu)** Download and Install the following via apt: `python3 make g++`
+- **(Linux source builds only - Debian, Ubuntu)** Download and Install the following via apt: `python3 make g++`
 
-- **(Linux only - CentOS, RHEL)** Download and Install the following via yum: `python3 make gcc-c++`
+- **(Linux source builds only - CentOS, RHEL)** Download and Install the following via yum: `python3 make gcc-c++`
 
-- Note: Reinstallation is required when Node is upgraded to a new major version. When installed, the plug-in builds a native binary that is needed to interact with Db2. If a new major version of Node is installed, you must uninstall and reinstall the IBM Db2 Database Plug-in to update the binary. 
+- The plug-in bundles `ibm_db` 4, which uses [Node-API](https://github.com/ibmdb/node-ibm_db/tree/v4.0.1#prerequisite) instead of NAN. Its native binding does not need to be rebuilt solely because you upgrade to a newer compatible Node.js version on the same operating system and architecture. The native binding and IBM Db2 ODBC CLI driver must still be installed; see [The `ibm_db` module is not installed](#the-ibm_db-module-is-not-installed) if installation is incomplete. Precompiled bindings are available for supported Windows, Linux, and MacOS platforms when source compilation is unavailable.
 
 ## Installing
 
@@ -171,9 +173,9 @@ IBM® Db2® Plug-in for Zowe CLI was installed, but its required 'ibm_db' module
 Db2 commands will fail until the installation of 'ibm_db' is completed.
 ```
 
-The plug-in itself is installed and registered with Zowe CLI when this failure occurs. Only the `ibm_db` module is incomplete, so you do not need to reinstall the plug-in.
+The IBM Db2 Plug-in for Zowe CLI is installed and registered with Zowe CLI when this failure occurs. Only the `ibm_db` module is incomplete, so you do not need to reinstall the plug-in.
 
-**Cause**: The plug-in delivers `ibm_db` as a bundled dependency, so that the plug-in can be installed without access to a public npm registry. However, `ibm_db` is a native module. Its own npm install script must download the IBM Db2 ODBC CLI driver and build the binding for your platform. npm does not run the lifecycle scripts of a bundled dependency, so that install script does not run when the plug-in is installed. The `--allow-scripts` option of `zowe plugins install` does not change that behavior, because npm skips the scripts of bundled dependencies even when scripts are allowed.
+**Cause**: The plug-in delivers `ibm_db` as a bundled dependency, so that the plug-in can be installed without access to a public npm registry. However, `ibm_db` is a native module. Its own npm install script must download the IBM Db2 ODBC CLI driver and install the binding for your platform, either by compiling it or using a precompiled binary. npm does not run the lifecycle scripts of a bundled dependency, so that install script does not run when the plug-in is installed. The `--allow-scripts` option of the `zowe plugins install` command does not change that behavior, because npm skips the scripts of bundled dependencies even when scripts are allowed.
 
 **Action**: Run the `ibm_db` install script yourself. The error message contains the full path to the `ibm_db` directory on your system, which is normally the following path:
 
@@ -181,7 +183,7 @@ The plug-in itself is installed and registered with Zowe CLI when this failure o
 <zowe home>/plugins/installed/node_modules/@zowe/db2-for-zowe-cli/node_modules/ibm_db
 ```
 
