appium-mac2-driver 4.5.0 → 4.6.0

package/node_modules/axios/dist/axios.js

@@ -1,4 +1,4 @@
-/*! Axios v1.20.0 Copyright (c) 2026 Matt Zabriskie and contributors */
+/*! Axios v1.21.0 Copyright (c) 2026 Matt Zabriskie and contributors */
 (function (global, factory) {
   typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
   typeof define === 'function' && define.amd ? define(factory) :
@@ -847,11 +847,17 @@
       return false;
     }
     var prototype = getPrototypeOf(val);
-    return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) &&
-    // Treat safe own/inherited Symbol.toStringTag or Symbol.iterator members as
-    // evidence the value is tagged/iterable, while ignoring members reachable
-    // only through shared or terminal prototype boundaries.
-    !hasOwnInPrototypeChain(val, toStringTag) && !hasOwnInPrototypeChain(val, iterator);
+    return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) && (
+    // Treat own Symbol.toStringTag or Symbol.iterator members as evidence the
+    // value is tagged/iterable, ignoring members reachable only through shared
+    // or terminal prototype boundaries. This is exactly what
+    // hasOwnInPrototypeChain(val, prop) computes here: every prototype admitted
+    // above (null, Object.prototype, or a terminal null-prototype template) is
+    // a boundary, so the walk never inspects anything but `val`'s own members,
+    // and stops before even those when `val` is itself the boundary
+    // Object.prototype. Checking that inline avoids allocating the walker's
+    // `seen` list twice per call on the mergeConfig / merge hot path.
+    isPrototypeBoundary(val, prototype, true) || !hasOwnProperty(val, toStringTag) && !hasOwnProperty(val, iterator));
   };
 
   /**
@@ -1113,15 +1119,29 @@
       caseless = _ref3.caseless,
       skipUndefined = _ref3.skipUndefined;
     var result = {};
+    // Caseless lookup only applies to string keys — symbol keys are
+    // identity-matched. Every string key that reaches `result` passes through
+    // this index first, so it can never hold two case variants of one key and a
+    // lowercase -> key map is exactly what findKey(result, key) would rescan
+    // Object.keys(result) for on each assignment.
+    var lowerCaseKeys = caseless ? Object.create(null) : null;
     var assignValue = function assignValue(val, key) {
       // Skip dangerous property names to prevent prototype pollution
       if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
         return;
       }
-
-      // findKey lowercases the key, so caseless lookup only applies to strings —
-      // symbol keys are identity-matched.
-      var targetKey = caseless && typeof key === 'string' && findKey(result, key) || key;
+      var targetKey = key;
+      if (lowerCaseKeys && typeof key === 'string') {
+        var lowerKey = key.toLowerCase();
+        var knownKey = lowerCaseKeys[lowerKey];
+        // A key recorded but absent from `result` was skipped by skipUndefined;
+        // the later spelling wins then, as it does for findKey.
+        if (knownKey !== undefined && hasOwnProperty(result, knownKey)) {
+          targetKey = knownKey;
+        } else {
+          lowerCaseKeys[lowerKey] = key;
+        }
+      }
       // Read via own-prop only — a bare `result[targetKey]` walks the prototype
       // chain, so a polluted Object.prototype value could surface here and get
       // copied into the merged result.
@@ -1142,7 +1162,7 @@
         continue;
       }
       forEach(source, assignValue);
-      if (_typeof(source) !== 'object' || isArray(source)) {
+      if (_typeof(source) !== 'object' || isArray(source) || !Object.getOwnPropertySymbols) {
         continue;
       }
       var symbols = Object.getOwnPropertySymbols(source);
@@ -1297,7 +1317,27 @@
     if (!thing) return null;
     if (isArray(thing)) return thing;
     var i = thing.length;
-    if (!isNumber(i)) return null;
+    if (!Number.isSafeInteger(i) || i < 0 || i > 0xffffffff) return null;
+
+    // Bound the copy by actual indexed properties, including hidden and inherited
+    // members of array-like collections, rather than by the declared length alone.
+    var indexes = new Set();
+    var seen = new Set();
+    var source = thing;
+    while (source != null && indexes.size < i) {
+      if (seen.has(source)) return null;
+      seen.add(source);
+      var prototype = getPrototypeOf(source);
+      if (isPrototypeBoundary(source, prototype, source === thing)) break;
+      Object.getOwnPropertyNames(source).forEach(function (key) {
+        var index = +key;
+        if (Number.isInteger(index) && index >= 0 && index < i && String(index) === key && hasOwnProperty(source, key)) {
+          indexes.add(index);
+        }
+      });
+      source = prototype;
+    }
+    if (indexes.size !== i) return null;
     var arr = new Array(i);
     while (i-- > 0) {
       arr[i] = thing[i];
@@ -1662,7 +1702,8 @@
    * @returns {Object} Headers parsed into an object
    */
   var parseHeaders = (function (rawHeaders) {
-    var parsed = {};
+    // Header names are data, including __proto__; avoid inherited setters.
+    var parsed = Object.create(null);
     var key;
     var val;
     var i;
@@ -1840,9 +1881,23 @@
   var isValidHeaderName = function isValidHeaderName(str) {
     return /^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(str.trim());
   };
+
+  // `__proto__` is a valid field name, and the one name the uppercase mapping at
+  // the bottom of this file cannot reach: it is inherited from Object.prototype
+  // instead of being declared on AxiosHeaders.prototype, so `self.__proto__ = v`
+  // runs the inherited setter. That silently discards the header, and an array
+  // value replaces the instance prototype, taking every method with it.
+  // Store it under the same kind of case variant that mapping uses for `set` and
+  // `constructor`. Header lookup is caseless, so it reads back under either
+  // spelling, and no own `__proto__` slot is ever created for a later
+  // `Object.assign` to copy onto a plain object through the same setter.
+  var PROTO_HEADER_SLOT = '__Proto__';
+  var headerSlot = function headerSlot(name) {
+    return name === '__proto__' ? PROTO_HEADER_SLOT : name;
+  };
   function matchHeaderValue(context, value, header, filter, isHeaderNameFilter) {
     if (utils$1.isFunction(filter)) {
-      return filter.call(this, value, header);
+      return filter.call(context, value, header);
     }
     if (isHeaderNameFilter) {
       value = header;
@@ -1890,7 +1945,7 @@
           }
           var key = utils$1.findKey(self, lHeader);
           if (!key || self[key] === undefined || _rewrite === true || _rewrite === undefined && self[key] !== false) {
-            self[key || _header] = normalizeValue(_value);
+            self[headerSlot(key || _header)] = normalizeValue(_value);
           }
         }
         var setHeaders = function setHeaders(headers, _rewrite) {
@@ -2008,7 +2063,7 @@
       key: "normalize",
       value: function normalize(format) {
         var self = this;
-        var headers = {};
+        var headers = Object.create(null);
         utils$1.forEach(this, function (value, header) {
           var key = utils$1.findKey(headers, header);
           if (key) {
@@ -2016,7 +2071,7 @@
             delete self[header];
             return;
           }
-          var normalized = format ? formatHeader(header) : String(header).trim();
+          var normalized = headerSlot(format ? formatHeader(header) : String(header).trim());
           if (normalized !== header) {
             delete self[header];
           }
@@ -2206,6 +2261,60 @@
     }).filter(Boolean).join('; ');
     return message || error.name || 'AggregateError';
   }
+
+  // Shared with `Axios.prototype.request`, which splices the reconstructed
+  // caller frames in ahead of this marker.
+  var CAUSED_BY_SEPARATOR = '\nCaused by: ';
+  var $causeStack = Symbol('causeStack');
+
+  // Match the section we appended, not marker-like text in an error message or
+  // a replacement stack supplied by the caller. Do not re-read the cause's stack.
+  function getCauseStackIndex(error, stack) {
+    var causeStack = utils$1.hasOwnProp(error, $causeStack) && error[$causeStack];
+    return causeStack && stack.endsWith(causeStack) ? stack.length - causeStack.length : -1;
+  }
+
+  /**
+   * Append the stack of a wrapped error to `target.stack`.
+   *
+   * `cause` already exposes the original error for tooling that walks the standard
+   * cause chain, but many error reporters read `stack` and nothing else. Inlining
+   * the wrapped stack there means those reporters surface the underlying failure
+   * instead of the axios frames that normalized it (see #6670).
+   *
+   * Every read is defensive: a custom `Error.prepareStackTrace` hook, a runtime
+   * without stack support, or a replaced `stack` property can leave the value
+   * missing, non-string, or read-only, and normalizing an error must not throw
+   * because of that.
+   *
+   * @param {Error} target The AxiosError being built.
+   * @param {Error} source The error being wrapped.
+   *
+   * @returns {void}
+   */
+  function appendCauseStack(target, source) {
+    try {
+      var sourceStack = source && source.stack;
+      if (typeof sourceStack !== 'string' || !sourceStack) {
+        return;
+      }
+      var targetStack = target.stack;
+      if (typeof targetStack !== 'string' || !targetStack) {
+        return;
+      }
+
+      // Each call to `from()` creates a fresh target. Re-wrapping includes the
+      // previous stack verbatim, adding one cause section per wrap.
+      var causeStack = CAUSED_BY_SEPARATOR + sourceStack;
+      target.stack = targetStack + causeStack;
+      Object.defineProperty(target, $causeStack, {
+        __proto__: null,
+        value: causeStack
+      });
+    } catch (e) {
+      // Ignore failures from custom stack hooks or un-writable stack properties.
+    }
+  }
   var AxiosError = /*#__PURE__*/function (_Error) {
     /**
      * Create an Error with the specified message, config, error code, request and response.
@@ -2301,6 +2410,10 @@
         });
         axiosError.name = error.name;
 
