apify-client 2.23.5-beta.32 → 2.23.5-beta.34

package/dist/bundle.js

@@ -18122,7 +18122,7 @@ function isStream(value) {
 function getVersionData() {
     if (true) {
         return {
-            version: "2.23.5-beta.32"
+            version: "2.23.5-beta.34"
         };
     }
     // eslint-disable-next-line
@@ -22098,11 +22098,11 @@ __webpack_require__.r(__webpack_exports__);
 /* import */ var _utils_js__rspack_import_0 = __webpack_require__(7275);
 /* import */ var _core_AxiosError_js__rspack_import_2 = __webpack_require__(4062);
 /* import */ var _helpers_composeSignals_js__rspack_import_4 = __webpack_require__(2723);
-/* import */ var _helpers_trackStream_js__rspack_import_7 = __webpack_require__(1791);
-/* import */ var _core_AxiosHeaders_js__rspack_import_11 = __webpack_require__(7110);
-/* import */ var _helpers_progressEventReducer_js__rspack_import_6 = __webpack_require__(7837);
+/* import */ var _helpers_trackStream_js__rspack_import_6 = __webpack_require__(1791);
+/* import */ var _core_AxiosHeaders_js__rspack_import_10 = __webpack_require__(7110);
+/* import */ var _helpers_progressEventReducer_js__rspack_import_7 = __webpack_require__(7837);
 /* import */ var _helpers_resolveConfig_js__rspack_import_3 = __webpack_require__(8382);
-/* import */ var _core_settle_js__rspack_import_10 = __webpack_require__(3853);
+/* import */ var _core_settle_js__rspack_import_11 = __webpack_require__(3853);
 /* import */ var _helpers_estimateDataURLDecodedBytes_js__rspack_import_5 = __webpack_require__(1526);
 /* import */ var _env_data_js__rspack_import_8 = __webpack_require__(9888);
 /* import */ var _helpers_sanitizeHeaderValue_js__rspack_import_9 = __webpack_require__(8267);
@@ -22338,14 +22338,28 @@ const factory = (env) => {
 
     let requestContentLength;
 
+    // AxiosError we raise while the request body is being streamed. Captured
+    // by identity so the catch block can surface it directly, regardless of
+    // how the runtime wraps the resulting fetch rejection (undici exposes it
+    // as `err.cause`; some browsers drop the original error entirely).
+    let pendingBodyError = null;
+
+    const maxBodyLengthError = () =>
+      new _core_AxiosError_js__rspack_import_2["default"](
+        'Request body larger than maxBodyLength limit',
+        _core_AxiosError_js__rspack_import_2["default"].ERR_BAD_REQUEST,
+        config,
+        request
+      );
+
     try {
       // HTTP basic authentication
       let auth = undefined;
       const configAuth = own('auth');
 
       if (configAuth) {
-        const username = configAuth.username || '';
-        const password = configAuth.password || '';
+        const username = _utils_js__rspack_import_0["default"].getSafeProp(configAuth, 'username') || '';
+        const password = _utils_js__rspack_import_0["default"].getSafeProp(configAuth, 'password') || '';
         auth = {
           username,
           password
@@ -22394,53 +22408,96 @@ const factory = (env) => {
         }
       }
 
-      // Enforce maxBodyLength against the outbound request body before dispatch.
-      // Mirrors http.js behavior (ERR_BAD_REQUEST / 'Request body larger than
-      // maxBodyLength limit'). Skip when the body length cannot be determined
-      // (e.g. a live ReadableStream supplied by the caller).
+      // Enforce maxBodyLength against known-size bodies before dispatch using
+      // the body's *actual* size — never a caller-declared Content-Length,
+      // which could under-report to slip an oversized body past the check.
+      // Unknown-size streams return undefined here and are counted per-chunk
+      // below as fetch consumes them.
       if (hasMaxBodyLength && method !== 'get' && method !== 'head') {
-        const outboundLength = await resolveBodyLength(headers, data);
-        if (
-          typeof outboundLength === 'number' &&
-          isFinite(outboundLength) &&
-          outboundLength > maxBodyLength
-        ) {
-          throw new _core_AxiosError_js__rspack_import_2["default"](
-            'Request body larger than maxBodyLength limit',
-            _core_AxiosError_js__rspack_import_2["default"].ERR_BAD_REQUEST,
-            config,
-            request
-          );
+        const outboundLength = await getBodyLength(data);
+        if (typeof outboundLength === 'number' && isFinite(outboundLength)) {
+          requestContentLength = outboundLength;
+          if (outboundLength > maxBodyLength) {
+            throw maxBodyLengthError();
+          }
         }
       }
 