-Change to that directory and run its install script:
+Change to that directory and run the `ibm_db` install script:
 
 ```bash
 cd "<zowe home>/plugins/installed/node_modules/@zowe/db2-for-zowe-cli/node_modules/ibm_db"
@@ -192,14 +194,14 @@ If npm is not available, run the same script directly with `node installer/drive
 
 The script downloads the CLI driver from `https://public.dhe.ibm.com`, so the system needs network access to that site. If the system already has a Db2 client, a Db2 server, or a copy of the CLI driver, set the `IBM_DB_HOME` environment variable to that directory before you run the script to skip the download. For more `ibm_db` installation options, see the `README.md` file in the `ibm_db` directory.
 
-### Node.js version incompatible with plug-in
+### Native binary from an older plug-in installation
 
 **Error message**:
 ```
 The module 'C:\Users\User\.zowe\plugins\installed\node_modules\@zowe\db2-for-zowe-cli\node_modules\ibm_db\build\Release\odbc_bindings.node' was compiled against a different Node.js version using NODE_MODULE_VERSION ###. This version of Node.js requires NODE_MODULE_VERSION ###. Please try re-compiling or re-installing this module (for instance, using npm rebuild or npm install).
 ```
 
-**Action**: Uninstall and reinstall the IBM Db2 Database Plug-in for Zowe CLI. The Node version installed on the system has changed since the IBM Db2 Database Plug-in for Zowe CLI was installed on the system, and the native binary is no longer compatible.
+**Action**: Upgrade or reinstall the IBM Db2 Database Plug-in for Zowe CLI to replace the old native binary with the bundled `ibm_db` 4 binding. This error can occur with an older `ibm_db` 3 binding compiled for a different Node.js major version. `ibm_db` 4 uses Node-API, so changing between compatible Node.js versions on the same operating system and architecture does not require rebuilding the binding. If the updated module cannot be loaded, follow [The `ibm_db` module is not installed](#the-ibm_db-module-is-not-installed).
 
 ## Contributing
 

package/lib/Db2PluginLifeCycle.d.ts

@@ -20,14 +20,6 @@ declare class Db2PluginLifeCycle extends AbstractPluginLifeCycle {
      * @memberof Db2PluginLifeCycle
      */
     static readonly NATIVE_MODULE_NM: string;
-    /**
-     * A horizontal rule used to make the reported steps stand out among the
-     * other messages that are displayed while a plug-in is installed.
-     * @type {string}
-     * @static
-     * @memberof Db2PluginLifeCycle
-     */
-    private static readonly DIVIDER;
     /**
      * Confirm that the bundled native module can be loaded after the plug-in
      * has been installed. When it cannot be loaded, report the steps that the
@@ -51,7 +43,7 @@ declare class Db2PluginLifeCycle extends AbstractPluginLifeCycle {
      *
      * @private
      * @static
-     * @throws When the native module has not been completely installed.
+     * @throws If the native module is missing or installation is incomplete.
      * @memberof Db2PluginLifeCycle
      */
     private static loadNativeModule;
@@ -76,5 +68,15 @@ declare class Db2PluginLifeCycle extends AbstractPluginLifeCycle {
      * @memberof Db2PluginLifeCycle
      */
     private static findNativeModuleDir;
+    /**
+     * A horizontal rule used to make the reported steps stand out among the
+     * other messages that are displayed while a plug-in is installed.
+     *
+     * @private
+     * @static
+     * @returns {string}
+     * @memberof Db2PluginLifeCycle
+     */
+    private static get dividerLine();
 }
 export = Db2PluginLifeCycle;

package/lib/Db2PluginLifeCycle.js

@@ -37,7 +37,6 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
      * @memberof Db2PluginLifeCycle
      */
     postInstall() {
-        var _a;
         const impLogger = imperative_1.Logger.getImperativeLogger();
         try {
             Db2PluginLifeCycle.loadNativeModule();
@@ -45,7 +44,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
                 `after the installation of ${Constants_1.Constants.DISPLAY_NAME}.`);
         }
         catch (err) {
-            const warningMsg = Db2PluginLifeCycle.formIncompleteInstallMsg((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err);
+            const warningMsg = Db2PluginLifeCycle.formIncompleteInstallMsg(err instanceof Error ? err.message : String(err));
             impLogger.warn(warningMsg);
             throw new imperative_1.ImperativeError({ msg: warningMsg });
         }
@@ -64,7 +63,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
      *
      * @private
      * @static
-     * @throws When the native module has not been completely installed.
+     * @throws If the native module is missing or installation is incomplete.
      * @memberof Db2PluginLifeCycle
      */
     static loadNativeModule() {
@@ -83,7 +82,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
     static formIncompleteInstallMsg(reason) {
         const nativeMod = Db2PluginLifeCycle.NATIVE_MODULE_NM;
         const nativeModDir = Db2PluginLifeCycle.findNativeModuleDir();
-        return `\n${Db2PluginLifeCycle.DIVIDER}\n` +
+        return `\n${Db2PluginLifeCycle.dividerLine}\n` +
             `${Constants_1.Constants.DISPLAY_NAME} was installed, but its required '${nativeMod}' module could not be loaded.\n` +