+        // Inline the wrapped stack for reporters that read only `stack`; the `cause`
+        // property above already covers cause-aware tooling.
+        appendCauseStack(axiosError, error);
+
         // Preserve status from the original error if not already set from response
         if (error.status != null && axiosError.status == null) {
           axiosError.status = error.status;
@@ -2656,6 +2769,15 @@
       handlers.pop();
     }
   }
+
+  // Preserve the array-key coercion used before IDs were stored in a Map, without
+  // treating null, empty strings, or noncanonical numeric strings as ID zero.
+  function normalizeHandlerId(id) {
+    if (typeof id === 'string' && id !== '' && String(Number(id)) === id) {
+      return Number(id);
+    }
+    return id;
+  }
   function syncHandlerEntries(manager, internals) {
     var handlers = manager.handlers;
     var length = countHandlers(handlers);
@@ -2733,9 +2855,10 @@
       value: function eject(id) {
         var internals = this[$internals];
         syncHandlerEntries(this, internals);
-        var entry = internals.handlerEntries.get(id);
+        var handlerId = normalizeHandlerId(id);
+        var entry = internals.handlerEntries.get(handlerId);
         if (entry) {
-          internals.handlerEntries["delete"](id);
+          internals.handlerEntries["delete"](handlerId);
 
           // Ignore IDs invalidated by clear or direct replacement of handlers.
           if (this.handlers[entry.index] !== entry.handler) {
@@ -2804,7 +2927,8 @@
     clarifyTimeoutError: false,
     legacyInterceptorReqResOrdering: true,
     advertiseZstdAcceptEncoding: false,
-    validateStatusUndefinedResolves: true
+    validateStatusUndefinedResolves: true,
+    encodeBasicAuthUsername: false
   };
 
   var URLSearchParams$1 = typeof URLSearchParams !== 'undefined' ? URLSearchParams : AxiosURLSearchParams;
@@ -2938,6 +3062,29 @@
     }
     return obj;
   }
+  function normalizeArray(value) {
+    if (!utils$1.isArray(value)) return value;
+    var keys = Object.keys(value);
+    return keys.length !== value.length || keys.some(function (key, index) {
+      return key !== String(index);
+    }) ? arrayToObject(value) : value;
+  }
+  function normalizeArrays(obj) {
+    var pending = [obj];
+    var _loop = function _loop() {
+      var target = pending.pop();
+      Object.keys(target).forEach(function (key) {
+        var value = target[key] = normalizeArray(target[key]);
+        if (utils$1.isArray(value) || utils$1.isPlainObject(value)) {
+          pending.push(value);
+        }
+      });
+    };
+    while (pending.length) {
+      _loop();
+    }
+    return obj;
+  }
 
   /**
    * It takes a FormData object and returns a JavaScript object
@@ -2956,6 +3103,7 @@
       name = !name && utils$1.isArray(target) ? target.length : name;
       if (isLast) {
         if (utils$1.hasOwnProp(target, name)) {
+          target[name] = normalizeArray(target[name]);
           target[name] = utils$1.isArray(target[name]) ? target[name].concat(value) : [target[name], value];
         } else {
           target[name] = value;
@@ -2976,7 +3124,7 @@
       utils$1.forEachEntry(formData, function (name, value) {
         buildPath(parsePropPath(name), value, obj, 0);
       });
-      return obj;
+      return normalizeArrays(obj);
     }
     return null;
   }
@@ -3191,9 +3339,111 @@
 
   function parseProtocol(url) {
     var match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url);
-    return match && match[1] || '';
+    return match && match[1].toLowerCase() || '';
   }
 