+      // A streamed body under maxBodyLength must be counted as fetch consumes
+      // it; its size is never trusted from a caller-declared Content-Length.
+      const mustEnforceStreamBody =
+        hasMaxBodyLength && (_utils_js__rspack_import_0["default"].isReadableStream(data) || _utils_js__rspack_import_0["default"].isStream(data));
+
+      const trackRequestStream = (stream, onProgress, flush) =>
+        (0,_helpers_trackStream_js__rspack_import_6.trackStream)(
+          stream,
+          DEFAULT_CHUNK_SIZE,
+          (loadedBytes) => {
+            if (hasMaxBodyLength && loadedBytes > maxBodyLength) {
+              throw (pendingBodyError = maxBodyLengthError());
+            }
+            onProgress && onProgress(loadedBytes);
+          },
+          flush
+        );
+
       if (
-        onUploadProgress &&
         supportsRequestStream &&
         method !== 'get' &&
         method !== 'head' &&
-        (requestContentLength = await resolveBodyLength(headers, data)) !== 0
+        (onUploadProgress || mustEnforceStreamBody)
       ) {
-        let _request = new Request(url, {
-          method: 'POST',
-          body: data,
-          duplex: 'half',
-        });
+        requestContentLength =
+          requestContentLength == null ? await resolveBodyLength(headers, data) : requestContentLength;
+
+        // A declared length of 0 is only trusted to skip the wrap when we are
+        // not enforcing a stream limit (which must not rely on that header).
+        if (requestContentLength !== 0 || mustEnforceStreamBody) {
+          let _request = new Request(url, {
+            method: 'POST',
+            body: data,
+            duplex: 'half',
+          });
 
-        let contentTypeHeader;
+          let contentTypeHeader;
 
-        if (_utils_js__rspack_import_0["default"].isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) {
-          headers.setContentType(contentTypeHeader);
-        }
+          if (_utils_js__rspack_import_0["default"].isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) {
+            headers.setContentType(contentTypeHeader);
+          }
 
-        if (_request.body) {
-          const [onProgress, flush] = (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventDecorator)(
-            requestContentLength,
-            (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_6.asyncDecorator)(onUploadProgress))
-          );
+          if (_request.body) {
+            const [onProgress, flush] =
+              (onUploadProgress &&
+                (0,_helpers_progressEventReducer_js__rspack_import_7.progressEventDecorator)(
+                  requestContentLength,
+                  (0,_helpers_progressEventReducer_js__rspack_import_7.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_7.asyncDecorator)(onUploadProgress))
+                )) ||
+              [];
 
-          data = (0,_helpers_trackStream_js__rspack_import_7.trackStream)(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush);
+            data = trackRequestStream(_request.body, onProgress, flush);
+          }
         }
+      } else if (
+        mustEnforceStreamBody &&
+        !isRequestSupported &&
+        isReadableStreamSupported &&
+        method !== 'get' &&
+        method !== 'head'
+      ) {
+        data = trackRequestStream(data);
+      } else if (
+        mustEnforceStreamBody &&
+        isRequestSupported &&
+        !supportsRequestStream &&
+        method !== 'get' &&
+        method !== 'head'
+      ) {
+        throw new _core_AxiosError_js__rspack_import_2["default"](
+          'Stream request bodies are not supported by the current fetch implementation',
+          _core_AxiosError_js__rspack_import_2["default"].ERR_NOT_SUPPORT,
+          config,
+          request
+        );
       }
 
       if (!_utils_js__rspack_import_0["default"].isString(withCredentials)) {
@@ -22483,10 +22540,12 @@ const factory = (env) => {
         ? _fetch(request, fetchOptions)
         : _fetch(url, resolvedOptions));
 
+      const responseHeaders = _core_AxiosHeaders_js__rspack_import_10["default"].from(response.headers);
+
       // Cheap pre-check: if the server honestly declares a content-length that
       // already exceeds the cap, reject before we start streaming.
       if (hasMaxContentLength) {
-        const declaredLength = _utils_js__rspack_import_0["default"].toFiniteNumber(response.headers.get('content-length'));
+        const declaredLength = _utils_js__rspack_import_0["default"].toFiniteNumber(responseHeaders.getContentLength());
         if (declaredLength != null && declaredLength > maxContentLength) {
           throw new _core_AxiosError_js__rspack_import_2["default"](
             'maxContentLength size of ' + maxContentLength + ' exceeded',
@@ -22511,13 +22570,13 @@ const factory = (env) => {
           options[prop] = response[prop];
         });
 
