apify-client 2.23.2-beta.4 → 2.23.2-beta.5

package/dist/bundle.js

@@ -18020,7 +18020,7 @@ function isStream(value) {
 function getVersionData() {
     if (true) {
         return {
-            version: "2.23.2-beta.4"
+            version: "2.23.2-beta.5"
         };
     }
     // eslint-disable-next-line
@@ -21548,6 +21548,7 @@ __webpack_require__.d(__webpack_exports__, {
   HttpStatusCode: () => (HttpStatusCode),
   VERSION: () => (VERSION),
   all: () => (all),
+  create: () => (create),
   "default": () => (/* reexport safe */ _lib_axios_js__rspack_import_0["default"]),
   formToJSON: () => (formToJSON),
   getAdapter: () => (getAdapter),
@@ -21580,6 +21581,7 @@ const {
   formToJSON,
   getAdapter,
   mergeConfig,
+  create,
 } = _lib_axios_js__rspack_import_0["default"];
 
 
@@ -21624,11 +21626,13 @@ const knownAdapters = {
 _utils_js__rspack_import_3["default"].forEach(knownAdapters, (fn, value) => {
   if (fn) {
     try {
-      Object.defineProperty(fn, 'name', { value });
+      // Null-proto descriptors so a polluted Object.prototype.get cannot turn
+      // these data descriptors into accessor descriptors on the way in.
+      Object.defineProperty(fn, 'name', { __proto__: null, value });
     } catch (e) {
       // eslint-disable-next-line no-empty
     }
-    Object.defineProperty(fn, 'adapterName', { value });
+    Object.defineProperty(fn, 'adapterName', { __proto__: null, value });
   }
 });
 
@@ -21741,11 +21745,13 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _utils_js__rspack_import_0 = __webpack_require__(7275);
 /* import */ var _core_AxiosError_js__rspack_import_2 = __webpack_require__(4062);
 /* import */ var _helpers_composeSignals_js__rspack_import_4 = __webpack_require__(2723);
-/* import */ var _helpers_trackStream_js__rspack_import_6 = __webpack_require__(1791);
-/* import */ var _core_AxiosHeaders_js__rspack_import_8 = __webpack_require__(7110);
-/* import */ var _helpers_progressEventReducer_js__rspack_import_5 = __webpack_require__(7837);
+/* import */ var _helpers_trackStream_js__rspack_import_7 = __webpack_require__(1791);
+/* import */ var _core_AxiosHeaders_js__rspack_import_10 = __webpack_require__(7110);
+/* import */ var _helpers_progressEventReducer_js__rspack_import_6 = __webpack_require__(7837);
 /* import */ var _helpers_resolveConfig_js__rspack_import_3 = __webpack_require__(8382);
-/* import */ var _core_settle_js__rspack_import_7 = __webpack_require__(3853);
+/* import */ var _core_settle_js__rspack_import_9 = __webpack_require__(3853);
+/* import */ var _helpers_estimateDataURLDecodedBytes_js__rspack_import_5 = __webpack_require__(1526);
+/* import */ var _env_data_js__rspack_import_8 = __webpack_require__(9888);
 
 
 
@@ -21756,16 +21762,11 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 
-const DEFAULT_CHUNK_SIZE = 64 * 1024;
 
-const { isFunction } = _utils_js__rspack_import_0["default"];
 
-const globalFetchAPI = (({ Request, Response }) => ({
-  Request,
-  Response,
-}))(_utils_js__rspack_import_0["default"].global);
+const DEFAULT_CHUNK_SIZE = 64 * 1024;
 
-const { ReadableStream, TextEncoder } = _utils_js__rspack_import_0["default"].global;
+const { isFunction } = _utils_js__rspack_import_0["default"];
 
 const test = (fn, ...args) => {
   try {
@@ -21776,11 +21777,17 @@ const test = (fn, ...args) => {
 };
 
 const factory = (env) => {
+  const globalObject = _utils_js__rspack_import_0["default"].global ?? globalThis;
+  const { ReadableStream, TextEncoder } = globalObject;
+
   env = _utils_js__rspack_import_0["default"].merge.call(
     {
       skipUndefined: true,
     },
-    globalFetchAPI,
+    {
+      Request: globalObject.Request,
+      Response: globalObject.Response,
+    },
     env
   );
 
@@ -21810,18 +21817,20 @@ const factory = (env) => {
     test(() => {
       let duplexAccessed = false;
 
-      const body = new ReadableStream();
-
-      const hasContentType = new Request(_platform_index_js__rspack_import_1["default"].origin, {
-        body,
+      const request = new Request(_platform_index_js__rspack_import_1["default"].origin, {
+        body: new ReadableStream(),
         method: 'POST',
         get duplex() {
           duplexAccessed = true;
           return 'half';
         },
-      }).headers.has('Content-Type');
+      });
+
+      const hasContentType = request.headers.has('Content-Type');
 
-      body.cancel();
+      if (request.body != null) {
+        request.body.cancel();
+      }
 
       return duplexAccessed && !hasContentType;
     });
@@ -21905,8 +21914,13 @@ const factory = (env) => {
       headers,
       withCredentials = 'same-origin',
       fetchOptions,
+      maxContentLength,
+      maxBodyLength,
     } = (0,_helpers_resolveConfig_js__rspack_import_3["default"])(config);
 
+    const hasMaxContentLength = _utils_js__rspack_import_0["default"].isNumber(maxContentLength) && maxContentLength > -1;
+    const hasMaxBodyLength = _utils_js__rspack_import_0["default"].isNumber(maxBodyLength) && maxBodyLength > -1;
+
     let _fetch = envFetch || fetch;
 
     responseType = responseType ? (responseType + '').toLowerCase() : 'text';
@@ -21928,6 +21942,41 @@ const factory = (env) => {
     let requestContentLength;
 
     try {
+      // Enforce maxContentLength for data: URLs up-front so we never materialize
+      // an oversized payload. The HTTP adapter applies the same check (see http.js
+      // "if (protocol === 'data:')" branch).
+      if (hasMaxContentLength && typeof url === 'string' && url.startsWith('data:')) {
+        const estimated = (0,_helpers_estimateDataURLDecodedBytes_js__rspack_import_5["default"])(url);
+        if (estimated > maxContentLength) {
+          throw new _core_AxiosError_js__rspack_import_2["default"](
+            'maxContentLength size of ' + maxContentLength + ' exceeded',
+            _core_AxiosError_js__rspack_import_2["default"].ERR_BAD_RESPONSE,
+            config,
+            request
+          );
+        }
+      }
+
+      // Enforce maxBodyLength against the outbound request body before dispatch.
+      // Mirrors http.js behavior (ERR_BAD_REQUEST / 'Request body larger than
+      // maxBodyLength limit'). Skip when the body length cannot be determined
+      // (e.g. a live ReadableStream supplied by the caller).
+      if (hasMaxBodyLength && method !== 'get' && method !== 'head') {
+        const outboundLength = await resolveBodyLength(headers, data);
+        if (
+          typeof outboundLength === 'number' &&
+          isFinite(outboundLength) &&
+          outboundLength > maxBodyLength
+        ) {
+          throw new _core_AxiosError_js__rspack_import_2["default"](
+            'Request body larger than maxBodyLength limit',
+            _core_AxiosError_js__rspack_import_2["default"].ERR_BAD_REQUEST,
+            config,
+            request
+          );
+        }
+      }
+
       if (
         onUploadProgress &&
         supportsRequestStream &&
@@ -21948,12 +21997,12 @@ const factory = (env) => {
         }
 
         if (_request.body) {
-          const [onProgress, flush] = (0,_helpers_progressEventReducer_js__rspack_import_5.progressEventDecorator)(
+          const [onProgress, flush] = (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventDecorator)(
             requestContentLength,
-            (0,_helpers_progressEventReducer_js__rspack_import_5.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_5.asyncDecorator)(onUploadProgress))
+            (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_6.asyncDecorator)(onUploadProgress))
           );
 
-          data = (0,_helpers_trackStream_js__rspack_import_6.trackStream)(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush);
+          data = (0,_helpers_trackStream_js__rspack_import_7.trackStream)(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush);
         }
       }
 