+  var decodeCookieValue = function decodeCookieValue(value) {
+    try {
+      return decodeURIComponent(value);
+    } catch (e) {
+      return value;
+    }
+  };
+  var cookies = platform.hasStandardBrowserEnv ?
+  // Standard browser envs support document.cookie
+  {
+    write: function write(name, value, expires, path, domain, secure, sameSite) {
+      if (typeof document === 'undefined') return;
+      var cookie = ["".concat(name, "=").concat(encodeURIComponent(value))];
+      if (utils$1.isNumber(expires)) {
+        cookie.push("expires=".concat(new Date(expires).toUTCString()));
+      }
+      if (utils$1.isString(path)) {
+        cookie.push("path=".concat(path));
+      }
+      if (utils$1.isString(domain)) {
+        cookie.push("domain=".concat(domain));
+      }
+      if (secure === true) {
+        cookie.push('secure');
+      }
+      if (utils$1.isString(sameSite)) {
+        cookie.push("SameSite=".concat(sameSite));
+      }
+      document.cookie = cookie.join('; ');
+    },
+    read: function read(name) {
+      if (typeof document === 'undefined') return null;
+      var cookieString = document.cookie;
+      if (!cookieString) return null;
+      // Match name=value by splitting on the semicolon separator instead of building a
+      // RegExp from `name` — interpolating an unescaped string into a RegExp would let
+      // metacharacters (e.g. `.+?` in an attacker-influenced cookie name) cause ReDoS or
+      // match the wrong cookie. Browsers may serialize cookie pairs as either ";" or
+      // "; ", so ignore optional whitespace before each cookie name.
+      var cookies = cookieString.split(';');
+      for (var i = 0; i < cookies.length; i++) {
+        var cookie = cookies[i].replace(/^\s+/, '');
+        var eq = cookie.indexOf('=');
+        if (eq !== -1 && cookie.slice(0, eq) === name) {
+          return decodeCookieValue(cookie.slice(eq + 1));
+        }
+      }
+      return null;
+    },
+    readAsync: function readAsync(name) {
+      var _this = this;
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+        var store, cookie;
+        return _regenerator().w(function (_context) {
+          while (1) switch (_context.p = _context.n) {
+            case 0:
+              _context.p = 0;
+              store = typeof window !== 'undefined' && window.cookieStore;
+              if (!(store && utils$1.isFunction(store.get))) {
+                _context.n = 2;
+                break;
+              }
+              _context.n = 1;
+              return store.get(name);
+            case 1:
+              cookie = _context.v;
+              return _context.a(2, cookie ? decodeCookieValue(cookie.value) : null);
+            case 2:
+              _context.n = 4;
+              break;
+            case 3:
+              _context.p = 3;
+              _context.v;
+            case 4:
+              return _context.a(2, _this.read(name));
+          }
+        }, _callee, null, [[0, 3]]);
+      }))();
+    },
+    remove: function remove(name) {
+      this.write(name, '', Date.now() - 86400000, '/');
+    }
+  } :
+  // Non-standard browser env (web workers, react-native) lack needed support.
+  {
+    write: function write() {},
+    read: function read() {
+      return null;
+    },
+    readAsync: function readAsync() {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2() {
+        return _regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              return _context2.a(2, null);
+          }
+        }, _callee2);
+      }))();
+    },
+    remove: function remove() {}
+  };
+
   /**
    * Calculate data maxRate
    * @param {Number} [samplesCount= 10]
@@ -3334,72 +3584,15 @@
     };
   };
 
-  var isURLSameOrigin = platform.hasStandardBrowserEnv ? function (origin, isMSIE) {
+  var isURLSameOrigin = platform.hasStandardBrowserEnv ? function (origin) {
     return function (url) {
-      url = new URL(url, platform.origin);
-      return origin.protocol === url.protocol && origin.host === url.host && (isMSIE || origin.port === url.port);
+      url = new URL(url, document.baseURI || platform.origin);
+      return origin.protocol === url.protocol && origin.host === url.host && origin.port === url.port;
     };
-  }(new URL(platform.origin), platform.navigator && /(msie|trident)/i.test(platform.navigator.userAgent)) : function () {
+  }(new URL(platform.origin)) : function () {
     return true;
   };
 
-  var cookies = platform.hasStandardBrowserEnv ?
-  // Standard browser envs support document.cookie
-  {
-    write: function write(name, value, expires, path, domain, secure, sameSite) {
-      if (typeof document === 'undefined') return;
-      var cookie = ["".concat(name, "=").concat(encodeURIComponent(value))];
-      if (utils$1.isNumber(expires)) {
-        cookie.push("expires=".concat(new Date(expires).toUTCString()));
-      }
-      if (utils$1.isString(path)) {
-        cookie.push("path=".concat(path));
-      }
-      if (utils$1.isString(domain)) {
-        cookie.push("domain=".concat(domain));
-      }
-      if (secure === true) {
-        cookie.push('secure');
-      }
-      if (utils$1.isString(sameSite)) {
-        cookie.push("SameSite=".concat(sameSite));
-      }
-      document.cookie = cookie.join('; ');
-    },
-    read: function read(name) {
-      if (typeof document === 'undefined') return null;
-      // Match name=value by splitting on the semicolon separator instead of building a
-      // RegExp from `name` — interpolating an unescaped string into a RegExp would let
-      // metacharacters (e.g. `.+?` in an attacker-influenced cookie name) cause ReDoS or
-      // match the wrong cookie. Browsers may serialize cookie pairs as either ";" or
-      // "; ", so ignore optional whitespace before each cookie name.
-      var cookies = document.cookie.split(';');
-      for (var i = 0; i < cookies.length; i++) {
-        var cookie = cookies[i].replace(/^\s+/, '');
-        var eq = cookie.indexOf('=');
-        if (eq !== -1 && cookie.slice(0, eq) === name) {
-          try {
-            return decodeURIComponent(cookie.slice(eq + 1));
-          } catch (e) {
-            return cookie.slice(eq + 1);
-          }
-        }
-      }
-      return null;
-    },
-    remove: function remove(name) {
-      this.write(name, '', Date.now() - 86400000, '/');
-    }
-  } :
-  // Non-standard browser env (web workers, react-native) lack needed support.
-  {
-    write: function write() {},
-    read: function read() {
-      return null;
-    },
-    remove: function remove() {}
-  };
-
   /**
    * Determines whether the specified URL is absolute
    *
@@ -3494,18 +3687,237 @@
     return requestedURL;
   }
 
+  function assertParamsAcyclic(params) {
+    var pending = [{
+      value: params
+    }];
+    var active = new WeakSet();
+    var visited = new WeakSet();
+    var _loop = function _loop() {
+        var _pending$pop = pending.pop(),
+          value = _pending$pop.value,
+          done = _pending$pop.done;
+        if (!utils$1.isPlainObject(value) && !utils$1.isArray(value)) return 0; // continue
+        if (done) {
+          active["delete"](value);
+          return 0; // continue
+        }
+        if (active.has(value)) {
+          throw new AxiosError('Circular reference detected in params', AxiosError.ERR_BAD_OPTION_VALUE);
+        }
+        if (visited.has(value)) return 0; // continue
+        visited.add(value);
+        active.add(value);
+        pending.push({
+          value: value,
+          done: true
+        });
+        var keys = Object.keys(value);
+        if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) {
+          Object.getOwnPropertySymbols(value).forEach(function (key) {
+            var descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (descriptor && descriptor.enumerable) keys.push(key);
+          });
+        }
+        // Shallow array elements retain fields filtered during plain-object merges.
+        // Inspect reserved data properties without evaluating their accessors.
+        keys.forEach(function (key) {
+          if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+            var descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (descriptor && utils$1.hasOwnProp(descriptor, 'value')) {
+              pending.push({
+                value: descriptor.value
+              });
+            }
+          } else {
+            pending.push({
+              value: value[key]
+            });
+          }
+        });
+      },
+      _ret;
+    while (pending.length) {
+      _ret = _loop();
+      if (_ret === 0) continue;
+    }
+  }
+
   var headersToObject = function headersToObject(thing) {
     return thing instanceof AxiosHeaders ? _objectSpread2({}, thing) : thing;
   };
   var ownEnumerableKeys = function ownEnumerableKeys(thing) {
     if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) {
       return Object.keys(thing).concat(Object.getOwnPropertySymbols(thing).filter(function (symbol) {
-        return Object.getOwnPropertyDescriptor(thing, symbol).enumerable;
+        var descriptor = Object.getOwnPropertyDescriptor(thing, symbol);
+        return descriptor && descriptor.enumerable;
       }));
     }
     return Object.keys(thing);
   };
 