             `Db2 commands will fail until the installation of '${nativeMod}' is completed.\n` +
             `\n` +
@@ -110,7 +109,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
             `skip the download.\n` +
             `\n` +
             `See ${path.join(nativeModDir, "README.md")} for more '${nativeMod}' installation options.\n` +
-            `${Db2PluginLifeCycle.DIVIDER}\n`;
+            `${Db2PluginLifeCycle.dividerLine}\n`;
     }
     /**
      * Find the directory into which the native module was installed, so that
@@ -134,6 +133,20 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
             return path.resolve(__dirname, "..", "node_modules", nativeMod);
         }
     }
+    /**
+     * A horizontal rule used to make the reported steps stand out among the
+     * other messages that are displayed while a plug-in is installed.
+     *
+     * @private
+     * @static
+     * @returns {string}
+     * @memberof Db2PluginLifeCycle
+     */
+    static get dividerLine() {
+        var _a;
+        const defaultWidth = 100;
+        return "_".repeat(Math.min(((_a = process.stdout) === null || _a === void 0 ? void 0 : _a.columns) || Infinity, defaultWidth));
+    }
 }
 /**
  * The name of the native module that Db2 commands require.
@@ -142,13 +155,5 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
  * @memberof Db2PluginLifeCycle
  */
 Db2PluginLifeCycle.NATIVE_MODULE_NM = "ibm_db";
-/**
- * A horizontal rule used to make the reported steps stand out among the
- * other messages that are displayed while a plug-in is installed.
- * @type {string}
- * @static
- * @memberof Db2PluginLifeCycle
- */
-Db2PluginLifeCycle.DIVIDER = "____________________________________________________________________________________________________";
 module.exports = Db2PluginLifeCycle;
 //# sourceMappingURL=Db2PluginLifeCycle.js.map

package/lib/Db2PluginLifeCycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"Db2PluginLifeCycle.js","sourceRoot":"","sources":["../src/Db2PluginLifeCycle.ts"],"names":[],"mappings":";AAAA;;;;;;;;;EASE;AAEF,6BAA6B;AAC7B,iDAAoF;AACpF,2CAAwC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAmB,SAAQ,oCAAuB;IAmBpD;;;;;;;;;OASG;IACI,WAAW;;QACd,MAAM,SAAS,GAAG,mBAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACD,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;YACtC,SAAS,CAAC,KAAK,CAAC,QAAQ,kBAAkB,CAAC,gBAAgB,mCAAmC;gBAC1F,6BAA6B,qBAAS,CAAC,YAAY,GAAG,CACzD,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,GAAG,CAAC,CAAC;YACpF,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,IAAI,4BAAe,CAAC,EAAC,GAAG,EAAE,UAAU,EAAC,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,YAAY;QACf,gBAAgB;IACpB,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,gBAAgB;QAC3B,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,wBAAwB,CAAC,MAAc;QAClD,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,mBAAmB,EAAE,CAAC;QAE9D,OAAO,KAAK,kBAAkB,CAAC,OAAO,IAAI;YACtC,GAAG,qBAAS,CAAC,YAAY,qCAAqC,SAAS,iCAAiC;YACxG,qDAAqD,SAAS,mBAAmB;YACjF,IAAI;YACJ,YAAY,MAAM,IAAI;YACtB,IAAI;YACJ,yBAAyB,SAAS,mEAAmE;YACrG,sDAAsD,SAAS,6CAA6C;YAC5G,sGAAsG;YACtG,qGAAqG;YACrG,oGAAoG;YACpG,gFAAgF;YAChF,IAAI;YACJ,iEAAiE;YACjE,IAAI;YACJ,WAAW,YAAY,KAAK;YAC5B,uBAAuB;YACvB,IAAI;YACJ,oEAAoE,SAAS,6BAA6B;YAC1G,sCAAsC;YACtC,IAAI;YACJ,oGAAoG;YACpG,oGAAoG;YACpG,mGAAmG;YACnG,sBAAsB;YACtB,IAAI;YACJ,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,SAAS,2BAA2B;YAC7F,GAAG,kBAAkB,CAAC,OAAO,IAAI,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB;QAC9B,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC;YACD;;eAEG;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;;AAhID;;;;;GAKG;AACoB,mCAAgB,GAAW,QAAQ,CAAC;AAE3D;;;;;;GAMG;AACqB,0BAAO,GAC3B,sGAAsG,CAAC;AAmH/G,iBAAS,kBAAkB,CAAC"}
+{"version":3,"file":"Db2PluginLifeCycle.js","sourceRoot":"","sources":["../src/Db2PluginLifeCycle.ts"],"names":[],"mappings":";AAAA;;;;;;;;;EASE;AAEF,6BAA6B;AAC7B,iDAAoF;AACpF,2CAAwC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAmB,SAAQ,oCAAuB;IASpD;;;;;;;;;OASG;IACI,WAAW;QACd,MAAM,SAAS,GAAG,mBAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACD,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;YACtC,SAAS,CAAC,KAAK,CAAC,QAAQ,kBAAkB,CAAC,gBAAgB,mCAAmC;gBAC1F,6BAA6B,qBAAS,CAAC,YAAY,GAAG,CACzD,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjH,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,IAAI,4BAAe,CAAC,EAAC,GAAG,EAAE,UAAU,EAAC,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,YAAY;QACf,gBAAgB;IACpB,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,gBAAgB;QAC3B,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,wBAAwB,CAAC,MAAc;QAClD,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,mBAAmB,EAAE,CAAC;QAE9D,OAAO,KAAK,kBAAkB,CAAC,WAAW,IAAI;YAC1C,GAAG,qBAAS,CAAC,YAAY,qCAAqC,SAAS,iCAAiC;YACxG,qDAAqD,SAAS,mBAAmB;YACjF,IAAI;YACJ,YAAY,MAAM,IAAI;YACtB,IAAI;YACJ,yBAAyB,SAAS,mEAAmE;YACrG,sDAAsD,SAAS,6CAA6C;YAC5G,sGAAsG;YACtG,qGAAqG;YACrG,oGAAoG;YACpG,gFAAgF;YAChF,IAAI;YACJ,iEAAiE;YACjE,IAAI;YACJ,WAAW,YAAY,KAAK;YAC5B,uBAAuB;YACvB,IAAI;YACJ,oEAAoE,SAAS,6BAA6B;YAC1G,sCAAsC;YACtC,IAAI;YACJ,oGAAoG;YACpG,oGAAoG;YACpG,mGAAmG;YACnG,sBAAsB;YACtB,IAAI;YACJ,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,SAAS,2BAA2B;YAC7F,GAAG,kBAAkB,CAAC,WAAW,IAAI,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB;QAC9B,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC;YACD;;eAEG;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,KAAK,WAAW;;QAC1B,MAAM,YAAY,GAAG,GAAG,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,OAAO,KAAI,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;;AApID;;;;;GAKG;AACoB,mCAAgB,GAAW,QAAQ,CAAC;AAiI/D,iBAAS,kBAAkB,CAAC"}