@@ -21965,6 +22014,22 @@ const factory = (env) => {
       // see https://github.com/cloudflare/workerd/issues/902
       const isCredentialsSupported = isRequestSupported && 'credentials' in Request.prototype;
 
+      // If data is FormData and Content-Type is multipart/form-data without boundary,
+      // delete it so fetch can set it correctly with the boundary
+      if (_utils_js__rspack_import_0["default"].isFormData(data)) {
+        const contentType = headers.getContentType();
+        if (
+          contentType &&
+          /^multipart\/form-data/i.test(contentType) &&
+          !/boundary=/i.test(contentType)
+        ) {
+          headers.delete('content-type');
+        }
+      }
+
+      // Set User-Agent header if not already set (fetch defaults to 'node' in Node.js)
+      headers.set('User-Agent', 'axios/' + _env_data_js__rspack_import_8.VERSION, false);
+
       const resolvedOptions = {
         ...fetchOptions,
         signal: composedSignal,
@@ -21981,10 +22046,28 @@ const factory = (env) => {
         ? _fetch(request, fetchOptions)
         : _fetch(url, resolvedOptions));
 
+      // Cheap pre-check: if the server honestly declares a content-length that
+      // already exceeds the cap, reject before we start streaming.
+      if (hasMaxContentLength) {
+        const declaredLength = _utils_js__rspack_import_0["default"].toFiniteNumber(response.headers.get('content-length'));
+        if (declaredLength != null && declaredLength > maxContentLength) {
+          throw new _core_AxiosError_js__rspack_import_2["default"](
+            'maxContentLength size of ' + maxContentLength + ' exceeded',
+            _core_AxiosError_js__rspack_import_2["default"].ERR_BAD_RESPONSE,
+            config,
+            request
+          );
+        }
+      }
+
       const isStreamResponse =
         supportsResponseStream && (responseType === 'stream' || responseType === 'response');
 
-      if (supportsResponseStream && (onDownloadProgress || (isStreamResponse && unsubscribe))) {
+      if (
+        supportsResponseStream &&
+        response.body &&
+        (onDownloadProgress || hasMaxContentLength || (isStreamResponse && unsubscribe))
+      ) {
         const options = {};
 
         ['status', 'statusText', 'headers'].forEach((prop) => {
@@ -21995,14 +22078,30 @@ const factory = (env) => {
 
         const [onProgress, flush] =
           (onDownloadProgress &&
-            (0,_helpers_progressEventReducer_js__rspack_import_5.progressEventDecorator)(
+            (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventDecorator)(
               responseContentLength,
-              (0,_helpers_progressEventReducer_js__rspack_import_5.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_5.asyncDecorator)(onDownloadProgress), true)
+              (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_6.asyncDecorator)(onDownloadProgress), true)
             )) ||
           [];
 
+        let bytesRead = 0;
+        const onChunkProgress = (loadedBytes) => {
+          if (hasMaxContentLength) {
+            bytesRead = loadedBytes;
+            if (bytesRead > maxContentLength) {
+              throw new _core_AxiosError_js__rspack_import_2["default"](
+                'maxContentLength size of ' + maxContentLength + ' exceeded',
+                _core_AxiosError_js__rspack_import_2["default"].ERR_BAD_RESPONSE,
+                config,
+                request
+              );
+            }
+          }
+          onProgress && onProgress(loadedBytes);
+        };
+
         response = new Response(
-          (0,_helpers_trackStream_js__rspack_import_6.trackStream)(response.body, DEFAULT_CHUNK_SIZE, onProgress, () => {
+          (0,_helpers_trackStream_js__rspack_import_7.trackStream)(response.body, DEFAULT_CHUNK_SIZE, onChunkProgress, () => {
             flush && flush();
             unsubscribe && unsubscribe();
           }),
@@ -22017,12 +22116,39 @@ const factory = (env) => {
         config
       );
 
+      // Fallback enforcement for environments without ReadableStream support
+      // (legacy runtimes). Detect materialized size from typed output; skip
+      // streams/Response passthrough since the user will read those themselves.
+      if (hasMaxContentLength && !supportsResponseStream && !isStreamResponse) {
+        let materializedSize;
+        if (responseData != null) {
+          if (typeof responseData.byteLength === 'number') {
+            materializedSize = responseData.byteLength;
+          } else if (typeof responseData.size === 'number') {
+            materializedSize = responseData.size;
+          } else if (typeof responseData === 'string') {
+            materializedSize =
+              typeof TextEncoder === 'function'
+                ? new TextEncoder().encode(responseData).byteLength
+                : responseData.length;
+          }
+        }
+        if (typeof materializedSize === 'number' && materializedSize > maxContentLength) {
+          throw new _core_AxiosError_js__rspack_import_2["default"](
+            'maxContentLength size of ' + maxContentLength + ' exceeded',
+            _core_AxiosError_js__rspack_import_2["default"].ERR_BAD_RESPONSE,
+            config,
+            request
+          );
+        }
+      }
+
       !isStreamResponse && unsubscribe && unsubscribe();
 
       return await new Promise((resolve, reject) => {
-        (0,_core_settle_js__rspack_import_7["default"])(resolve, reject, {
+        (0,_core_settle_js__rspack_import_9["default"])(resolve, reject, {
           data: responseData,
-          headers: _core_AxiosHeaders_js__rspack_import_8["default"].from(response.headers),
+          headers: _core_AxiosHeaders_js__rspack_import_10["default"].from(response.headers),
           status: response.status,
           statusText: response.statusText,
           config,
@@ -22032,6 +22158,17 @@ const factory = (env) => {
     } catch (err) {
       unsubscribe && unsubscribe();
 
+      // Safari can surface fetch aborts as a DOMException-like object whose
+      // branded getters throw. Prefer our composed signal reason before reading
+      // the caught error, preserving timeout vs cancellation semantics.
+      if (composedSignal && composedSignal.aborted && composedSignal.reason instanceof _core_AxiosError_js__rspack_import_2["default"]) {
+        const canceledError = composedSignal.reason;
+        canceledError.config = config;
+        request && (canceledError.request = request);
+        err !== canceledError && (canceledError.cause = err);
+        throw canceledError;
+      }
+
       if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) {
         throw Object.assign(
           new _core_AxiosError_js__rspack_import_2["default"](
@@ -22192,7 +22329,7 @@ const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
           // will return status as 0 even though it's a successful request
           if (
             request.status === 0 &&
-            !(request.responseURL && request.responseURL.indexOf('file:') === 0)
+            !(request.responseURL && request.responseURL.startsWith('file:'))
           ) {
             return;
           }
@@ -22209,6 +22346,7 @@ const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
         }
 
         reject(new _core_AxiosError_js__rspack_import_3["default"]('Request aborted', _core_AxiosError_js__rspack_import_3["default"].ECONNABORTED, config, request));
+        done();
 
         // Clean up request
         request = null;
@@ -22224,6 +22362,7 @@ const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
         // attach the underlying event for consumers who want details
         err.event = event || null;
         reject(err);
+        done();
         request = null;
       };
 
@@ -22244,6 +22383,7 @@ const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
             request
           )
         );
+        done();
 
         // Clean up request
         request = null;
@@ -22293,6 +22433,7 @@ const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
           }
           reject(!cancel || cancel.type ? new _cancel_CanceledError_js__rspack_import_7["default"](null, config, request) : cancel);
           request.abort();
+          done();
           request = null;
         };
 
@@ -22306,7 +22447,7 @@ const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
 
       const protocol = (0,_helpers_parseProtocol_js__rspack_import_8["default"])(_config.url);
 
-      if (protocol && _platform_index_js__rspack_import_9["default"].protocols.indexOf(protocol) === -1) {
+      if (protocol && !_platform_index_js__rspack_import_9["default"].protocols.includes(protocol)) {
         reject(
           new _core_AxiosError_js__rspack_import_3["default"](
             'Unsupported protocol ' + protocol + ':',
@@ -22795,7 +22936,7 @@ class Axios {
     let contextHeaders = headers && _utils_js__rspack_import_3["default"].merge(headers.common, headers[config.method]);
 
     headers &&
-      _utils_js__rspack_import_3["default"].forEach(['delete', 'get', 'head', 'post', 'put', 'patch', 'common'], (method) => {
+      _utils_js__rspack_import_3["default"].forEach(['delete', 'get', 'head', 'post', 'put', 'patch', 'query', 'common'], (method) => {
         delete headers[method];
       });
 