+  // Copy params without recursive merges so the serializer remains responsible
+  // for its depth policy. Only visit defaults that contribute to the result.
+  function mergeParams(a, b) {
+    var pending = [];
+    var copies = new WeakMap();
+    var empty = {};
+    function copy(target, source) {
+      if (!utils$1.isPlainObject(source)) {
+        return utils$1.isArray(source) ? source.slice() : source;
+      }
+      var base = utils$1.isPlainObject(target) ? target : empty;
+      var bases = copies.get(source);
+      if (!bases) {
+        bases = new WeakMap();
+        copies.set(source, bases);
+      }
+      if (bases.has(base)) return bases.get(base);
+      var result = {};
+      bases.set(base, result);
+      pending.push({
+        base: base,
+        source: source,
+        result: result
+      });
+      return result;
+    }
+    var result = utils$1.isUndefined(b) ? copy(undefined, a) : copy(a, b);
+    var _loop = function _loop() {
+      var _pending$pop = pending.pop(),
+        base = _pending$pop.base,
+        source = _pending$pop.source,
+        target = _pending$pop.result;
+      var baseKeys = new Set(ownEnumerableKeys(base));
+      var sourceKeys = new Set(ownEnumerableKeys(source));
+      var keys = new Set([].concat(_toConsumableArray(baseKeys), _toConsumableArray(sourceKeys)));
+      keys.forEach(function (key) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') return;
+        var hasSource = sourceKeys.has(key);
+        var value = hasSource ? source[key] : undefined;
+        var previous = (!hasSource || utils$1.isPlainObject(value)) && baseKeys.has(key) ? base[key] : undefined;
+        target[key] = hasSource ? copy(previous, value) : copy(undefined, previous);
+      });
+    };
+    while (pending.length) {
+      _loop();
+    }
+    assertParamsAcyclic(result);
+    return result;
+  }
+  function getMergedValue(target, source, prop, caseless) {
+    if (utils$1.isPlainObject(target) && utils$1.isPlainObject(source)) {
+      return utils$1.merge.call({
+        caseless: caseless
+      }, target, source);
+    } else if (utils$1.isPlainObject(source)) {
+      return utils$1.merge({}, source);
+    } else if (utils$1.isArray(source)) {
+      return source.slice();
+    }
+    return source;
+  }
+  function mergeDeepProperties(a, b, prop, caseless) {
+    if (!utils$1.isUndefined(b)) {
+      return getMergedValue(a, b, prop, caseless);
+    } else if (!utils$1.isUndefined(a)) {
+      return getMergedValue(undefined, a, prop, caseless);
+    }
+  }
+
+  // eslint-disable-next-line consistent-return
+  function valueFromConfig2(a, b) {
+    if (!utils$1.isUndefined(b)) {
+      return getMergedValue(undefined, b);
+    }
+  }
+
+  // eslint-disable-next-line consistent-return
+  function defaultToConfig2(a, b) {
+    if (!utils$1.isUndefined(b)) {
+      return getMergedValue(undefined, b);
+    } else if (!utils$1.isUndefined(a)) {
+      return getMergedValue(undefined, a);
+    }
+  }
+  function getMergedTransitionalOption(config1, config2, prop) {
+    var transitional2 = utils$1.hasOwnProp(config2, 'transitional') ? config2.transitional : undefined;
+    if (!utils$1.isUndefined(transitional2)) {
+      if (utils$1.isPlainObject(transitional2)) {
+        if (utils$1.hasOwnProp(transitional2, prop)) {
+          return transitional2[prop];
+        }
+      } else {
+        return undefined;
+      }
+    }
+    var transitional1 = utils$1.hasOwnProp(config1, 'transitional') ? config1.transitional : undefined;
+    if (utils$1.isPlainObject(transitional1) && utils$1.hasOwnProp(transitional1, prop)) {
+      return transitional1[prop];
+    }
+    return undefined;
+  }
+
+  // eslint-disable-next-line consistent-return
+  function mergeDirectKeys(a, b, prop, config1, config2) {
+    if (utils$1.hasOwnProp(config2, prop)) {
+      return getMergedValue(a, b);
+    } else if (utils$1.hasOwnProp(config1, prop)) {
+      return getMergedValue(undefined, a);
+    }
+  }
+  function mergeHeaders(a, b, prop) {
+    return mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true);
+  }
+
+  // Null-proto, frozen descriptor so a polluted Object.prototype.get cannot turn
+  // this data descriptor into an accessor descriptor on the way in.
+  // defineProperty only reads it, so one shared instance serves every call.
+  var hasOwnPropertyDescriptor = Object.freeze({
+    __proto__: null,
+    value: Object.prototype.hasOwnProperty,
+    enumerable: false,
+    writable: true,
+    configurable: true
+  });
+
+  // The strategy table and the strategies above are stateless, so they are
+  // built once at module load instead of on every call: mergeConfig runs at
+  // most twice per request (once from a method alias, once from `_request`).
+  var mergeMap = {
+    url: valueFromConfig2,
+    method: valueFromConfig2,
+    data: valueFromConfig2,
+    baseURL: defaultToConfig2,
+    transformRequest: defaultToConfig2,
+    transformResponse: defaultToConfig2,
+    params: mergeParams,
+    paramsSerializer: defaultToConfig2,
+    timeout: defaultToConfig2,
+    timeoutErrorMessage: defaultToConfig2,
+    withCredentials: defaultToConfig2,
+    withXSRFToken: defaultToConfig2,
+    adapter: defaultToConfig2,
+    responseType: defaultToConfig2,
+    xsrfCookieName: defaultToConfig2,
+    xsrfHeaderName: defaultToConfig2,
+    onUploadProgress: defaultToConfig2,
+    onDownloadProgress: defaultToConfig2,
+    decompress: defaultToConfig2,
+    maxContentLength: defaultToConfig2,
+    maxBodyLength: defaultToConfig2,
+    beforeRedirect: defaultToConfig2,
+    transport: defaultToConfig2,
+    httpAgent: defaultToConfig2,
+    httpsAgent: defaultToConfig2,
+    cancelToken: defaultToConfig2,
+    socketPath: defaultToConfig2,
+    allowedSocketPaths: defaultToConfig2,
+    responseEncoding: defaultToConfig2,
+    validateStatus: mergeDirectKeys,
+    headers: mergeHeaders
+  };
+
   /**
    * Config-specific merge-function which creates a new config-object
    * by merging two configuration objects together.
@@ -3525,119 +3937,18 @@
     // `hasOwnProperty` is restored as a non-enumerable own slot to preserve
     // ergonomics for user code that relies on it.
     var config = Object.create(null);
-    Object.defineProperty(config, 'hasOwnProperty', {
-      // Null-proto descriptor so a polluted Object.prototype.get cannot turn
-      // this data descriptor into an accessor descriptor on the way in.
-      __proto__: null,
-      value: Object.prototype.hasOwnProperty,
-      enumerable: false,
-      writable: true,
-      configurable: true
-    });
-    function getMergedValue(target, source, prop, caseless) {
-      if (utils$1.isPlainObject(target) && utils$1.isPlainObject(source)) {
-        return utils$1.merge.call({
-          caseless: caseless
-        }, target, source);
-      } else if (utils$1.isPlainObject(source)) {
-        return utils$1.merge({}, source);
-      } else if (utils$1.isArray(source)) {
-        return source.slice();
-      }
-      return source;
-    }
-    function mergeDeepProperties(a, b, prop, caseless) {
-      if (!utils$1.isUndefined(b)) {
-        return getMergedValue(a, b, prop, caseless);
-      } else if (!utils$1.isUndefined(a)) {
-        return getMergedValue(undefined, a, prop, caseless);
-      }
-    }
-
-    // eslint-disable-next-line consistent-return
-    function valueFromConfig2(a, b) {
-      if (!utils$1.isUndefined(b)) {
-        return getMergedValue(undefined, b);
-      }
-    }
-
-    // eslint-disable-next-line consistent-return
-    function defaultToConfig2(a, b) {
-      if (!utils$1.isUndefined(b)) {
-        return getMergedValue(undefined, b);
-      } else if (!utils$1.isUndefined(a)) {
-        return getMergedValue(undefined, a);
-      }
-    }
-    function getMergedTransitionalOption(prop) {
-      var transitional2 = utils$1.hasOwnProp(config2, 'transitional') ? config2.transitional : undefined;
-      if (!utils$1.isUndefined(transitional2)) {
-        if (utils$1.isPlainObject(transitional2)) {
-          if (utils$1.hasOwnProp(transitional2, prop)) {
-            return transitional2[prop];
-          }
-        } else {
-          return undefined;
-        }
-      }
-      var transitional1 = utils$1.hasOwnProp(config1, 'transitional') ? config1.transitional : undefined;
-      if (utils$1.isPlainObject(transitional1) && utils$1.hasOwnProp(transitional1, prop)) {
-        return transitional1[prop];
-      }
-      return undefined;
-    }
-
-    // eslint-disable-next-line consistent-return
-    function mergeDirectKeys(a, b, prop) {
-      if (utils$1.hasOwnProp(config2, prop)) {
-        return getMergedValue(a, b);
-      } else if (utils$1.hasOwnProp(config1, prop)) {
-        return getMergedValue(undefined, a);
-      }
-    }
-    var mergeMap = {
-      url: valueFromConfig2,
-      method: valueFromConfig2,
-      data: valueFromConfig2,
-      baseURL: defaultToConfig2,
-      transformRequest: defaultToConfig2,
-      transformResponse: defaultToConfig2,
-      paramsSerializer: defaultToConfig2,
-      timeout: defaultToConfig2,
-      timeoutErrorMessage: defaultToConfig2,
-      withCredentials: defaultToConfig2,
-      withXSRFToken: defaultToConfig2,
-      adapter: defaultToConfig2,
-      responseType: defaultToConfig2,
-      xsrfCookieName: defaultToConfig2,
-      xsrfHeaderName: defaultToConfig2,
-      onUploadProgress: defaultToConfig2,
-      onDownloadProgress: defaultToConfig2,
-      decompress: defaultToConfig2,
-      maxContentLength: defaultToConfig2,
-      maxBodyLength: defaultToConfig2,
-      beforeRedirect: defaultToConfig2,
-      transport: defaultToConfig2,
-      httpAgent: defaultToConfig2,
-      httpsAgent: defaultToConfig2,
-      cancelToken: defaultToConfig2,
-      socketPath: defaultToConfig2,
-      allowedSocketPaths: defaultToConfig2,
-      responseEncoding: defaultToConfig2,
-      validateStatus: mergeDirectKeys,
-      headers: function headers(a, b, prop) {
-        return mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true);
-      }
-    };
-    utils$1.forEach(ownEnumerableKeys(_objectSpread2(_objectSpread2({}, config1), config2)), function computeConfigValue(prop) {
-      if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
+    Object.defineProperty(config, 'hasOwnProperty', hasOwnPropertyDescriptor);
+    var keys = ownEnumerableKeys(_objectSpread2(_objectSpread2({}, config1), config2));
+    for (var i = 0, len = keys.length; i < len; i++) {
+      var prop = keys[i];
+      if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') continue;
       var merge = utils$1.hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
       var a = utils$1.hasOwnProp(config1, prop) ? config1[prop] : undefined;
       var b = utils$1.hasOwnProp(config2, prop) ? config2[prop] : undefined;
-      var configValue = merge(a, b, prop);
+      var configValue = merge === mergeDirectKeys ? merge(a, b, prop, config1, config2) : merge(a, b, prop);
       utils$1.isUndefined(configValue) && merge !== mergeDirectKeys || (config[prop] = configValue);
-    });
-    if (utils$1.hasOwnProp(config2, 'validateStatus') && utils$1.isUndefined(config2.validateStatus) && getMergedTransitionalOption('validateStatusUndefinedResolves') === false) {
+    }
+    if (utils$1.hasOwnProp(config2, 'validateStatus') && utils$1.isUndefined(config2.validateStatus) && getMergedTransitionalOption(config1, config2, 'validateStatusUndefinedResolves') === false) {
       if (utils$1.hasOwnProp(config1, 'validateStatus')) {
         config.validateStatus = getMergedValue(undefined, config1.validateStatus);
       } else {
@@ -3688,7 +3999,11 @@
       return String.fromCharCode(parseInt(hex, 16));
     });
   };
+  var readCookie = function readCookie(name) {
+    return cookies.read(name);
+  };
   function resolveConfig(config) {
+    var readXsrfCookie = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : readCookie;
     var newConfig = mergeConfig({}, config);
 