-        const responseContentLength = _utils_js__rspack_import_0["default"].toFiniteNumber(response.headers.get('content-length'));
+        const responseContentLength = _utils_js__rspack_import_0["default"].toFiniteNumber(responseHeaders.getContentLength());
 
         const [onProgress, flush] =
           (onDownloadProgress &&
-            (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventDecorator)(
+            (0,_helpers_progressEventReducer_js__rspack_import_7.progressEventDecorator)(
               responseContentLength,
-              (0,_helpers_progressEventReducer_js__rspack_import_6.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_6.asyncDecorator)(onDownloadProgress), true)
+              (0,_helpers_progressEventReducer_js__rspack_import_7.progressEventReducer)((0,_helpers_progressEventReducer_js__rspack_import_7.asyncDecorator)(onDownloadProgress), true)
             )) ||
           [];
 
@@ -22538,7 +22597,7 @@ const factory = (env) => {
         };
 
         response = new Response(
-          (0,_helpers_trackStream_js__rspack_import_7.trackStream)(response.body, DEFAULT_CHUNK_SIZE, onChunkProgress, () => {
+          (0,_helpers_trackStream_js__rspack_import_6.trackStream)(response.body, DEFAULT_CHUNK_SIZE, onChunkProgress, () => {
             flush && flush();
             unsubscribe && unsubscribe();
           }),
@@ -22583,9 +22642,9 @@ const factory = (env) => {
       !isStreamResponse && unsubscribe && unsubscribe();
 
       return await new Promise((resolve, reject) => {
-        (0,_core_settle_js__rspack_import_10["default"])(resolve, reject, {
+        (0,_core_settle_js__rspack_import_11["default"])(resolve, reject, {
           data: responseData,
-          headers: _core_AxiosHeaders_js__rspack_import_11["default"].from(response.headers),
+          headers: _core_AxiosHeaders_js__rspack_import_10["default"].from(response.headers),
           status: response.status,
           statusText: response.statusText,
           config,
@@ -22606,6 +22665,23 @@ const factory = (env) => {
         throw canceledError;
       }
 
+      // Surface a maxBodyLength violation we raised while the request body was
+      // being streamed. Matching by identity (rather than reading
+      // `err.cause.isAxiosError`) keeps the error deterministic across runtimes
+      // and avoids both prototype-pollution reads and mis-attributing a foreign
+      // AxiosError that merely happened to land in `err.cause`.
+      if (pendingBodyError) {
+        request && !pendingBodyError.request && (pendingBodyError.request = request);
+        throw pendingBodyError;
+      }
+
+      // Re-throw AxiosErrors we raised synchronously (data: URL / content-length
+      // pre-checks, response size enforcement) without re-wrapping them.
+      if (err instanceof _core_AxiosError_js__rspack_import_2["default"]) {
+        request && !err.request && (err.request = request);
+        throw err;
+      }
+
       if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) {
         throw Object.assign(
           new _core_AxiosError_js__rspack_import_2["default"](
@@ -23341,6 +23417,7 @@ class Axios {
           clarifyTimeoutError: validators.transitional(validators.boolean),
           legacyInterceptorReqResOrdering: validators.transitional(validators.boolean),
           advertiseZstdAcceptEncoding: validators.transitional(validators.boolean),
+          validateStatusUndefinedResolves: validators.transitional(validators.boolean),
         },
         false
       );
@@ -23472,7 +23549,7 @@ class Axios {
 
   getUri(config) {
     config = (0,_mergeConfig_js__rspack_import_2["default"])(this.defaults, config);
-    const fullPath = (0,_buildFullPath_js__rspack_import_7["default"])(config.baseURL, config.url, config.allowAbsoluteUrls);
+    const fullPath = (0,_buildFullPath_js__rspack_import_7["default"])(config.baseURL, config.url, config.allowAbsoluteUrls, config);
     return (0,_helpers_buildURL_js__rspack_import_8["default"])(fullPath, config.params, config.paramsSerializer);
   }
 }
@@ -23485,7 +23562,7 @@ _utils_js__rspack_import_3["default"].forEach(['delete', 'get', 'head', 'options
       (0,_mergeConfig_js__rspack_import_2["default"])(config || {}, {
         method,
         url,
-        data: (config || {}).data,
+        data: config && _utils_js__rspack_import_3["default"].hasOwnProp(config, 'data') ? config.data : undefined,
       })
     );
   };
@@ -23835,8 +23912,8 @@ class AxiosHeaders {
       setHeaders(header, valueOrRewrite);
     } else if (_utils_js__rspack_import_0["default"].isString(header) && (header = header.trim()) && !isValidHeaderName(header)) {
       setHeaders((0,_helpers_parseHeaders_js__rspack_import_2["default"])(header), valueOrRewrite);
-    } else if (_utils_js__rspack_import_0["default"].isObject(header) && _utils_js__rspack_import_0["default"].isIterable(header)) {
-      let obj = {},
+    } else if (_utils_js__rspack_import_0["default"].isObject(header) && _utils_js__rspack_import_0["default"].isSafeIterable(header)) {
+      let obj = Object.create(null),
         dest,
         key;
       for (const entry of header) {
@@ -23844,11 +23921,14 @@ class AxiosHeaders {
           throw new TypeError('Object iterator must return a key-value pair');
         }
 