@@ -22898,7 +23039,7 @@ _utils_js__rspack_import_3["default"].forEach(['delete', 'get', 'head', 'options
   };
 });
 
-_utils_js__rspack_import_3["default"].forEach(['post', 'put', 'patch'], function forEachMethodWithData(method) {
+_utils_js__rspack_import_3["default"].forEach(['post', 'put', 'patch', 'query'], function forEachMethodWithData(method) {
   function generateHTTPMethod(isForm) {
     return function httpMethod(url, data, config) {
       return this.request(
@@ -22918,7 +23059,11 @@ _utils_js__rspack_import_3["default"].forEach(['post', 'put', 'patch'], function
 
   Axios.prototype[method] = generateHTTPMethod();
 
-  Axios.prototype[method + 'Form'] = generateHTTPMethod(true);
+  // QUERY is a safe/idempotent read method; multipart form bodies don't fit
+  // its semantics, so no queryForm shorthand is generated.
+  if (method !== 'query') {
+    Axios.prototype[method + 'Form'] = generateHTTPMethod(true);
+  }
 });
 
 /* export default */ const __rspack_default_export = (Axios);
@@ -22932,9 +23077,80 @@ __webpack_require__.d(__webpack_exports__, {
   "default": () => (__rspack_default_export)
 });
 /* import */ var _utils_js__rspack_import_0 = __webpack_require__(7275);
+/* import */ var _AxiosHeaders_js__rspack_import_1 = __webpack_require__(7110);
+
+
+
+
+
+const REDACTED = '[REDACTED ****]';
+
+function hasOwnOrPrototypeToJSON(source) {
+  if (_utils_js__rspack_import_0["default"].hasOwnProp(source, 'toJSON')) {
+    return true;
+  }
+
+  let prototype = Object.getPrototypeOf(source);
+
+  while (prototype && prototype !== Object.prototype) {
+    if (_utils_js__rspack_import_0["default"].hasOwnProp(prototype, 'toJSON')) {
+      return true;
+    }
 
+    prototype = Object.getPrototypeOf(prototype);
+  }
+
+  return false;
+}
+
+// Build a plain-object snapshot of `config` and replace the value of any key
+// (case-insensitive) listed in `redactKeys` with REDACTED. Walks through arrays
+// and AxiosHeaders, and short-circuits on circular references.
+function redactConfig(config, redactKeys) {
+  const lowerKeys = new Set(redactKeys.map((k) => String(k).toLowerCase()));
+  const seen = [];
+
+  const visit = (source) => {
+    if (source === null || typeof source !== 'object') return source;
+    if (_utils_js__rspack_import_0["default"].isBuffer(source)) return source;
+    if (seen.indexOf(source) !== -1) return undefined;
+
+    if (source instanceof _AxiosHeaders_js__rspack_import_1["default"]) {
+      source = source.toJSON();
+    }
 
+    seen.push(source);
 
+    let result;
+    if (_utils_js__rspack_import_0["default"].isArray(source)) {
+      result = [];
+      source.forEach((v, i) => {
+        const reducedValue = visit(v);
+        if (!_utils_js__rspack_import_0["default"].isUndefined(reducedValue)) {
+          result[i] = reducedValue;
+        }
+      });
+    } else {
+      if (!_utils_js__rspack_import_0["default"].isPlainObject(source) && hasOwnOrPrototypeToJSON(source)) {
+        seen.pop();
+        return source;
+      }
+
+      result = Object.create(null);
+      for (const [key, value] of Object.entries(source)) {
+        const reducedValue = lowerKeys.has(key.toLowerCase()) ? REDACTED : visit(value);
+        if (!_utils_js__rspack_import_0["default"].isUndefined(reducedValue)) {
+          result[key] = reducedValue;
+        }
+      }
+    }
+
+    seen.pop();
+    return result;
+  };
+
+  return visit(config);
+}
 
 class AxiosError extends Error {
   static from(error, code, config, request, response, customProps) {
@@ -22951,42 +23167,56 @@ class AxiosError extends Error {
     return axiosError;
   }
 
-    /**
-     * Create an Error with the specified message, config, error code, request and response.
-     *
-     * @param {string} message The error message.
-     * @param {string} [code] The error code (for example, 'ECONNABORTED').
-     * @param {Object} [config] The config.
-     * @param {Object} [request] The request.
-     * @param {Object} [response] The response.
-     *
-     * @returns {Error} The created error.
-     */
-    constructor(message, code, config, request, response) {
-      super(message);
-      
-      // Make message enumerable to maintain backward compatibility
-      // The native Error constructor sets message as non-enumerable,
-      // but axios < v1.13.3 had it as enumerable
-      Object.defineProperty(this, 'message', {
-          value: message,
-          enumerable: true,
-          writable: true,
-          configurable: true
-      });
-      
-      this.name = 'AxiosError';
-      this.isAxiosError = true;
-      code && (this.code = code);
-      config && (this.config = config);
-      request && (this.request = request);
-      if (response) {
-          this.response = response;
-          this.status = response.status;
-      }
+  /**
+   * Create an Error with the specified message, config, error code, request and response.
+   *
+   * @param {string} message The error message.
+   * @param {string} [code] The error code (for example, 'ECONNABORTED').
+   * @param {Object} [config] The config.
+   * @param {Object} [request] The request.
+   * @param {Object} [response] The response.
+   *
+   * @returns {Error} The created error.
+   */
+  constructor(message, code, config, request, response) {
+    super(message);
+
+    // Make message enumerable to maintain backward compatibility
+    // The native Error constructor sets message as non-enumerable,
+    // but axios < v1.13.3 had it as enumerable
+    Object.defineProperty(this, 'message', {
+      // Null-proto descriptor so a polluted Object.prototype.get cannot turn
+      // this data descriptor into an accessor descriptor on the way in.
+      __proto__: null,
+      value: message,
+      enumerable: true,
+      writable: true,
+      configurable: true,
+    });
+
+    this.name = 'AxiosError';
+    this.isAxiosError = true;
+    code && (this.code = code);
+    config && (this.config = config);
+    request && (this.request = request);
+    if (response) {
+      this.response = response;
+      this.status = response.status;
     }
+  }
 
   toJSON() {
+    // Opt-in redaction: when the request config carries a `redact` array, the
+    // value of any matching key (case-insensitive, at any depth) is replaced
+    // with REDACTED in the serialized snapshot. Undefined or empty leaves the
+    // existing serialization behavior unchanged.
+    const config = this.config;
+    const redactKeys = config && _utils_js__rspack_import_0["default"].hasOwnProp(config, 'redact') ? config.redact : undefined;
+    const serializedConfig =
+      _utils_js__rspack_import_0["default"].isArray(redactKeys) && redactKeys.length > 0
+        ? redactConfig(config, redactKeys)
+        : _utils_js__rspack_import_0["default"].toJSONObject(config);
+
     return {
       // Standard
       message: this.message,
@@ -23000,7 +23230,7 @@ class AxiosError extends Error {
       columnNumber: this.columnNumber,
       stack: this.stack,
       // Axios
-      config: _utils_js__rspack_import_0["default"].toJSONObject(this.config),
+      config: serializedConfig,
       code: this.code,
       status: this.status,
     };
@@ -23012,6 +23242,7 @@ AxiosError.ERR_BAD_OPTION_VALUE = 'ERR_BAD_OPTION_VALUE';
 AxiosError.ERR_BAD_OPTION = 'ERR_BAD_OPTION';
 AxiosError.ECONNABORTED = 'ECONNABORTED';
 AxiosError.ETIMEDOUT = 'ETIMEDOUT';
+AxiosError.ECONNREFUSED = 'ECONNREFUSED';
 AxiosError.ERR_NETWORK = 'ERR_NETWORK';
 AxiosError.ERR_FR_TOO_MANY_REDIRECTS = 'ERR_FR_TOO_MANY_REDIRECTS';
 AxiosError.ERR_DEPRECATED = 'ERR_DEPRECATED';
@@ -23020,6 +23251,7 @@ AxiosError.ERR_BAD_REQUEST = 'ERR_BAD_REQUEST';
 AxiosError.ERR_CANCELED = 'ERR_CANCELED';
 AxiosError.ERR_NOT_SUPPORT = 'ERR_NOT_SUPPORT';
 AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL';
+AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED';
 