package/node_modules/axios/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## v1.19.0 — July 22, 2026
+
+This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
+
+## 🔒 Security Fixes
+
+- Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (https://github.com/advisories/GHSA-hmw2-7cc7-3qxx). (#11028)
+
+## 🚀 New Features
+
+- Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
+  adapters, and serializers. (#11043, #11081)
+- Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
+- HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)
+
+## 🐛 Bug Fixes
+
+- Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
+- Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
+- Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
+- Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
+- URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)
+
+- Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
+- Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
+- Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
+- Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)
+
+## 🔧 Maintenance & Chores
+
+- Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
+- Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
+- Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
+- Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
+- Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
+- Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve Axios:
+
+- @afonsojramos (#11028)
+- @MahinAnowar (#11006)
+- @yassertawfik4 (#11024)
+- @AnandSundar (#11029)
+- @lin-hongkuan (#11035)
+- @Wali007-lab (#11054)
+- @magicdawn (#11043)
+- @andrewkernel (#11053)
+- @Sagargupta16 (#11059)
+- @Rpaudel379 (#11078)
+- @kobihikri (#11076)
+- @spokodev (#11061)
+- @shaedrich (#11081)
+- @QodeXcli (#11062)
+- @akahoshi1421 (#11067)
+- @TheHonoredOne914 (#11071)
+- @Ahsan1Murtaza (#11073)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.18.1...v1.19.0)
+
+
 ## v1.18.0 — June 13, 2026
 
 This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

package/node_modules/axios/README.md

@@ -349,6 +349,67 @@
                 >
             </p>
         </td>
+        <td align="center" width="33.333333333333336%">
+            <a
+                href="https://kasyno.us.com/?utm_source=axios_docs_website&utm_medium=website&utm_campaign=axios_open_collective_sponsorship"
+                style="padding: 10px; display: inline-block"
+                target="_blank"
+            >
+                <img
+                    width="71px"
+                    height="70px"
+                    src="https://images.opencollective.com/polskie-kasyno-online/c25e456/avatar.png"
+                    alt="polskie kasyno online"
+                />
+            </a>
+            <p
+                align="center"
+            >
+                Kasyno.us.com to niezależny portal o tematyce kasyno online Polska, który pomaga graczom znaleźć bezpieczne i sprawdzone kasyna internetowe.
+            </p>
+            <p align="center">
+                <a
+                    href="https://kasyno.us.com/?utm_source=axios_docs_website&utm_medium=website&utm_campaign=axios_open_collective_sponsorship"
+                    target="_blank"
+                    ><b>kasyno.us.com</b></a
+                >
+            </p>
+        </td>
+    </tr>
+    <tr width="33.333333333333336%">
+        <td align="center" width="33.333333333333336%">
+            <a
+                href="https://www.scrapingbee.com/?utm_source=axios_docs_website&utm_medium=website&utm_campaign=axios_open_collective_sponsorship"
+                style="padding: 10px; display: inline-block"
+                target="_blank"
+            >
+                <img
+                    width="90px"
+                    height="90px"
+                    src="https://images.opencollective.com/scrapingbee/6d5dc95/logo.png"
+                    alt="ScrapingBee"
+                />
+            </a>
+            <p
+                align="center"
+            >
+                Scrape websites with a powerful web scraping API without managing proxies, browsers, or anti-bot defenses.
+            </p>
+            <p align="center">
+                <a
+                    href="https://www.scrapingbee.com/?utm_source=axios_docs_website&utm_medium=website&utm_campaign=axios_open_collective_sponsorship"
+                    target="_blank"
+                    ><b>scrapingbee.com</b></a
+                >
+            </p>
+        </td>
+        <td align="center" width="33.333333333333336%">
+            <a
+                href="https://opencollective.com/axios/contribute"
+                target="_blank"
+                >💜 Become a sponsor</a
+            >
+        </td>
         <td align="center" width="33.333333333333336%">
             <a
                 href="https://opencollective.com/axios/contribute"
@@ -648,6 +709,7 @@ axios({
 