-        obj[(key = entry[0])] = (dest = obj[key])
-          ? _utils_js__rspack_import_0["default"].isArray(dest)
-            ? [...dest, entry[1]]
-            : [dest, entry[1]]
-          : entry[1];
+        key = entry[0];
+
+        if (_utils_js__rspack_import_0["default"].hasOwnProp(obj, key)) {
+          dest = obj[key];
+          obj[key] = _utils_js__rspack_import_0["default"].isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]];
+        } else {
+          obj[key] = entry[1];
+        }
       }
 
       setHeaders(obj, valueOrRewrite);
@@ -24165,12 +24245,39 @@ __webpack_require__.d(__webpack_exports__, {
 8262(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 "use strict";
 __webpack_require__.r(__webpack_exports__);
-/* import */ var _helpers_isAbsoluteURL_js__rspack_import_0 = __webpack_require__(9034);
-/* import */ var _helpers_combineURLs_js__rspack_import_1 = __webpack_require__(6787);
+/* import */ var _AxiosError_js__rspack_import_0 = __webpack_require__(4062);
+/* import */ var _helpers_isAbsoluteURL_js__rspack_import_1 = __webpack_require__(9034);
+/* import */ var _helpers_combineURLs_js__rspack_import_2 = __webpack_require__(6787);
+
+
 
 
 
 
+const malformedHttpProtocol = /^https?:(?!\/\/)/i;
+const httpProtocolControlCharacters = /[\t\n\r]/g;
+
+function stripLeadingC0ControlOrSpace(url) {
+  let i = 0;
+  while (i < url.length && url.charCodeAt(i) <= 0x20) {
+    i++;
+  }
+  return url.slice(i);
+}
+
+function normalizeURLForProtocolCheck(url) {
+  return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, '');
+}
+
+function assertValidHttpProtocolURL(url, config) {
+  if (typeof url === 'string' && malformedHttpProtocol.test(normalizeURLForProtocolCheck(url))) {
+    throw new _AxiosError_js__rspack_import_0["default"](
+      'Invalid URL: missing "//" after protocol',
+      _AxiosError_js__rspack_import_0["default"].ERR_INVALID_URL,
+      config
+    );
+  }
+}
 
 /**
  * Creates a new URL by combining the baseURL with the requestedURL,
@@ -24182,10 +24289,12 @@ __webpack_require__.r(__webpack_exports__);
  *
  * @returns {string} The combined full path
  */
-function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
-  let isRelativeUrl = !(0,_helpers_isAbsoluteURL_js__rspack_import_0["default"])(requestedURL);
+function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {
+  assertValidHttpProtocolURL(requestedURL, config);
+  let isRelativeUrl = !(0,_helpers_isAbsoluteURL_js__rspack_import_1["default"])(requestedURL);
   if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
-    return (0,_helpers_combineURLs_js__rspack_import_1["default"])(baseURL, requestedURL);
+    assertValidHttpProtocolURL(baseURL, config);
+    return (0,_helpers_combineURLs_js__rspack_import_2["default"])(baseURL, requestedURL);
   }
   return requestedURL;
 }
@@ -24376,6 +24485,28 @@ function mergeConfig(config1, config2) {
     }
   }
 
+  function getMergedTransitionalOption(prop) {
+    const transitional2 = _utils_js__rspack_import_1["default"].hasOwnProp(config2, 'transitional') ? config2.transitional : undefined;
+
+    if (!_utils_js__rspack_import_1["default"].isUndefined(transitional2)) {
+      if (_utils_js__rspack_import_1["default"].isPlainObject(transitional2)) {
+        if (_utils_js__rspack_import_1["default"].hasOwnProp(transitional2, prop)) {
+          return transitional2[prop];
+        }
+      } else {
+        return undefined;
+      }
+    }
+
+    const transitional1 = _utils_js__rspack_import_1["default"].hasOwnProp(config1, 'transitional') ? config1.transitional : undefined;
+
+    if (_utils_js__rspack_import_1["default"].isPlainObject(transitional1) && _utils_js__rspack_import_1["default"].hasOwnProp(transitional1, prop)) {
+      return transitional1[prop];
+    }
+
+    return undefined;
+  }
+
   // eslint-disable-next-line consistent-return
   function mergeDirectKeys(a, b, prop) {
     if (_utils_js__rspack_import_1["default"].hasOwnProp(config2, prop)) {
@@ -24428,6 +24559,18 @@ function mergeConfig(config1, config2) {
     (_utils_js__rspack_import_1["default"].isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
   });
 