 /* export default */ const __rspack_default_export = (AxiosError);
 
@@ -23040,41 +23272,41 @@ __webpack_require__.d(__webpack_exports__, {
 
 const $internals = Symbol('internals');
 
-const isValidHeaderValue = (value) => !/[\r\n]/.test(value);
-
-function assertValidHeaderValue(value, header) {
-  if (value === false || value == null) {
-    return;
-  }
+const INVALID_HEADER_VALUE_CHARS_RE = /[^\x09\x20-\x7E\x80-\xFF]/g;
 
-  if (_utils_js__rspack_import_0["default"].isArray(value)) {
-    value.forEach((v) => assertValidHeaderValue(v, header));
-    return;
-  }
+function trimSPorHTAB(str) {
+  let start = 0;
+  let end = str.length;
 
-  if (!isValidHeaderValue(String(value))) {
-    throw new Error(`Invalid character in header content ["${header}"]`);
-  }
-}
+  while (start < end) {
+    const code = str.charCodeAt(start);
 
-function normalizeHeader(header) {
-  return header && String(header).trim().toLowerCase();
-}
+    if (code !== 0x09 && code !== 0x20) {
+      break;
+    }
 
-function stripTrailingCRLF(str) {
-  let end = str.length;
+    start += 1;
+  }
 
-  while (end > 0) {
-    const charCode = str.charCodeAt(end - 1);
+  while (end > start) {
+    const code = str.charCodeAt(end - 1);
 
-    if (charCode !== 10 && charCode !== 13) {
+    if (code !== 0x09 && code !== 0x20) {
       break;
     }
 
     end -= 1;
   }
 
-  return end === str.length ? str : str.slice(0, end);
+  return start === 0 && end === str.length ? str : str.slice(start, end);
+}
+
+function normalizeHeader(header) {
+  return header && String(header).trim().toLowerCase();
+}
+
+function sanitizeHeaderValue(str) {
+  return trimSPorHTAB(str.replace(INVALID_HEADER_VALUE_CHARS_RE, ''));
 }
 
 function normalizeValue(value) {
@@ -23082,7 +23314,7 @@ function normalizeValue(value) {
     return value;
   }
 
-  return _utils_js__rspack_import_0["default"].isArray(value) ? value.map(normalizeValue) : stripTrailingCRLF(String(value));
+  return _utils_js__rspack_import_0["default"].isArray(value) ? value.map(normalizeValue) : sanitizeHeaderValue(String(value));
 }
 
 function parseTokens(str) {
@@ -23133,6 +23365,9 @@ function buildAccessors(obj, header) {
 
   ['get', 'set', 'has'].forEach((methodName) => {
     Object.defineProperty(obj, methodName + accessorName, {
+      // Null-proto descriptor so a polluted Object.prototype.get cannot turn
+      // this data descriptor into an accessor descriptor on the way in.
+      __proto__: null,
       value: function (arg1, arg2, arg3) {
         return this[methodName].call(this, header, arg1, arg2, arg3);
       },
@@ -23164,7 +23399,6 @@ class AxiosHeaders {
         _rewrite === true ||
         (_rewrite === undefined && self[key] !== false)
       ) {
-        assertValidHeaderValue(_value, _header);
         self[key || _header] = normalizeValue(_value);
       }
     }
@@ -23521,7 +23755,7 @@ __webpack_require__.d(__webpack_exports__, {
  */
 function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
   let isRelativeUrl = !(0,_helpers_isAbsoluteURL_js__rspack_import_0["default"])(requestedURL);
-  if (baseURL && (isRelativeUrl || allowAbsoluteUrls == false)) {
+  if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
     return (0,_helpers_combineURLs_js__rspack_import_1["default"])(baseURL, requestedURL);
   }
   return requestedURL;
@@ -23592,8 +23826,15 @@ function dispatchRequest(config) {
     function onAdapterResolution(response) {
       throwIfCancellationRequested(config);
 
-      // Transform response data
-      response.data = _transformData_js__rspack_import_2["default"].call(config, config.transformResponse, response);
+      // Expose the current response on config so that transformResponse can
+      // attach it to any AxiosError it throws (e.g. on JSON parse failure).
+      // We clean it up afterwards to avoid polluting the config object.
+      config.response = response;
+      try {
+        response.data = _transformData_js__rspack_import_2["default"].call(config, config.transformResponse, response);
+      } finally {
+        delete config.response;
+      }
 
       response.headers = _core_AxiosHeaders_js__rspack_import_1["default"].from(response.headers);
 
@@ -23605,11 +23846,16 @@ function dispatchRequest(config) {
 
         // Transform response data
         if (reason && reason.response) {
-          reason.response.data = _transformData_js__rspack_import_2["default"].call(
-            config,
-            config.transformResponse,
-            reason.response
-          );
+          config.response = reason.response;
+          try {
+            reason.response.data = _transformData_js__rspack_import_2["default"].call(
+              config,
+              config.transformResponse,
+              reason.response
+            );
+          } finally {
+            delete config.response;
+          }
           reason.response.headers = _core_AxiosHeaders_js__rspack_import_1["default"].from(reason.response.headers);
         }
       }
@@ -23648,7 +23894,21 @@ const headersToObject = (thing) => (thing instanceof _AxiosHeaders_js__rspack_im
 function mergeConfig(config1, config2) {
   // eslint-disable-next-line no-param-reassign
   config2 = config2 || {};
-  const config = {};
+
+  // Use a null-prototype object so that downstream reads such as `config.auth`
+  // or `config.baseURL` cannot inherit polluted values from Object.prototype.
+  // `hasOwnProperty` is restored as a non-enumerable own slot to preserve
+  // ergonomics for user code that relies on it.
+  const config = Object.create(null);
+  Object.defineProperty(config, 'hasOwnProperty', {
+    // Null-proto descriptor so a polluted Object.prototype.get cannot turn
+    // this data descriptor into an accessor descriptor on the way in.
+    __proto__: null,
+    value: Object.prototype.hasOwnProperty,
+    enumerable: false,
+    writable: true,
+    configurable: true,
+  });
 
   function getMergedValue(target, source, prop, caseless) {
     if (_utils_js__rspack_import_1["default"].isPlainObject(target) && _utils_js__rspack_import_1["default"].isPlainObject(source)) {
@@ -23687,9 +23947,9 @@ function mergeConfig(config1, config2) {
 
   // eslint-disable-next-line consistent-return
   function mergeDirectKeys(a, b, prop) {
-    if (prop in config2) {
+    if (_utils_js__rspack_import_1["default"].hasOwnProp(config2, prop)) {
       return getMergedValue(a, b);
-    } else if (prop in config1) {
+    } else if (_utils_js__rspack_import_1["default"].hasOwnProp(config1, prop)) {
       return getMergedValue(undefined, a);
     }
   }
@@ -23721,6 +23981,7 @@ function mergeConfig(config1, config2) {
     httpsAgent: defaultToConfig2,
     cancelToken: defaultToConfig2,
     socketPath: defaultToConfig2,
+    allowedSocketPaths: defaultToConfig2,
     responseEncoding: defaultToConfig2,
     validateStatus: mergeDirectKeys,
     headers: (a, b, prop) =>
@@ -23730,7 +23991,9 @@ function mergeConfig(config1, config2) {
   _utils_js__rspack_import_1["default"].forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
     if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
     const merge = _utils_js__rspack_import_1["default"].hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
-    const configValue = merge(config1[prop], config2[prop], prop);
+    const a = _utils_js__rspack_import_1["default"].hasOwnProp(config1, prop) ? config1[prop] : undefined;
+    const b = _utils_js__rspack_import_1["default"].hasOwnProp(config2, prop) ? config2[prop] : undefined;
+    const configValue = merge(a, b, prop);
     (_utils_js__rspack_import_1["default"].isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
   });
 