     // Read only own properties to prevent prototype pollution gadgets
@@ -3712,8 +4027,12 @@
     if (auth) {
       var username = utils$1.getSafeProp(auth, 'username') || '';
       var password = utils$1.getSafeProp(auth, 'password') || '';
+      var transitional = own('transitional');
+      var encodeUsername = transitional && utils$1.hasOwnProp(transitional, 'encodeBasicAuthUsername') && transitional.encodeBasicAuthUsername === true;
       try {
-        headers.set('Authorization', 'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : '')));
+        headers.set('Authorization',
+        // Preserve legacy username bytes unless the caller opts in to UTF-8.
+        'Basic ' + btoa((encodeUsername ? encodeUTF8$1(username) : username) + ':' + (password ? encodeUTF8$1(password) : '')));
       } catch (e) {
         throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);
       }
@@ -3742,7 +4061,7 @@
       // the XSRF token cross-origin.
       var shouldSendXSRF = withXSRFToken === true || withXSRFToken == null && isURLSameOrigin(newConfig.url);
       if (shouldSendXSRF) {
-        var xsrfValue = xsrfHeaderName && xsrfCookieName && cookies.read(xsrfCookieName);
+        var xsrfValue = xsrfHeaderName && xsrfCookieName && readXsrfCookie(xsrfCookieName);
         if (xsrfValue) {
           headers.set(xsrfHeaderName, xsrfValue);
         }
@@ -3754,19 +4073,55 @@
   var isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
   var xhrAdapter = isXHRAdapterSupported && function (config) {
     return new Promise(function dispatchXhrRequest(resolve, reject) {
-      var _config = resolveConfig(config);
+      var useAsyncXsrf;
+      try {
+        var store = platform.hasStandardBrowserEnv && typeof window !== 'undefined' && window.cookieStore;
+        useAsyncXsrf = store && utils$1.isFunction(store.get);
+      } catch (e) {
+        // A restricted Cookie Store getter must retain the synchronous fallback.
+      }
+      var xsrfCookieName;
+      var _config = resolveConfig(config, useAsyncXsrf ? function (name) {
+        xsrfCookieName = name;
+        return null;
+      } : undefined);
       var requestData = _config.data;
       var requestHeaders = AxiosHeaders.from(_config.headers).normalize();
       var responseType = _config.responseType,
         onUploadProgress = _config.onUploadProgress,
         onDownloadProgress = _config.onDownloadProgress;
       var onCanceled;
+      var timeoutId;
       var uploadThrottled, downloadThrottled;
       var flushUpload, flushDownload, flushDownloadWithEvent;
       function done() {
-        flushUpload && flushUpload(); // flush events
-        flushDownload && flushDownload(); // flush events
+        clearTimeout(timeoutId);
+        // A final progress callback must not prevent the remaining cleanup.
+        // Report errors asynchronously, as onloadend and the throttle timer do.
+        try {
+          flushUpload && flushUpload(); // flush events
+        } catch (err) {
+          setTimeout(function () {
+            throw err;
+          });
+        }
+        try {
+          flushDownload && flushDownload(); // flush events
+        } catch (err) {
+          setTimeout(function () {
+            throw err;
+          });
+        }
 