+  if (
+    _utils_js__rspack_import_1["default"].hasOwnProp(config2, 'validateStatus') &&
+    _utils_js__rspack_import_1["default"].isUndefined(config2.validateStatus) &&
+    getMergedTransitionalOption('validateStatusUndefinedResolves') === false
+  ) {
+    if (_utils_js__rspack_import_1["default"].hasOwnProp(config1, 'validateStatus')) {
+      config.validateStatus = getMergedValue(undefined, config1.validateStatus);
+    } else {
+      delete config.validateStatus;
+    }
+  }
+
   return config;
 }
 
@@ -24722,6 +24865,7 @@ __webpack_require__.r(__webpack_exports__);
   clarifyTimeoutError: false,
   legacyInterceptorReqResOrdering: true,
   advertiseZstdAcceptEncoding: false,
+  validateStatusUndefinedResolves: true,
 });
 
 __webpack_require__.d(__webpack_exports__, {
@@ -24734,7 +24878,7 @@ __webpack_require__.d(__webpack_exports__, {
 9888(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 "use strict";
 __webpack_require__.r(__webpack_exports__);
-const VERSION = "1.17.0";
+const VERSION = "1.18.0";
 __webpack_require__.d(__webpack_exports__, {
 }, {
   VERSION: VERSION
@@ -24967,15 +25111,17 @@ function buildURL(url, params, options) {
     return url;
   }
 
-  const _encode = (options && options.encode) || encode;
-
   const _options = _utils_js__rspack_import_0["default"].isFunction(options)
     ? {
         serialize: options,
       }
     : options;
 
-  const serializeFn = _options && _options.serialize;
+  // Read serializer options pollution-safely: own properties and methods on a
+  // class/template prototype are honored, but values injected onto a polluted
+  // Object.prototype are ignored.
+  const _encode = _utils_js__rspack_import_0["default"].getSafeProp(_options, 'encode') || encode;
+  const serializeFn = _utils_js__rspack_import_0["default"].getSafeProp(_options, 'serialize');
 
   let serializedParams;
 
@@ -25178,16 +25324,23 @@ __webpack_require__.d(__webpack_exports__, {
 1526(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 "use strict";
 __webpack_require__.r(__webpack_exports__);
-/* provided dependency */ var Buffer = __webpack_require__(8287).Buffer;
 /**
  * Estimate decoded byte length of a data:// URL *without* allocating large buffers.
  * - For base64: compute exact decoded size using length and padding;
  *               handle %XX at the character-count level (no string allocation).
- * - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound.
+ * - For non-base64: compute the exact percent-decoded UTF-8 byte length.
  *
  * @param {string} url
  * @returns {number}
  */
+const isHexDigit = (charCode) =>
+  (charCode >= 48 && charCode <= 57) ||
+  (charCode >= 65 && charCode <= 70) ||
+  (charCode >= 97 && charCode <= 102);
+
+const isPercentEncodedByte = (str, i, len) =>
+  i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2));
+
 function estimateDataURLDecodedBytes(url) {
   if (!url || typeof url !== 'string') return 0;
   if (!url.startsWith('data:')) return 0;
@@ -25207,9 +25360,7 @@ function estimateDataURLDecodedBytes(url) {
       if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) {
         const a = body.charCodeAt(i + 1);
         const b = body.charCodeAt(i + 2);
-        const isHex =
-          ((a >= 48 && a <= 57) || (a >= 65 && a <= 70) || (a >= 97 && a <= 102)) &&
-          ((b >= 48 && b <= 57) || (b >= 65 && b <= 70) || (b >= 97 && b <= 102));
+        const isHex = isHexDigit(a) && isHexDigit(b);
 
         if (isHex) {
           effectiveLen -= 2;
@@ -25250,18 +25401,17 @@ function estimateDataURLDecodedBytes(url) {
     return bytes > 0 ? bytes : 0;
   }
 
-  if (typeof Buffer !== 'undefined' && typeof Buffer.byteLength === 'function') {
-    return Buffer.byteLength(body, 'utf8');
-  }
-
   // Compute UTF-8 byte length directly from UTF-16 code units without allocating
   // a byte buffer (TextEncoder.encode would defeat the DoS guard on large bodies).
-  // Using body.length here would undercount non-ASCII (e.g. '€' is 1 code unit
-  // but 3 UTF-8 bytes).
+  // Valid %XX triplets count as one decoded byte; this matches the bytes that
+  // decodeURIComponent(body) would produce before Buffer re-encodes the string.
   let bytes = 0;
   for (let i = 0, len = body.length; i < len; i++) {
     const c = body.charCodeAt(i);
-    if (c < 0x80) {
+    if (c === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) {
+      bytes += 1;
+      i += 2;
+    } else if (c < 0x80) {
       bytes += 1;
     } else if (c < 0x800) {
       bytes += 2;
@@ -25289,10 +25439,25 @@ __webpack_require__.d(__webpack_exports__, {
 7887(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 "use strict";
 __webpack_require__.r(__webpack_exports__);
-/* import */ var _utils_js__rspack_import_0 = __webpack_require__(7275);
+/* import */ var _utils_js__rspack_import_2 = __webpack_require__(7275);
+/* import */ var _core_AxiosError_js__rspack_import_1 = __webpack_require__(4062);
+/* import */ var _toFormData_js__rspack_import_0 = __webpack_require__(665);
+
+
+
 