 ```js
 // GET request for remote image in node.js
+import fs from 'fs';
 const response = await axios({
   method: 'get',
   url: 'https://bit.ly/2mTM3nY',
@@ -763,6 +825,8 @@ These config options are available for requests. Only `url` is required. Request
   // `baseURL` is not a security boundary. If `url` is attacker-controlled, validate it
   // before passing it to axios. Relative URLs can contain `..` segments that resolve
   // outside an intended path prefix after the final URL is parsed.
+  // HTTP(S) URLs must include `//` after the protocol. Values such as
+  // `https:example.com` and `https:/example.com` are rejected with ERR_INVALID_URL.
   baseURL: 'https://some-domain.com/api/',
 
   // `allowAbsoluteUrls` determines whether or not absolute URLs will override a configured `baseUrl`.
@@ -1371,6 +1435,40 @@ axios.interceptors.request.use(
 );
 ```
 
+If a synchronous request interceptor throws, Axios calls that interceptor's paired rejection handler and stops running the remaining request interceptors. A rejection handler that returns normally, including one that returns `undefined` or a fulfilled Promise, treats the error as handled: Axios dispatches the request with the last valid config, and ignores the handler's return value. To block dispatch, omit the rejection handler or throw/return a rejected Promise from it. The final error then continues through response rejection interceptors.
+
+Use a rejected Promise when validation must prevent the request:
+
+```js
+axios.interceptors.request.use(
+  function validate(config) {
+    if (!config.headers.has('Authorization')) {
+      throw new Error('Authorization is required');
+    }
+    return config;
+  },
+  function rejectInvalidRequest(error) {
+    return Promise.reject(error);
+  },
+  { synchronous: true }
+);
+```
+
+A logging-only rejection handler can return normally to preserve the existing request-continuation behavior:
+
+```js
+axios.interceptors.request.use(
+  function prepare(config) {
+    throw new Error('Optional preparation failed');
+  },
+  function logPreparationFailure(error) {
+    console.warn(error);
+    // Returning normally dispatches with the last valid config.
+  },
+  { synchronous: true }
+);
+```
+
 If you want to execute a particular interceptor based on a runtime check,
 you can add a `runWhen` function to the options object. The request interceptor will not run **if and only if** the return
 of `runWhen` is `false`. Axios calls the function with the config
@@ -1438,7 +1536,7 @@ When a response is fulfilled and multiple response interceptors are registered:
 - If a fulfillment interceptor throws, Axios skips the next fulfillment interceptor and calls the next rejection interceptor.
 - After the error is caught, later fulfillment interceptors run again, just like in a promise chain.
 
-Read [the interceptor tests](./test/specs/interceptors.spec.js) to see all this in code.
+Read [the interceptor tests](./tests/browser/interceptors.browser.test.js) to see all this in code.
 
 ## Error types
 
@@ -1496,6 +1594,10 @@ axios.get('/user/12345').catch(function (error) {
 });
 ```
 