@@ -23764,17 +24027,13 @@ function settle(resolve, reject, response) {
   if (!response.status || !validateStatus || validateStatus(response.status)) {
     resolve(response);
   } else {
-    reject(
-      new _AxiosError_js__rspack_import_0["default"](
-        'Request failed with status code ' + response.status,
-        [_AxiosError_js__rspack_import_0["default"].ERR_BAD_REQUEST, _AxiosError_js__rspack_import_0["default"].ERR_BAD_RESPONSE][
-          Math.floor(response.status / 100) - 4
-        ],
-        response.config,
-        response.request,
-        response
-      )
-    );
+    reject(new _AxiosError_js__rspack_import_0["default"](
+      'Request failed with status code ' + response.status,
+      response.status >= 400 && response.status < 500 ? _AxiosError_js__rspack_import_0["default"].ERR_BAD_REQUEST : _AxiosError_js__rspack_import_0["default"].ERR_BAD_RESPONSE,
+      response.config,
+      response.request,
+      response
+    ));
   }
 }
 
@@ -23843,6 +24102,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 
+const own = (obj, key) => (obj != null && _utils_js__rspack_import_0["default"].hasOwnProp(obj, key) ? obj[key] : undefined);
+
 /**
  * It takes a string, tries to parse it, and if it fails, it returns the stringified version
  * of the input
@@ -23910,20 +24171,22 @@ const defaults = {
       let isFileList;
 
       if (isObjectPayload) {
+        const formSerializer = own(this, 'formSerializer');
         if (contentType.indexOf('application/x-www-form-urlencoded') > -1) {
-          return (0,_helpers_toURLEncodedForm_js__rspack_import_3["default"])(data, this.formSerializer).toString();
+          return (0,_helpers_toURLEncodedForm_js__rspack_import_3["default"])(data, formSerializer).toString();
         }
 
         if (
           (isFileList = _utils_js__rspack_import_0["default"].isFileList(data)) ||
           contentType.indexOf('multipart/form-data') > -1
         ) {
-          const _FormData = this.env && this.env.FormData;
+          const env = own(this, 'env');
+          const _FormData = env && env.FormData;
 
           return (0,_helpers_toFormData_js__rspack_import_4["default"])(
             isFileList ? { 'files[]': data } : data,
             _FormData && new _FormData(),
-            this.formSerializer
+            formSerializer
           );
         }
       }
@@ -23939,9 +24202,10 @@ const defaults = {
 
   transformResponse: [
     function transformResponse(data) {
-      const transitional = this.transitional || defaults.transitional;
+      const transitional = own(this, 'transitional') || defaults.transitional;
       const forcedJSONParsing = transitional && transitional.forcedJSONParsing;
-      const JSONRequested = this.responseType === 'json';
+      const responseType = own(this, 'responseType');
+      const JSONRequested = responseType === 'json';
 
       if (_utils_js__rspack_import_0["default"].isResponse(data) || _utils_js__rspack_import_0["default"].isReadableStream(data)) {
         return data;
@@ -23950,17 +24214,17 @@ const defaults = {
       if (
         data &&
         _utils_js__rspack_import_0["default"].isString(data) &&
-        ((forcedJSONParsing && !this.responseType) || JSONRequested)
+        ((forcedJSONParsing && !responseType) || JSONRequested)
       ) {
         const silentJSONParsing = transitional && transitional.silentJSONParsing;
         const strictJSONParsing = !silentJSONParsing && JSONRequested;
 
         try {
-          return JSON.parse(data, this.parseReviver);
+          return JSON.parse(data, own(this, 'parseReviver'));
         } catch (e) {
           if (strictJSONParsing) {
             if (e.name === 'SyntaxError') {
-              throw _core_AxiosError_js__rspack_import_5["default"].from(e, _core_AxiosError_js__rspack_import_5["default"].ERR_BAD_RESPONSE, this, null, this.response);
+              throw _core_AxiosError_js__rspack_import_5["default"].from(e, _core_AxiosError_js__rspack_import_5["default"].ERR_BAD_RESPONSE, this, null, own(this, 'response'));
             }
             throw e;
           }
@@ -24000,7 +24264,7 @@ const defaults = {
   },
 };
 
-_utils_js__rspack_import_0["default"].forEach(['delete', 'get', 'head', 'post', 'put', 'patch'], (method) => {
+_utils_js__rspack_import_0["default"].forEach(['delete', 'get', 'head', 'post', 'put', 'patch', 'query'], (method) => {
   defaults.headers[method] = {};
 });
 
@@ -24031,7 +24295,7 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
   VERSION: () => (VERSION)
 });
-const VERSION = "1.15.0";
+const VERSION = "1.16.0";
 
 },
 5267(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
@@ -24061,9 +24325,8 @@ function encode(str) {
     ')': '%29',
     '~': '%7E',
     '%20': '+',
-    '%00': '\x00',
   };
-  return encodeURIComponent(str).replace(/[!'()~]|%20|%00/g, function replacer(match) {
+  return encodeURIComponent(str).replace(/[!'()~]|%20/g, function replacer(match) {
     return charMap[match];
   });
 }
@@ -24219,7 +24482,8 @@ function bind(fn, thisArg) {
 "use strict";
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
-  "default": () => (buildURL)
+  "default": () => (buildURL),
+  encode: () => (encode)
 });
 /* import */ var _utils_js__rspack_import_0 = __webpack_require__(7275);
 /* import */ var _helpers_AxiosURLSearchParams_js__rspack_import_1 = __webpack_require__(5267);
@@ -24424,8 +24688,20 @@ __webpack_require__.d(__webpack_exports__, {
 
       read(name) {
         if (typeof document === 'undefined') return null;
-        const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));
-        return match ? decodeURIComponent(match[1]) : null;
+        // Match name=value by splitting on the semicolon separator instead of building a
+        // RegExp from `name` — interpolating an unescaped string into a RegExp would let
+        // metacharacters (e.g. `.+?` in an attacker-influenced cookie name) cause ReDoS or
+        // match the wrong cookie. Browsers may serialize cookie pairs as either ";" or
+        // "; ", so ignore optional whitespace before each cookie name.
+        const cookies = document.cookie.split(';');
+        for (let i = 0; i < cookies.length; i++) {
+          const cookie = cookies[i].replace(/^\s+/, '');
+          const eq = cookie.indexOf('=');
+          if (eq !== -1 && cookie.slice(0, eq) === name) {
+            return decodeURIComponent(cookie.slice(eq + 1));
+          }
+        }
+        return null;
       },
 
       remove(name) {
@@ -24442,6 +24718,116 @@ __webpack_require__.d(__webpack_exports__, {
     });
 
 
+},
+1526(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
+"use strict";
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+  "default": () => (estimateDataURLDecodedBytes)
+});
+/* provided dependency */ var Buffer = __webpack_require__(8287)["Buffer"];
+/**
+ * Estimate decoded byte length of a data:// URL *without* allocating large buffers.
+ * - For base64: compute exact decoded size using length and padding;
+ *               handle %XX at the character-count level (no string allocation).
+ * - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound.
+ *
+ * @param {string} url
+ * @returns {number}
+ */
+function estimateDataURLDecodedBytes(url) {
+  if (!url || typeof url !== 'string') return 0;
+  if (!url.startsWith('data:')) return 0;
+
+  const comma = url.indexOf(',');
+  if (comma < 0) return 0;
+
+  const meta = url.slice(5, comma);
+  const body = url.slice(comma + 1);
+  const isBase64 = /;base64/i.test(meta);
+
+  if (isBase64) {
+    let effectiveLen = body.length;
+    const len = body.length; // cache length
+
+    for (let i = 0; i < len; i++) {
+      if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) {
+        const a = body.charCodeAt(i + 1);
+        const b = body.charCodeAt(i + 2);
+        const isHex =
+          ((a >= 48 && a <= 57) || (a >= 65 && a <= 70) || (a >= 97 && a <= 102)) &&
+          ((b >= 48 && b <= 57) || (b >= 65 && b <= 70) || (b >= 97 && b <= 102));
+
+        if (isHex) {
+          effectiveLen -= 2;
+          i += 2;
+        }
+      }
+    }
+
+    let pad = 0;
+    let idx = len - 1;
+
+    const tailIsPct3D = (j) =>
+      j >= 2 &&
+      body.charCodeAt(j - 2) === 37 && // '%'
+      body.charCodeAt(j - 1) === 51 && // '3'
+      (body.charCodeAt(j) === 68 || body.charCodeAt(j) === 100); // 'D' or 'd'
+
+    if (idx >= 0) {
+      if (body.charCodeAt(idx) === 61 /* '=' */) {
+        pad++;
+        idx--;
+      } else if (tailIsPct3D(idx)) {
+        pad++;
+        idx -= 3;
+      }
+    }
+
+    if (pad === 1 && idx >= 0) {
+      if (body.charCodeAt(idx) === 61 /* '=' */) {
+        pad++;
+      } else if (tailIsPct3D(idx)) {
+        pad++;
+      }
+    }
+
+    const groups = Math.floor(effectiveLen / 4);
+    const bytes = groups * 3 - (pad || 0);
+    return bytes > 0 ? bytes : 0;
+  }
+
+  if (typeof Buffer !== 'undefined' && typeof Buffer.byteLength === 'function') {
+    return Buffer.byteLength(body, 'utf8');
+  }
+
+  // Compute UTF-8 byte length directly from UTF-16 code units without allocating
+  // a byte buffer (TextEncoder.encode would defeat the DoS guard on large bodies).
+  // Using body.length here would undercount non-ASCII (e.g. '€' is 1 code unit
+  // but 3 UTF-8 bytes).
+  let bytes = 0;
+  for (let i = 0, len = body.length; i < len; i++) {
+    const c = body.charCodeAt(i);
+    if (c < 0x80) {
+      bytes += 1;
+    } else if (c < 0x800) {
+      bytes += 2;
+    } else if (c >= 0xd800 && c <= 0xdbff && i + 1 < len) {
+      const next = body.charCodeAt(i + 1);
+      if (next >= 0xdc00 && next <= 0xdfff) {
+        bytes += 4;
+        i++;
+      } else {
+        bytes += 3;
+      }
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+
+
 },
 7887(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 "use strict";
@@ -24510,7 +24896,9 @@ function formDataToJSON(formData) {
 