+        // A flush can synchronously cancel the request and reenter done().
+        // In that case the inner call has already detached these listeners.
+        if (request) {
+          downloadThrottled && request.removeEventListener('progress', downloadThrottled);
+          if (request.upload) {
+            uploadThrottled && request.upload.removeEventListener('progress', uploadThrottled);
+            flushUpload && request.upload.removeEventListener('loadend', flushUpload);
+          }
+        }
         _config.cancelToken && _config.cancelToken.unsubscribe(onCanceled);
         _config.signal && _config.signal.removeEventListener('abort', onCanceled);
       }
@@ -3892,6 +4247,7 @@
 
       // Handle timeout
       request.ontimeout = function handleTimeout() {
+        if (!request) return;
         var timeoutErrorMessage = _config.timeout ? 'timeout of ' + _config.timeout + 'ms exceeded' : 'timeout exceeded';
         var transitional = _config.transitional || transitionalDefaults;
         if (_config.timeoutErrorMessage) {
@@ -3907,13 +4263,6 @@
       // Remove Content-Type if data is undefined
       requestData === undefined && requestHeaders.setContentType(null);
 
-      // Add headers to the request
-      if ('setRequestHeader' in request) {
-        utils$1.forEach(toByteStringHeaderObject(requestHeaders), function setRequestHeader(val, key) {
-          request.setRequestHeader(key, val);
-        });
-      }
-
       // Add withCredentials to request if needed
       if (!utils$1.isUndefined(_config.withCredentials)) {
         request.withCredentials = !!_config.withCredentials;
@@ -3951,24 +4300,81 @@
             return;
           }
           reject(!cancel || cancel.type ? new CanceledError(null, config, request) : cancel);
-          request.abort();
+          var xhr = request;
           done();
           request = null;
+          xhr.abort();
         };
         _config.cancelToken && _config.cancelToken.subscribe(onCanceled);
+        if (!request) return;
         if (_config.signal) {
           _config.signal.aborted ? onCanceled() : _config.signal.addEventListener('abort', onCanceled);
         }
       }
+      if (!request) return;
       var protocol = parseProtocol(_config.url);
       if (protocol && !platform.protocols.includes(protocol)) {
         reject(new AxiosError('Unsupported protocol ' + protocol + ':', AxiosError.ERR_BAD_REQUEST, config));
         done();
         return;
       }
-
-      // Send the request
-      request.send(requestData || null);
+      var sendRequest = function sendRequest() {
+        if (!request) return;
+        // Apply headers after an asynchronous XSRF read so existing headers are
+        // replaced through AxiosHeaders rather than appended by the native XHR.
+        if ('setRequestHeader' in request) {
+          utils$1.forEach(toByteStringHeaderObject(requestHeaders), function setRequestHeader(val, key) {
+            request.setRequestHeader(key, val);
+          });
+        }
+        request.send(requestData || null);
+      };
+      if (xsrfCookieName) {
+        // Native XHR timeout starts at send(). Cover cookie preparation and the
+        // subsequent request with the same budget and existing timeout handler.
+        var now = typeof performance !== 'undefined' && utils$1.isFunction(performance.now) ? function () {
+          return performance.now();
+        } : Date.now;
+        var deadline = request.timeout > 0 ? now() + Number(request.timeout) : undefined;
+        var abortOnTimeout = function abortOnTimeout() {
+          if (!request) return;
+          var xhr = request;
+          xhr.ontimeout();
+          xhr.abort();
+        };
+        if (deadline !== undefined) {
+          var _scheduleTimeout = function scheduleTimeout() {
+            var remaining = deadline - now();
+            if (remaining > 0) {
+              // Browser timers overflow above the signed 32-bit delay limit.
+              timeoutId = setTimeout(_scheduleTimeout, Math.min(remaining, 0x7fffffff));
+            } else {
+              abortOnTimeout();
+            }
+          };
+          _scheduleTimeout();
+        }
+        cookies.readAsync(xsrfCookieName).then(function (value) {
+          if (!request) return;
+          // Promise callbacks may run before an overdue timer after a busy task.
+          if (deadline !== undefined && now() >= deadline) {
+            abortOnTimeout();
+            return;
+          }
+          if (value) {
+            var headerName = utils$1.hasOwnProp(_config, 'xsrfHeaderName') && _config.xsrfHeaderName;
+            requestHeaders.set(headerName, value);
+          }
+          sendRequest();
+        })["catch"](function (error) {
+          if (!request) return;
+          reject(AxiosError.from(error, null, config, request));
+          done();
+          request = null;
+        });
+      } else {
+        sendRequest();
+      }
     });
   };
 
@@ -3998,7 +4404,8 @@
       timer && clearTimeout(timer);
       timer = null;
       signals.forEach(function (signal) {
-        signal.unsubscribe ? signal.unsubscribe(onabort) : signal.removeEventListener('abort', onabort);
+        var unsubscribeSignal = utils$1.getSafeProp(signal, 'unsubscribe');
+        utils$1.isFunction(unsubscribeSignal) ? unsubscribeSignal.call(signal, onabort) : signal.removeEventListener('abort', onabort);
       });
       signals = null;
     };
@@ -4224,11 +4631,151 @@
     });
   };
 