+Axios rejects an `http:` or `https:` request `url` or `baseURL` that omits `//` after the protocol. For example, `https:example.com` and `https:/example.com` reject with `AxiosError` code `ERR_INVALID_URL` instead of being silently normalized. Pass a well-formed URL such as `https://example.com`.
+
+The error identifies the malformed URL, for example `Invalid URL "https:example.com": missing "//" after protocol`. To keep logs useful without leaking secrets, Axios reports the control-character-normalized URL with credentials, query parameter values, and fragment contents redacted; the scheme, host, path, and query parameter names remain visible.
+
 Use `validateStatus` to override the default condition (`status >= 200 && status < 300`) and choose which HTTP status codes should reject.
 
 ```js
@@ -1931,6 +2033,24 @@ formData.append('users[1][surname]', 'Anderson');
 formData.append('obj2{}', '[{"x":1}]');
 ```
 
+### Converting FormData to JSON
+
+`axios.formToJSON()` converts `FormData` field names that use dot or bracket notation into nested objects and arrays. Only `.`, `[`, and `]` are structural separators. Other characters, including `-`, spaces, `+`, `*`, and `&`, remain part of the literal key.
+
+```js
+const form = new FormData();
+form.append('user-name', 'johndoe');
+form.append('user.name', 'john');
+
+console.log(axios.formToJSON(form));
+// {
+//   'user-name': 'johndoe',
+//   user: { name: 'john' }
+// }
+```
+
+`user[name]` also creates `{ user: { name: ... } }`, while `items[]` creates an array.
+
 Axios supports `postForm`, `putForm`, and `patchForm` as shortcuts for the matching HTTP methods with the `Content-Type` header preset to `multipart/form-data`.
 
 ## Posting files
@@ -2004,10 +2124,9 @@ submits this JSON object:
 {
   "foo": "1",
   "deep": {
-    "prop": {
-      "spaced": "3"
-    }
+    "prop": "2"
   },
+  "deep prop spaced": "3",
   "baz": [
     "4",
     "5"
@@ -2018,6 +2137,8 @@ submits this JSON object:
 }
 ```
 
+Only dot and bracket notation create nested paths when a form is converted to JSON. Spaces and other punctuation remain part of literal field names.
+
 Sending `Blobs`/`Files` as JSON (`base64`) is not currently supported.
 
 ## Progress capturing
@@ -2246,8 +2367,9 @@ Returns `this`.
 ### AxiosHeaders#get(header)
 
 ```
-  get(headerName: string, matcher?: true | AxiosHeaderMatcher): AxiosHeaderValue;
+  get(headerName: string, parser: typeof AxiosHeaders.parseParameters): AxiosHeaderParameters;
   get(headerName: string, parser: RegExp): RegExpExecArray | null;
+  get(headerName: string, matcher?: true | AxiosHeaderParser): AxiosHeaderValue;
 ```
 
 Returns the internal value of the header. It can take an extra argument to parse the header's value with `RegExp.exec`,
@@ -2267,6 +2389,15 @@ console.log(headers.get('Content-Type', true)); // parse key-value pairs from a
 //    boundary: 'Asrf456BGe4h'
 // }
 
+const quotedHeaders = new AxiosHeaders({
+  'Content-Type': 'multipart/form-data; boundary="a,b"',
+});
+
+console.log({
+  ...quotedHeaders.get('Content-Type', AxiosHeaders.parseParameters),
+});
+// { boundary: 'a,b' }
+
 console.log(
   headers.get('Content-Type', (value, name, headers) => {
     return String(value).replace(/a/g, 'ZZZ');
@@ -2278,6 +2409,10 @@ console.log(headers.get('Content-Type', /boundary=(\w+)/)?.[0]);
 // boundary=Asrf456BGe4h
 ```
 