 
 
+const MAX_DEPTH = _toFormData_js__rspack_import_0.DEFAULT_FORM_DATA_MAX_DEPTH;
+
+function throwIfDepthExceeded(index) {
+  if (index > MAX_DEPTH) {
+    throw new _core_AxiosError_js__rspack_import_1["default"](
+      'FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH,
+      _core_AxiosError_js__rspack_import_1["default"].ERR_FORM_DATA_DEPTH_EXCEEDED
+    );
+  }
+}
 
 /**
  * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z']
@@ -25306,9 +25471,16 @@ function parsePropPath(name) {
   // foo.x.y.z
   // foo-x-y-z
   // foo x y z
-  return _utils_js__rspack_import_0["default"].matchAll(/\w+|\[(\w*)]/g, name).map((match) => {
-    return match[0] === '[]' ? '' : match[1] || match[0];
-  });
+  const path = [];
+  const pattern = /\w+|\[(\w*)]/g;
+  let match;
+
+  while ((match = pattern.exec(name)) !== null) {
+    throwIfDepthExceeded(path.length);
+    path.push(match[0] === '[]' ? '' : match[1] || match[0]);
+  }
+
+  return path;
 }
 
 /**
@@ -25340,17 +25512,19 @@ function arrayToObject(arr) {
  */
 function formDataToJSON(formData) {
   function buildPath(path, value, target, index) {
+    throwIfDepthExceeded(index);
+
     let name = path[index++];
 
     if (name === '__proto__') return true;
 
     const isNumericKey = Number.isFinite(+name);
     const isLast = index >= path.length;
-    name = !name && _utils_js__rspack_import_0["default"].isArray(target) ? target.length : name;
+    name = !name && _utils_js__rspack_import_2["default"].isArray(target) ? target.length : name;
 
     if (isLast) {
-      if (_utils_js__rspack_import_0["default"].hasOwnProp(target, name)) {
-        target[name] = _utils_js__rspack_import_0["default"].isArray(target[name])
+      if (_utils_js__rspack_import_2["default"].hasOwnProp(target, name)) {
+        target[name] = _utils_js__rspack_import_2["default"].isArray(target[name])
           ? target[name].concat(value)
           : [target[name], value];
       } else {
@@ -25360,23 +25534,23 @@ function formDataToJSON(formData) {
       return !isNumericKey;
     }
 
-    if (!_utils_js__rspack_import_0["default"].hasOwnProp(target, name) || !_utils_js__rspack_import_0["default"].isObject(target[name])) {
+    if (!_utils_js__rspack_import_2["default"].hasOwnProp(target, name) || !_utils_js__rspack_import_2["default"].isObject(target[name])) {
       target[name] = [];
     }
 
     const result = buildPath(path, value, target[name], index);
 
-    if (result && _utils_js__rspack_import_0["default"].isArray(target[name])) {
+    if (result && _utils_js__rspack_import_2["default"].isArray(target[name])) {
       target[name] = arrayToObject(target[name]);
     }
 
     return !isNumericKey;
   }
 
-  if (_utils_js__rspack_import_0["default"].isFormData(formData) && _utils_js__rspack_import_0["default"].isFunction(formData.entries)) {
+  if (_utils_js__rspack_import_2["default"].isFormData(formData) && _utils_js__rspack_import_2["default"].isFunction(formData.entries)) {
     const obj = {};
 
-    _utils_js__rspack_import_0["default"].forEachEntry(formData, (name, value) => {
+    _utils_js__rspack_import_2["default"].forEachEntry(formData, (name, value) => {
       buildPath(parsePropPath(name), value, obj, 0);
     });
 
@@ -25725,17 +25899,19 @@ function resolveConfig(config) {
   newConfig.headers = headers = _core_AxiosHeaders_js__rspack_import_2["default"].from(headers);
 
   newConfig.url = (0,_buildURL_js__rspack_import_3["default"])(
-    (0,_core_buildFullPath_js__rspack_import_4["default"])(baseURL, url, allowAbsoluteUrls),
+    (0,_core_buildFullPath_js__rspack_import_4["default"])(baseURL, url, allowAbsoluteUrls, newConfig),
     own('params'),
     own('paramsSerializer')
   );
 