     if (isLast) {
       if (_utils_js__rspack_import_0["default"].hasOwnProp(target, name)) {
-        target[name] = [target[name], value];
+        target[name] = _utils_js__rspack_import_0["default"].isArray(target[name])
+          ? target[name].concat(value)
+          : [target[name], value];
       } else {
         target[name] = value;
       }
@@ -24725,7 +25113,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 function parseProtocol(url) {
-  const match = /^([-+\w]{1,25})(:?\/\/|:)/.exec(url);
+  const match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url);
   return (match && match[1]) || '';
 }
 
@@ -24751,13 +25139,13 @@ const progressEventReducer = (listener, isDownloadStream, freq = 3) => {
   const _speedometer = (0,_speedometer_js__rspack_import_0["default"])(50, 250);
 
   return (0,_throttle_js__rspack_import_1["default"])((e) => {
-    const loaded = e.loaded;
+    const rawLoaded = e.loaded;
     const total = e.lengthComputable ? e.total : undefined;
-    const progressBytes = loaded - bytesNotified;
+    const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+    const progressBytes = Math.max(0, loaded - bytesNotified);
     const rate = _speedometer(progressBytes);
-    const inRange = loaded <= total;
 
-    bytesNotified = loaded;
+    bytesNotified = Math.max(bytesNotified, loaded);
 
     const data = {
       loaded,
@@ -24765,7 +25153,7 @@ const progressEventReducer = (listener, isDownloadStream, freq = 3) => {
       progress: total ? loaded / total : undefined,
       bytes: progressBytes,
       rate: rate ? rate : undefined,
-      estimated: rate && total && inRange ? (total - loaded) / rate : undefined,
+      estimated: rate && total ? (total - loaded) / rate : undefined,
       event: e,
       lengthComputable: total != null,
       [isDownloadStream ? 'download' : 'upload']: true,
@@ -24803,13 +25191,14 @@ __webpack_require__.d(__webpack_exports__, {
   "default": () => (__rspack_default_export)
 });
 /* import */ var _platform_index_js__rspack_import_5 = __webpack_require__(3820);
-/* import */ var _utils_js__rspack_import_4 = __webpack_require__(7275);
+/* import */ var _utils_js__rspack_import_1 = __webpack_require__(7275);
 /* import */ var _isURLSameOrigin_js__rspack_import_6 = __webpack_require__(6305);
 /* import */ var _cookies_js__rspack_import_7 = __webpack_require__(9887);
-/* import */ var _core_buildFullPath_js__rspack_import_3 = __webpack_require__(8262);
+/* import */ var _core_buildFullPath_js__rspack_import_4 = __webpack_require__(8262);
 /* import */ var _core_mergeConfig_js__rspack_import_0 = __webpack_require__(4662);
-/* import */ var _core_AxiosHeaders_js__rspack_import_1 = __webpack_require__(7110);
-/* import */ var _buildURL_js__rspack_import_2 = __webpack_require__(3967);
+/* import */ var _core_AxiosHeaders_js__rspack_import_2 = __webpack_require__(7110);
+/* import */ var _buildURL_js__rspack_import_3 = __webpack_require__(3967);
+
 
 
 
@@ -24818,16 +25207,55 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 
+const FORM_DATA_CONTENT_HEADERS = ['content-type', 'content-length'];
+
+function setFormDataHeaders(headers, formHeaders, policy) {
+  if (policy !== 'content-only') {
+    headers.set(formHeaders);
+    return;
+  }
+
+  Object.entries(formHeaders).forEach(([key, val]) => {
+    if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) {
+      headers.set(key, val);
+    }
+  });
+}
+
+/**
+ * Encode a UTF-8 string to a Latin-1 byte string for use with btoa().
+ * This is a modern replacement for the deprecated unescape(encodeURIComponent(str)) pattern.
+ *
+ * @param {string} str The string to encode
+ *
+ * @returns {string} UTF-8 bytes as a Latin-1 string
+ */
+const encodeUTF8 = (str) =>
+  encodeURIComponent(str).replace(/%([0-9A-F]{2})/gi, (_, hex) =>
+    String.fromCharCode(parseInt(hex, 16))
+  );
 
 /* export default */ const __rspack_default_export = ((config) => {
   const newConfig = (0,_core_mergeConfig_js__rspack_import_0["default"])({}, config);
 
-  let { data, withXSRFToken, xsrfHeaderName, xsrfCookieName, headers, auth } = newConfig;
+  // Read only own properties to prevent prototype pollution gadgets
+  // (e.g. Object.prototype.baseURL = 'https://evil.com').
+  const own = (key) => (_utils_js__rspack_import_1["default"].hasOwnProp(newConfig, key) ? newConfig[key] : undefined);
+
+  const data = own('data');
+  let withXSRFToken = own('withXSRFToken');
+  const xsrfHeaderName = own('xsrfHeaderName');
+  const xsrfCookieName = own('xsrfCookieName');
+  let headers = own('headers');
+  const auth = own('auth');
+  const baseURL = own('baseURL');
+  const allowAbsoluteUrls = own('allowAbsoluteUrls');
+  const url = own('url');
 
-  newConfig.headers = headers = _core_AxiosHeaders_js__rspack_import_1["default"].from(headers);
+  newConfig.headers = headers = _core_AxiosHeaders_js__rspack_import_2["default"].from(headers);
 
-  newConfig.url = (0,_buildURL_js__rspack_import_2["default"])(
-    (0,_core_buildFullPath_js__rspack_import_3["default"])(newConfig.baseURL, newConfig.url, newConfig.allowAbsoluteUrls),
+  newConfig.url = (0,_buildURL_js__rspack_import_3["default"])(
+    (0,_core_buildFullPath_js__rspack_import_4["default"])(baseURL, url, allowAbsoluteUrls),
     config.params,
     config.paramsSerializer
   );
@@ -24837,27 +25265,16 @@ __webpack_require__.d(__webpack_exports__, {
     headers.set(
       'Authorization',
       'Basic ' +
-        btoa(
-          (auth.username || '') +
-            ':' +
-            (auth.password ? unescape(encodeURIComponent(auth.password)) : '')
-        )
+        btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
     );
   }
 