+  var CRLF = '\r\n';
+  var normalizeLines = function normalizeLines(value) {
+    return String(value).replace(/\r\n|\r|\n/g, CRLF);
+  };
+  var escapeName = function escapeName(value) {
+    return String(value).replace(/[\r\n"]/g, function (_char) {
+      return _char === '\r' ? '%0D' : _char === '\n' ? '%0A' : '%22';
+    });
+  };
+
+  // Count UTF-8 bytes without allocating an encoded copy of a field. FormData
+  // string values normalize line endings; Blob/File contents remain unchanged.
+  var stringBytes = function stringBytes(value, normalize) {
+    var length = 0;
+    for (var i = 0; i < value.length; i++) {
+      var code = value.charCodeAt(i);
+      if (normalize && (code === 13 || code === 10)) {
+        if (code === 13 && value.charCodeAt(i + 1) === 10) i++;
+        length += 2;
+      } else if (code < 0x80) {
+        length++;
+      } else if (code < 0x800) {
+        length += 2;
+      } else if (code >= 0xd800 && code <= 0xdbff && value.charCodeAt(i + 1) >= 0xdc00 && value.charCodeAt(i + 1) <= 0xdfff) {
+        length += 4;
+        i++;
+      } else {
+        length += 3;
+      }
+    }
+    return length;
+  };
+
+  // Describe serialization failures independently of any request library.
+  var FormDataError = /*#__PURE__*/function (_TypeError) {
+    function FormDataError(message, reason) {
+      var _this;
+      _classCallCheck(this, FormDataError);
+      _this = _callSuper(this, FormDataError, [message]);
+      _this.name = 'FormDataError';
+      _this.reason = reason;
+      return _this;
+    }
+    _inherits(FormDataError, _TypeError);
+    return _createClass(FormDataError);
+  }(/*#__PURE__*/_wrapNativeSuper(TypeError));
+
+  // The caller supplies the boundary, Blob implementation, and limit error.
+  function formDataToBlob(form, Blob, limit, limitError, boundary) {
+    if (!utils$1.isFunction(Blob)) {
+      throw new FormDataError('Blob is not supported', 'blob');
+    }
+    if (!utils$1.isString(boundary) || !/^[A-Za-z0-9'()+_,./:=? -]{1,70}$/.test(boundary) || / $/.test(boundary)) {
+      throw new FormDataError('Invalid multipart boundary', 'boundary');
+    }
+    var footer = '--' + boundary + '--' + CRLF;
+    var length = footer.length;
+    var parts = [];
+    var checkLength = function checkLength(extra) {
+      if (length + extra > limit) throw limitError();
+    };
+    checkLength(0);
+    var _iterator = _createForOfIteratorHelper(form),
+      _step;
+    try {
+      for (_iterator.s(); !(_step = _iterator.n()).done;) {
+        var _step$value = _slicedToArray(_step.value, 2),
+          name = _step$value[0],
+          value = _step$value[1];
+        var isString = utils$1.isString(value);
+        var valueLength = isString ? stringBytes(value, true) : value.size;
+        if (!Number.isFinite(valueLength) || valueLength < 0) {
+          throw new FormDataError('Unsupported FormData part size', 'part');
+        }
+        // Reject large values and names before building normalized header strings.
+        checkLength(valueLength + stringBytes(name, true) + (!isString && value.name ? stringBytes(value.name, false) : 0) + (!isString && value.type ? stringBytes(value.type, false) : 0));
+        var header = '--' + boundary + CRLF + 'Content-Disposition: form-data; name="' + escapeName(normalizeLines(name)) + '"';
+        if (!isString) {
+          header += '; filename="' + escapeName(utils$1.isString(value.name) ? value.name : 'blob') + '"' + CRLF + 'Content-Type: ' + String(value.type || 'application/octet-stream').replace(/[\r\n]/g, '');
+        }
+        header += CRLF + CRLF;
+        var partLength = stringBytes(header, false) + valueLength + CRLF.length;
+        checkLength(partLength);
+        length += partLength;
+        parts.push({
+          header: header,
+          value: value,
+          isString: isString
+        });
+      }
+
+      // Native Blob composition retains existing Blob/File data. No file is read
+      // and no complete multipart ArrayBuffer is created to determine its length.
+    } catch (err) {
+      _iterator.e(err);
+    } finally {
+      _iterator.f();
+    }
+    var blobParts = [];
+    for (var _i = 0, _parts = parts; _i < _parts.length; _i++) {
+      var part = _parts[_i];
+      blobParts.push(part.header, part.isString ? normalizeLines(part.value) : part.value, CRLF);
+    }
+    blobParts.push(footer);
+    return new Blob(blobParts, {
+      type: 'multipart/form-data; boundary=' + boundary
+    });
+  }
+
+  function createMultipartBody(form, Blob, limit, limitError, boundary) {
+    // Report missing Blob support before trying to select a random source.
+    if (!utils$1.isFunction(Blob)) {
+      throw new AxiosError('Blob is not supported', AxiosError.ERR_NOT_SUPPORT);
+    }
+    if (boundary === undefined) {
+      if (utils$1.isFunction(platform.generateString)) {
+        boundary = 'axios-' + platform.generateString(36, '0123456789abcdef');
+      } else {
+        var crypto = utils$1.global.crypto;
+        if (!crypto || !utils$1.isFunction(crypto.getRandomValues)) {
+          throw new AxiosError('Random byte generation is not supported', AxiosError.ERR_NOT_SUPPORT);
+        }
+        var random = new Uint8Array(18);
+        crypto.getRandomValues(random);
+        boundary = 'axios-' + Array.from(random, function (value) {
+          return ('0' + value.toString(16)).slice(-2);
+        }).join('');
+      }
+    }
+    try {
+      return formDataToBlob(form, Blob, limit, limitError, boundary);
+    } catch (error) {
+      if (error instanceof FormDataError) {
+        var code = error.reason === 'boundary' ? AxiosError.ERR_BAD_OPTION_VALUE : AxiosError.ERR_BAD_REQUEST;
+        throw new AxiosError(error.message, code);
+      }
+      throw error;
+    }
+  }
+
   /**
    * Estimate data: URL byte lengths *without* allocating large buffers.
    * - Fetch percent-decodes a base64 body before decoding it.
    * - Node's Buffer.from(body, 'base64') sizes its backing allocation from the
-   *   raw body, including ignored characters and content after padding.
+   *   percent-decoded body, including ignored characters and content after padding.
    * - Non-base64 data is percent-decoded and then encoded as UTF-8.
    */
   var isHexDigit = function isHexDigit(charCode) {
@@ -4310,14 +4857,14 @@
     }
     return base64Bytes(significant);
   };
-  var estimateDataURLBytes = function estimateDataURLBytes(url, estimateBase64) {
+  var estimateDataURLBytes = function estimateDataURLBytes(url, estimateBase64, base64Pattern) {
     if (!url || typeof url !== 'string') return 0;
-    if (!url.startsWith('data:')) return 0;
+    if (!/^data:/i.test(url)) return 0;
     var comma = url.indexOf(',');
     if (comma < 0) return 0;
     var meta = url.slice(5, comma);
     var body = url.slice(comma + 1);
-    var isBase64 = /;base64/i.test(meta);
+    var isBase64 = base64Pattern.test(meta);
     if (isBase64) {
       return estimateBase64(body);
     }
@@ -4360,10 +4907,10 @@
   function estimateDataURLDecodedBytes(url) {
     // Fetch removes URL fragments before processing a data: URL.
     var fragmentIndex = typeof url === 'string' ? url.indexOf('#') : -1;
-    return estimateDataURLBytes(fragmentIndex === -1 ? url : url.slice(0, fragmentIndex), estimatePercentDecodedBase64Bytes);
+    return estimateDataURLBytes(fragmentIndex === -1 ? url : url.slice(0, fragmentIndex), estimatePercentDecodedBase64Bytes, /; *base64[\t\n\f\r ]*$/i);
   }
 