   // HTTP basic authentication
   if (auth) {
+    const username = _utils_js__rspack_import_1["default"].getSafeProp(auth, 'username') || '';
+    const password = _utils_js__rspack_import_1["default"].getSafeProp(auth, 'password') || '';
+
     headers.set(
       'Authorization',
-      'Basic ' +
-        btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
+      'Basic ' + btoa(username + ':' + (password ? encodeUTF8(password) : ''))
     );
   }
 
@@ -26035,6 +26211,10 @@ __webpack_require__.r(__webpack_exports__);
 // temporary hotfix to avoid circular references until AxiosURLSearchParams is refactored
 
 
+// Default nesting limit shared with the inverse transform (formDataToJSON) so
+// the FormData <-> JSON round-trip stays symmetric.
+const DEFAULT_FORM_DATA_MAX_DEPTH = 100;
+
 /**
  * Determines if the given thing is a array or js object.
  *
@@ -26145,8 +26325,9 @@ function toFormData(obj, formData, options) {
   const dots = options.dots;
   const indexes = options.indexes;
   const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
-  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
+  const maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;
   const useBlob = _Blob && _utils_js__rspack_import_0["default"].isSpecCompliantForm(formData);
+  const stack = [];
 
   if (!_utils_js__rspack_import_0["default"].isFunction(visitor)) {
     throw new TypeError('visitor must be a function');
@@ -26174,6 +26355,38 @@ function toFormData(obj, formData, options) {
     return value;
   }
 
+  function throwIfMaxDepthExceeded(depth) {
+    if (depth > maxDepth) {
+      throw new _core_AxiosError_js__rspack_import_2["default"](
+        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+        _core_AxiosError_js__rspack_import_2["default"].ERR_FORM_DATA_DEPTH_EXCEEDED
+      );
+    }
+  }
+
+  function stringifyWithDepthLimit(value, depth) {
+    if (maxDepth === Infinity) {
+      return JSON.stringify(value);
+    }
+
+    const ancestors = [];
+
+    return JSON.stringify(value, function limitDepth(_key, currentValue) {
+      if (!_utils_js__rspack_import_0["default"].isObject(currentValue)) {
+        return currentValue;
+      }
+
+      while (ancestors.length && ancestors[ancestors.length - 1] !== this) {
+        ancestors.pop();
+      }
+
+      ancestors.push(currentValue);
+      throwIfMaxDepthExceeded(depth + ancestors.length - 1);
+
+      return currentValue;
+    });
+  }
+
   /**
    * Default visitor.
    *
@@ -26197,7 +26410,7 @@ function toFormData(obj, formData, options) {
         // eslint-disable-next-line no-param-reassign
         key = metaTokens ? key : key.slice(0, -2);
         // eslint-disable-next-line no-param-reassign
-        value = JSON.stringify(value);
+        value = stringifyWithDepthLimit(value, 1);
       } else if (
         (_utils_js__rspack_import_0["default"].isArray(value) && isFlatArray(value)) ||
         ((_utils_js__rspack_import_0["default"].isFileList(value) || _utils_js__rspack_import_0["default"].endsWith(key, '[]')) && (arr = _utils_js__rspack_import_0["default"].toArray(value)))
@@ -26230,8 +26443,6 @@ function toFormData(obj, formData, options) {
     return false;
   }
 
-  const stack = [];
-
   const exposedHelpers = Object.assign(predicates, {
     defaultVisitor,
     convertValue,
@@ -26241,12 +26452,7 @@ function toFormData(obj, formData, options) {
   function build(value, path, depth = 0) {
     if (_utils_js__rspack_import_0["default"].isUndefined(value)) return;
 
-    if (depth > maxDepth) {
-      throw new _core_AxiosError_js__rspack_import_2["default"](
-        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
-        _core_AxiosError_js__rspack_import_2["default"].ERR_FORM_DATA_DEPTH_EXCEEDED
-      );
-    }
+    throwIfMaxDepthExceeded(depth);
 
     if (stack.indexOf(value) !== -1) {
       throw new Error('Circular reference detected in ' + path.join('.'));
@@ -26280,6 +26486,7 @@ function toFormData(obj, formData, options) {
 
 __webpack_require__.d(__webpack_exports__, {
 }, {
+  DEFAULT_FORM_DATA_MAX_DEPTH: DEFAULT_FORM_DATA_MAX_DEPTH,
   "default": __rspack_default_export
 });
 
@@ -26711,6 +26918,57 @@ const { toString } = Object.prototype;
 const { getPrototypeOf } = Object;
 const { iterator, toStringTag } = Symbol;
 