+`AxiosHeaders.parseParameters` is the opt-in parser for normalized HTTP parameter values. It returns a null-prototype map, matches parameter names case-insensitively, removes quoted-string delimiters, decodes escaped quotes and backslashes, preserves commas and semicolons inside quoted values, and removes only HTTP optional whitespace around unquoted values. It omits the unsafe keys `__proto__`, `constructor`, and `prototype`.
+
+Passing `true` remains the legacy tokenizer and keeps its existing output for backward compatibility.
+
 Returns the value of the header.
 
 ### AxiosHeaders#has(header, matcher?)
@@ -2562,6 +2697,99 @@ try {
 }
 ```
 
+### Typing request data and query params
+
+`AxiosRequestConfig<D = any, P = any>` uses `D` for the request body and `P` for query parameters. The params serializer receives the same `P`, and both types are preserved on the default response config:
+
+```typescript
+import axios, {
+  type AxiosPromise,
+  type AxiosRequestConfig,
+  type InternalAxiosRequestConfig,
+} from 'axios';
+
+interface RequestBody {
+  includeArchived: boolean;
+}
+
+interface SearchParams {
+  query: string;
+  page?: number;
+}
+
+interface SearchResponse {
+  results: string[];
+}
+
+const config: AxiosRequestConfig<RequestBody, SearchParams> = {
+  data: { includeArchived: false },
+  params: { query: 'axios', page: 1 },
+  paramsSerializer: (params) => `${params.query}:${params.page ?? 1}`,
+};
+
+const response = await axios.get('/search', config);
+response.config.data;   // RequestBody | undefined
+response.config.params; // SearchParams | undefined
+
+const invalidConfig: AxiosRequestConfig<RequestBody, SearchParams> = {
+  // @ts-expect-error `query` must be a string
+  params: { query: 123 },
+};
+
+const adapter = (
+  adapterConfig: InternalAxiosRequestConfig<RequestBody, SearchParams>
+): AxiosPromise<SearchResponse, RequestBody, SearchParams> =>
+  Promise.resolve({
+    data: { results: [] },
+    status: 200,
+    statusText: 'OK',
+    headers: {},
+    config: adapterConfig,
+  });
+```
+
+The request methods place `P` last—`<T, R, D, P>`—so the existing response data (`T`), custom response (`R`), and request data (`D`) positions do not change. Explicit custom response types still determine the resolved value. `RawAxiosRequestConfig`, `InternalAxiosRequestConfig`, defaults, `AxiosResponse`, `AxiosPromise<T, D, P>`, `AxiosError`, `CanceledError`, callable instances, adapters, and `mergeConfig()` also carry `P`. The default is `any` for backward compatibility.
+
+Use all three public error generics when cancellation narrowing must retain the response, request body, and params types:
+
+```typescript
+declare const error: unknown;
+
+if (axios.isCancel<SearchResponse, RequestBody, SearchParams>(error)) {
+  error.config?.data;   // RequestBody | undefined
+  error.config?.params; // SearchParams | undefined
+}
+```
+
+### Symbol-keyed custom request config
+
+Own enumerable symbol properties survive config merging, so module-augmented options can reach request interceptors and adapters:
+
+```typescript
+import axios from 'axios';
+
+export const someFlag: unique symbol = Symbol(
+  'some flag used in request interceptor'
+);
+
+declare module 'axios' {
+  interface AxiosRequestConfig<D = any, P = any> {
+    [someFlag]?: boolean;
+  }
+}
+
+axios.interceptors.request.use((config) => {
+  if (config[someFlag]) {
+    config.headers.set('X-Some-Flag', 'enabled');
+  }
+  return config;
+});
+
+await axios.get('/users', { [someFlag]: true });
+```
+
+Only own enumerable symbol properties are copied; inherited and non-enumerable symbol properties are not.
+
 Because axios publishes an ESM default export and a CJS `module.exports`, TypeScript has a few caveats.
 The recommended setting is `"moduleResolution": "node16"`, which is implied by `"module": "node16"`. This requires TypeScript 4.7 or greater.
 If you use ESM, your settings should be fine.