-  if (_utils_js__rspack_import_4["default"].isFormData(data)) {
+  if (_utils_js__rspack_import_1["default"].isFormData(data)) {
     if (_platform_index_js__rspack_import_5["default"].hasStandardBrowserEnv || _platform_index_js__rspack_import_5["default"].hasStandardBrowserWebWorkerEnv) {
       headers.setContentType(undefined); // browser handles it
-    } else if (_utils_js__rspack_import_4["default"].isFunction(data.getHeaders)) {
+    } else if (_utils_js__rspack_import_1["default"].isFunction(data.getHeaders)) {
       // Node.js FormData (like form-data package)
-      const formHeaders = data.getHeaders();
-      // Only set safe headers to avoid overwriting security headers
-      const allowedHeaders = ['content-type', 'content-length'];
-      Object.entries(formHeaders).forEach(([key, val]) => {
-        if (allowedHeaders.includes(key.toLowerCase())) {
-          headers.set(key, val);
-        }
-      });
+      setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy'));
     }
   }
 
@@ -24866,10 +25283,17 @@ __webpack_require__.d(__webpack_exports__, {
   // Specifically not if we're in a web worker, or react-native.
 
   if (_platform_index_js__rspack_import_5["default"].hasStandardBrowserEnv) {
-    withXSRFToken && _utils_js__rspack_import_4["default"].isFunction(withXSRFToken) && (withXSRFToken = withXSRFToken(newConfig));
+    if (_utils_js__rspack_import_1["default"].isFunction(withXSRFToken)) {
+      withXSRFToken = withXSRFToken(newConfig);
+    }
+
+    // Strict boolean check — prevents proto-pollution gadgets (e.g. Object.prototype.withXSRFToken = 1)
+    // and misconfigurations (e.g. "false") from short-circuiting the same-origin check and leaking
+    // the XSRF token cross-origin.
+    const shouldSendXSRF =
+      withXSRFToken === true || (withXSRFToken == null && (0,_isURLSameOrigin_js__rspack_import_6["default"])(newConfig.url));
 
-    if (withXSRFToken || (withXSRFToken !== false && (0,_isURLSameOrigin_js__rspack_import_6["default"])(newConfig.url))) {
-      // Add xsrf header
+    if (shouldSendXSRF) {
       const xsrfValue = xsrfHeaderName && xsrfCookieName && _cookies_js__rspack_import_7["default"].read(xsrfCookieName);
 
       if (xsrfValue) {
@@ -25164,6 +25588,7 @@ function toFormData(obj, formData, options) {
   const dots = options.dots;
   const indexes = options.indexes;
   const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
+  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
   const useBlob = _Blob && _utils_js__rspack_import_0["default"].isSpecCompliantForm(formData);
 
   if (!_utils_js__rspack_import_0["default"].isFunction(visitor)) {
@@ -25256,9 +25681,16 @@ function toFormData(obj, formData, options) {
     isVisitable,
   });
 
-  function build(value, path) {
+  function build(value, path, depth = 0) {
     if (_utils_js__rspack_import_0["default"].isUndefined(value)) return;
 
+    if (depth > maxDepth) {
+      throw new _core_AxiosError_js__rspack_import_2["default"](
+        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+        _core_AxiosError_js__rspack_import_2["default"].ERR_FORM_DATA_DEPTH_EXCEEDED
+      );
+    }
+
     if (stack.indexOf(value) !== -1) {
       throw Error('Circular reference detected in ' + path.join('.'));
     }
@@ -25271,7 +25703,7 @@ function toFormData(obj, formData, options) {
         visitor.call(formData, el, _utils_js__rspack_import_0["default"].isString(key) ? key.trim() : key, path, exposedHelpers);
 
       if (result === true) {
-        build(el, path ? path.concat(key) : [key]);
+        build(el, path ? path.concat(key) : [key], depth + 1);
       }
     });
 
@@ -25518,7 +25950,9 @@ function assertOptions(options, schema, allowUnknown) {
   let i = keys.length;
   while (i-- > 0) {
     const opt = keys[i];
-    const validator = schema[opt];
+    // Use hasOwnProperty so a polluted Object.prototype.<opt> cannot supply
+    // a non-function validator and cause a TypeError.
+    const validator = Object.prototype.hasOwnProperty.call(schema, opt) ? schema[opt] : undefined;
     if (validator) {
       const value = options[opt];
       const result = value === undefined || validator(value, opt, options);
@@ -25885,21 +26319,21 @@ const isFile = kindOfTest('File');
  * also have a `name` and `type` attribute to specify filename and content type
  *
  * @see https://github.com/facebook/react-native/blob/26684cf3adf4094eb6c405d345a75bf8c7c0bf88/Libraries/Network/FormData.js#L68-L71
- * 
+ *
  * @param {*} value The value to test
- * 
+ *
  * @returns {boolean} True if value is a React Native Blob, otherwise false
  */
 const isReactNativeBlob = (value) => {
   return !!(value && typeof value.uri !== 'undefined');
-}
+};
 
 /**
  * Determine if environment is React Native
  * ReactNative `FormData` has a non-standard `getParts()` method
- * 
+ *
  * @param {*} formData The formData to test
- * 
+ *
  * @returns {boolean} True if environment is React Native, otherwise false
  */
 const isReactNative = (formData) => formData && typeof formData.getParts !== 'undefined';
@@ -25918,7 +26352,7 @@ const isBlob = kindOfTest('Blob');
  *
  * @param {*} val The value to test
  *
- * @returns {boolean} True if value is a File, otherwise false
+ * @returns {boolean} True if value is a FileList, otherwise false
  */
 const isFileList = kindOfTest('FileList');
 
@@ -25950,15 +26384,17 @@ const G = getGlobal();
 const FormDataCtor = typeof G.FormData !== 'undefined' ? G.FormData : undefined;
 
 const isFormData = (thing) => {
-  let kind;
-  return thing && (
-    (FormDataCtor && thing instanceof FormDataCtor) || (
-      isFunction(thing.append) && (
-        (kind = kindOf(thing)) === 'formdata' ||
-        // detect form-data instance
-        (kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]')
-      )
-    )
+  if (!thing) return false;
+  if (FormDataCtor && thing instanceof FormDataCtor) return true;
+  // Reject plain objects inheriting directly from Object.prototype so prototype-pollution gadgets can't spoof FormData.
+  const proto = getPrototypeOf(thing);
+  if (!proto || proto === Object.prototype) return false;
+  if (!isFunction(thing.append)) return false;
+  const kind = kindOf(thing);
+  return (
+    kind === 'formdata' ||
+    // detect form-data instance
+    (kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]')
   );
 };
 
@@ -26094,7 +26530,7 @@ const isContextDefined = (context) => !isUndefined(context) && context !== _glob
  *
  * @returns {Object} Result of all merge properties
  */
-function merge(/* obj1, obj2, obj3, ... */) {
+function merge(...objs) {
   const { caseless, skipUndefined } = (isContextDefined(this) && this) || {};
   const result = {};
   const assignValue = (val, key) => {
@@ -26104,8 +26540,12 @@ function merge(/* obj1, obj2, obj3, ... */) {
     }
 
     const targetKey = (caseless && findKey(result, key)) || key;
-    if (isPlainObject(result[targetKey]) && isPlainObject(val)) {
-      result[targetKey] = merge(result[targetKey], val);
+    // Read via own-prop only — a bare `result[targetKey]` walks the prototype
+    // chain, so a polluted Object.prototype value could surface here and get
+    // copied into the merged result.
+    const existing = hasOwnProperty(result, targetKey) ? result[targetKey] : undefined;
+    if (isPlainObject(existing) && isPlainObject(val)) {
+      result[targetKey] = merge(existing, val);
     } else if (isPlainObject(val)) {
       result[targetKey] = merge({}, val);
     } else if (isArray(val)) {
@@ -26115,8 +26555,8 @@ function merge(/* obj1, obj2, obj3, ... */) {
     }
   };
 