+/* Creating a function that will check if an object has a property. */
+const hasOwnProperty = (
+  ({ hasOwnProperty }) =>
+  (obj, prop) =>
+    hasOwnProperty.call(obj, prop)
+)(Object.prototype);
+
+/**
+ * Walk the prototype chain (excluding the shared Object.prototype) looking for
+ * an own `prop`. This distinguishes genuine own/inherited members — including
+ * class accessors and template prototypes — from members injected via
+ * Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which
+ * live on Object.prototype itself and are therefore never matched.
+ *
+ * @param {*} thing The value whose chain to inspect
+ * @param {string|symbol} prop The property key to look for
+ *
+ * @returns {boolean} True when `prop` is owned below Object.prototype
+ */
+const hasOwnInPrototypeChain = (thing, prop) => {
+  let obj = thing;
+  const seen = [];
+
+  while (obj != null && obj !== Object.prototype) {
+    if (seen.indexOf(obj) !== -1) {
+      return false;
+    }
+    seen.push(obj);
+
+    if (hasOwnProperty(obj, prop)) {
+      return true;
+    }
+    obj = getPrototypeOf(obj);
+  }
+  return false;
+};
+
+/**
+ * Read `obj[prop]` only when it is safe from Object.prototype pollution. Own
+ * properties and members inherited from a non-Object.prototype source (a class
+ * instance or template object) are honored; a value reachable only through a
+ * polluted Object.prototype is ignored and `undefined` is returned.
+ *
+ * @param {*} obj The source object
+ * @param {string|symbol} prop The property key to read
+ *
+ * @returns {*} The resolved value, or undefined when unsafe/absent
+ */
+const getSafeProp = (obj, prop) =>
+  obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : undefined;
+
 const kindOf = ((cache) => (thing) => {
   const str = toString.call(thing);
   return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase());
@@ -26836,7 +27094,7 @@ const isBoolean = (thing) => thing === true || thing === false;
  * @returns {boolean} True if value is a plain Object, otherwise false
  */
 const isPlainObject = (val) => {
-  if (kindOf(val) !== 'object') {
+  if (!isObject(val)) {
     return false;
   }
 
@@ -26844,9 +27102,12 @@ const isPlainObject = (val) => {
   return (
     (prototype === null ||
       prototype === Object.prototype ||
-      Object.getPrototypeOf(prototype) === null) &&
-    !(toStringTag in val) &&
-    !(iterator in val)
+      getPrototypeOf(prototype) === null) &&
+    // Treat any genuine (non-Object.prototype-polluted) Symbol.toStringTag or
+    // Symbol.iterator as evidence the value is a tagged/iterable type rather
+    // than a plain object, while ignoring keys injected onto Object.prototype.
+    !hasOwnInPrototypeChain(val, toStringTag) &&
+    !hasOwnInPrototypeChain(val, iterator)
   );
 };
 
@@ -27373,13 +27634,6 @@ const toCamelCase = (str) => {
   });
 };
 
-/* Creating a function that will check if an object has a property. */
-const hasOwnProperty = (
-  ({ hasOwnProperty }) =>
-  (obj, prop) =>
-    hasOwnProperty.call(obj, prop)
-)(Object.prototype);
-
 const { propertyIsEnumerable } = Object.prototype;
 
 /**
@@ -27593,6 +27847,20 @@ const asap =
 
 const isIterable = (thing) => thing != null && isFunction(thing[iterator]);
 
+/**
+ * Determine if a value is iterable via an iterator that is NOT sourced solely
+ * from a polluted Object.prototype. Use this instead of `isIterable` whenever
+ * the iterable comes from untrusted input (e.g. user-supplied header sources),
+ * so `Object.prototype[Symbol.iterator] = ...` cannot turn an ordinary object
+ * into an attacker-controlled entries iterator.
+ *
+ * @param {*} thing The value to test
+ *
+ * @returns {boolean} True if value has a non-polluted iterator
+ */
+const isSafeIterable = (thing) =>
+  thing != null && hasOwnInPrototypeChain(thing, iterator) && isIterable(thing);
+
 /* export default */ const __rspack_default_export = ({
   isArray,
   isArrayBuffer,
@@ -27637,6 +27905,8 @@ const isIterable = (thing) => thing != null && isFunction(thing[iterator]);
   isHTMLForm,
   hasOwnProperty,
   hasOwnProp: hasOwnProperty, // an alias to avoid ESLint no-prototype-builtins detection
+  hasOwnInPrototypeChain,
+  getSafeProp,
   reduceDescriptors,
   freezeMethods,
   toObjectSet,
@@ -27653,6 +27923,7 @@ const isIterable = (thing) => thing != null && isFunction(thing[iterator]);
   setImmediate: _setImmediate,
   asap,
   isIterable,
+  isSafeIterable,
 });
 
 __webpack_require__.d(__webpack_exports__, {