-  for (let i = 0, l = arguments.length; i < l; i++) {
-    arguments[i] && forEach(arguments[i], assignValue);
+  for (let i = 0, l = objs.length; i < l; i++) {
+    objs[i] && forEach(objs[i], assignValue);
   }
   return result;
 }
@@ -26138,6 +26578,9 @@ const extend = (a, b, thisArg, { allOwnKeys } = {}) => {
     (val, key) => {
       if (thisArg && isFunction(val)) {
         Object.defineProperty(a, key, {
+          // Null-proto descriptor so a polluted Object.prototype.get cannot
+          // hijack defineProperty's accessor-vs-data resolution.
+          __proto__: null,
           value: (0,_helpers_bind_js__rspack_import_0["default"])(val, thisArg),
           writable: true,
           enumerable: true,
@@ -26145,6 +26588,7 @@ const extend = (a, b, thisArg, { allOwnKeys } = {}) => {
         });
       } else {
         Object.defineProperty(a, key, {
+          __proto__: null,
           value: val,
           writable: true,
           enumerable: true,
@@ -26183,12 +26627,14 @@ const stripBOM = (content) => {
 const inherits = (constructor, superConstructor, props, descriptors) => {
   constructor.prototype = Object.create(superConstructor.prototype, descriptors);
   Object.defineProperty(constructor.prototype, 'constructor', {
+    __proto__: null,
     value: constructor,
     writable: true,
     enumerable: false,
     configurable: true,
   });
   Object.defineProperty(constructor, 'super', {
+    __proto__: null,
     value: superConstructor.prototype,
   });
   props && Object.assign(constructor.prototype, props);
@@ -26370,7 +26816,7 @@ const reduceDescriptors = (obj, reducer) => {
 const freezeMethods = (obj) => {
   reduceDescriptors(obj, (descriptor, name) => {
     // skip restricted props in strict mode
-    if (isFunction(obj) && ['arguments', 'caller', 'callee'].indexOf(name) !== -1) {
+    if (isFunction(obj) && ['arguments', 'caller', 'callee'].includes(name)) {
       return false;
     }
 
@@ -26615,7 +27061,7 @@ const isIterable = (thing) => thing != null && isFunction(thing[iterator]);
 },
 8330(module) {
 "use strict";
-module.exports = JSON.parse('{"name":"apify-client","version":"2.23.2-beta.4","description":"Apify API client for JavaScript","main":"dist/index.js","module":"dist/index.mjs","types":"dist/index.d.ts","browser":"dist/bundle.js","unpkg":"dist/bundle.js","exports":{"./package.json":"./package.json","./browser":"./dist/bundle.js",".":{"import":"./dist/index.mjs","require":"./dist/index.js","types":"./dist/index.d.ts","browser":"./dist/bundle.js"}},"keywords":["apify","api","apifier","crawler","scraper"],"author":{"name":"Apify","email":"support@apify.com","url":"https://apify.com"},"contributors":["Jan Curn <jan@apify.com>","Marek Trunkát <marek@apify.com>","Ondra Urban <ondra@apify.com>","Jakub Drobník <jakub.drobnik@apify.com>"],"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/apify/apify-client-js"},"bugs":{"url":"https://github.com/apify/apify-client-js/issues"},"homepage":"https://docs.apify.com/api/client/js/","files":["dist","!dist/*.tsbuildinfo"],"scripts":{"build":"pnpm clean && pnpm build:node && pnpm build:browser","postbuild":"gen-esm-wrapper dist/index.js dist/index.mjs","prepublishOnly":"(test $CI || (echo \\"Publishing is reserved to CI!\\"; exit 1))","clean":"rimraf dist tsconfig.tsbuildinfo","test":"pnpm build && vitest run","test:bundling":"pnpm build && pnpm --prefix=./test/bundling run bundle:all","lint":"oxlint --type-aware","lint:fix":"oxlint --type-aware --fix","tsc-check-tests":"tsc --noEmit --project test/tsconfig.json","format":"oxfmt","format:check":"oxfmt --check","build:node":"tsc","build:browser":"rsbuild build","preinstall":"npx only-allow pnpm"},"dependencies":{"@apify/consts":"^2.50.0","@apify/log":"^2.2.6","@apify/utilities":"^2.23.2","@crawlee/types":"^3.3.0","ansi-colors":"^4.1.1","async-retry":"^1.3.3","axios":"^1.6.7","content-type":"^1.0.5","ow":"^0.28.2","proxy-agent":"^6.5.0","tslib":"^2.5.0","type-fest":"^4.0.0"},"devDependencies":{"@apify/oxlint-config":"^0.2.5","@apify/tsconfig":"^0.1.2","@crawlee/puppeteer":"^3.2.2","@rsbuild/core":"^1.3.6","@rsbuild/plugin-node-polyfill":"^1.3.0","@rspack/cli":"^1.7.6","@rspack/core":"^1.7.6","@types/async-retry":"^1.4.5","@types/compression":"^1.8.1","@types/content-type":"^1.1.5","@types/express":"^5.0.0","@types/node":"^24.0.0","ajv":"^8.17.1","body-parser":"^2.0.0","compression":"^1.7.4","esbuild":"0.27.4","express":"^5.0.0","gen-esm-wrapper":"^1.1.2","oxfmt":"0.46.0","oxlint":"1.62.0","oxlint-tsgolint":"0.22.0","puppeteer":"^24.0.0","rimraf":"^6.0.0","rolldown":"^1.0.0-rc.4","typescript":"^5.8.3","vitest":"^4.0.16","webpack":"^5.105.2","webpack-cli":"^7.0.0"},"packageManager":"pnpm@10.24.0"}')
+module.exports = JSON.parse('{"name":"apify-client","version":"2.23.2-beta.5","description":"Apify API client for JavaScript","main":"dist/index.js","module":"dist/index.mjs","types":"dist/index.d.ts","browser":"dist/bundle.js","unpkg":"dist/bundle.js","exports":{"./package.json":"./package.json","./browser":"./dist/bundle.js",".":{"import":"./dist/index.mjs","require":"./dist/index.js","types":"./dist/index.d.ts","browser":"./dist/bundle.js"}},"keywords":["apify","api","apifier","crawler","scraper"],"author":{"name":"Apify","email":"support@apify.com","url":"https://apify.com"},"contributors":["Jan Curn <jan@apify.com>","Marek Trunkát <marek@apify.com>","Ondra Urban <ondra@apify.com>","Jakub Drobník <jakub.drobnik@apify.com>"],"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/apify/apify-client-js"},"bugs":{"url":"https://github.com/apify/apify-client-js/issues"},"homepage":"https://docs.apify.com/api/client/js/","files":["dist","!dist/*.tsbuildinfo"],"scripts":{"build":"pnpm clean && pnpm build:node && pnpm build:browser","postbuild":"gen-esm-wrapper dist/index.js dist/index.mjs","prepublishOnly":"(test $CI || (echo \\"Publishing is reserved to CI!\\"; exit 1))","clean":"rimraf dist tsconfig.tsbuildinfo","test":"pnpm build && vitest run","test:bundling":"pnpm build && pnpm --prefix=./test/bundling run bundle:all","lint":"oxlint --type-aware","lint:fix":"oxlint --type-aware --fix","tsc-check-tests":"tsc --noEmit --project test/tsconfig.json","format":"oxfmt","format:check":"oxfmt --check","build:node":"tsc","build:browser":"rsbuild build","preinstall":"npx only-allow pnpm"},"dependencies":{"@apify/consts":"^2.50.0","@apify/log":"^2.2.6","@apify/utilities":"^2.23.2","@crawlee/types":"^3.3.0","ansi-colors":"^4.1.1","async-retry":"^1.3.3","axios":"^1.16.0","content-type":"^1.0.5","ow":"^0.28.2","proxy-agent":"^6.5.0","tslib":"^2.5.0","type-fest":"^4.0.0"},"devDependencies":{"@apify/oxlint-config":"^0.2.5","@apify/tsconfig":"^0.1.2","@crawlee/puppeteer":"^3.2.2","@rsbuild/core":"^1.3.6","@rsbuild/plugin-node-polyfill":"^1.3.0","@rspack/cli":"^1.7.6","@rspack/core":"^1.7.6","@types/async-retry":"^1.4.5","@types/compression":"^1.8.1","@types/content-type":"^1.1.5","@types/express":"^5.0.0","@types/node":"^24.0.0","ajv":"^8.17.1","body-parser":"^2.0.0","compression":"^1.7.4","esbuild":"0.27.4","express":"^5.0.0","gen-esm-wrapper":"^1.1.2","oxfmt":"0.46.0","oxlint":"1.62.0","oxlint-tsgolint":"0.22.0","puppeteer":"^24.0.0","rimraf":"^6.0.0","rolldown":"^1.0.0-rc.4","typescript":"^5.8.3","vitest":"^4.0.16","webpack":"^5.105.2","webpack-cli":"^7.0.0"},"packageManager":"pnpm@10.24.0"}')
 
 },