-  var VERSION = "1.20.0";
+  var VERSION = "1.21.0";
 
   var DEFAULT_CHUNK_SIZE = 64 * 1024;
   var DEFAULT_REQUEST_OPTIONS = {
@@ -4433,12 +4980,14 @@
       skipUndefined: true
     }, {
       Request: globalObject.Request,
-      Response: globalObject.Response
+      Response: globalObject.Response,
+      Blob: globalObject.Blob
     }, env);
+    var envFetch = utils$1.hasOwnProp(env, 'fetch') ? env.fetch : undefined;
     var _env = env,
-      envFetch = _env.fetch,
       Request = _env.Request,
-      Response = _env.Response;
+      Response = _env.Response,
+      Blob = _env.Blob;
     var isFetchSupported = envFetch ? isFunction(envFetch) : typeof fetch === 'function';
     var isRequestSupported = isFunction(Request);
     var isResponseSupported = isFunction(Response);
@@ -4488,6 +5037,23 @@
     var supportsResponseStream = isResponseSupported && isReadableStreamSupported && test(function () {
       return utils$1.isReadableStream(new Response('').body);
     });
+
+    // Some runtimes reject every explicit cache mode. Use own defaults for both
+    // probes so unrelated polluted options cannot affect cache-mode detection.
+    var requestDefaults = Object.assign(Object.create(null), DEFAULT_REQUEST_OPTIONS);
+    if (isRequestSupported && !test(function () {
+      return new Request(platform.origin, requestDefaults);
+    })) {
+      delete requestDefaults.cache;
+
+      // Only omit cache when that makes Request construction succeed. Otherwise
+      // retain the explicit default that protects supporting runtimes from pollution.
+      if (!test(function () {
+        return new Request(platform.origin, requestDefaults);
+      })) {
+        requestDefaults.cache = DEFAULT_REQUEST_OPTIONS.cache;
+      }
+    }
     var resolvers = {
       stream: supportsResponseStream && function (res) {
         return res.body;
@@ -4506,7 +5072,6 @@
     }();
     var getBodyLength = /*#__PURE__*/function () {
       var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(body) {
-        var _request;
         return _regenerator().w(function (_context2) {
           while (1) switch (_context2.n) {
             case 0:
@@ -4522,37 +5087,24 @@
               }
               return _context2.a(2, body.size);
             case 2:
-              if (!utils$1.isSpecCompliantForm(body)) {
-                _context2.n = 4;
-                break;
-              }
-              _request = new Request(platform.origin, {
-                method: 'POST',
-                body: body
-              });
-              _context2.n = 3;
-              return _request.arrayBuffer();
-            case 3:
-              return _context2.a(2, _context2.v.byteLength);
-            case 4:
               if (!(utils$1.isArrayBufferView(body) || utils$1.isArrayBuffer(body))) {
-                _context2.n = 5;
+                _context2.n = 3;
                 break;
               }
               return _context2.a(2, body.byteLength);
-            case 5:
+            case 3:
               if (utils$1.isURLSearchParams(body)) {
                 body = body + '';
               }
               if (!utils$1.isString(body)) {
-                _context2.n = 7;
+                _context2.n = 5;
                 break;
               }
-              _context2.n = 6;
+              _context2.n = 4;
               return encodeText(body);
-            case 6:
+            case 4:
               return _context2.a(2, _context2.v.byteLength);
-            case 7:
+            case 5:
               return _context2.a(2);
           }
         }, _callee2);
@@ -4578,7 +5130,7 @@
     }();
     return /*#__PURE__*/function () {
       var _ref4 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(config) {
-        var _resolveConfig, url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, _resolveConfig$withCr, withCredentials, fetchOptions, maxContentLength, maxBodyLength, maxRedirects, hasMaxContentLength, hasMaxBodyLength, own, _fetch, composedSignal, request, unsubscribe, requestContentLength, pendingBodyError, maxBodyLengthError, auth, configAuth, username, password, parsedURL, urlUsername, urlPassword, estimated, outboundLength, mustEnforceStreamBody, trackRequestStream, _request, contentTypeHeader, _ref5, _ref6, onProgress, flush, isCredentialsSupported, contentType, safeFetchOptions, resolvedOptions, response, responseHeaders, declaredLength, isStreamResponse, options, responseContentLength, _ref7, _ref8, _onProgress, _flush, bytesRead, onChunkProgress, responseData, materializedSize, canceledError, networkError, _t3, _t4;
+        var _resolveConfig, url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, _resolveConfig$withCr, withCredentials, fetchOptions, maxContentLength, maxBodyLength, maxRedirects, hasMaxContentLength, hasMaxBodyLength, own, _fetch, composedSignal, request, unsubscribe, requestContentLength, pendingBodyError, pendingResponseError, maxBodyLengthError, auth, configAuth, username, password, parsedURL, urlUsername, urlPassword, estimated, formContentType, formBoundary, parameters, outboundLength, mustEnforceStreamBody, trackRequestStream, _request, contentTypeHeader, _ref5, _ref6, onProgress, flush, isCredentialsSupported, contentType, safeFetchOptions, resolvedOptions, response, responseHeaders, declaredLength, isStreamResponse, options, responseContentLength, _ref7, _ref8, _onProgress, _flush, bytesRead, onChunkProgress, responseData, materializedSize, canceledError, networkError, _t3, _t4;
         return _regenerator().w(function (_context4) {
           while (1) switch (_context4.p = _context4.n) {
             case 0:
@@ -4595,11 +5147,12 @@
               unsubscribe = composedSignal && composedSignal.unsubscribe && function () {
                 composedSignal.unsubscribe();
               };
-              // AxiosError we raise while the request body is being streamed. Captured
+              // AxiosErrors we raise while request or response bodies are being streamed. Captured
               // by identity so the catch block can surface it directly, regardless of
               // how the runtime wraps the resulting fetch rejection (undici exposes it
               // as `err.cause`; some browsers drop the original error entirely).
               pendingBodyError = null;
+              pendingResponseError = null;
               maxBodyLengthError = function maxBodyLengthError() {
                 return new AxiosError('Request body larger than maxBodyLength limit', AxiosError.ERR_BAD_REQUEST, config, request);
               };
@@ -4639,17 +5192,35 @@
               // Enforce maxContentLength for data: URLs up-front so we never materialize
               // an oversized payload. The HTTP adapter applies the same check (see http.js
               // "if (protocol === 'data:')" branch).
-              if (!(hasMaxContentLength && typeof url === 'string' && url.startsWith('data:'))) {
+              if (!(hasMaxContentLength && parsedURL && parsedURL.protocol === 'data:')) {
                 _context4.n = 2;
                 break;
               }
-              estimated = estimateDataURLDecodedBytes(url);
+              estimated = estimateDataURLDecodedBytes(parsedURL.href);
               if (!(estimated > maxContentLength)) {
                 _context4.n = 2;
                 break;
               }
               throw new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, request);
             case 2:
+              formContentType = utils$1.isSpecCompliantForm(data) && AxiosHeaders.from(own('headers')).getContentType();
+              if (utils$1.isString(formContentType) && /^multipart\/form-data(?:\s*;|$)/i.test(formContentType.trim())) {
+                parameters = AxiosHeaders.parseParameters(formContentType);
+                if (utils$1.hasOwnProp(parameters, 'boundary')) formBoundary = parameters.boundary;
+              }
+              if (utils$1.isSpecCompliantForm(data) && method !== 'get' && method !== 'head' && (hasMaxBodyLength || onUploadProgress && supportsRequestStream || formBoundary !== undefined)) {
+                data = createMultipartBody(data, Blob, hasMaxBodyLength ? maxBodyLength : Infinity, maxBodyLengthError, formBoundary);
+                // Blob.type lowercases its value, including a case-sensitive boundary.
+                // Retain the caller's header when an explicit boundary was serialized.
+                headers.setContentType(formBoundary === undefined ? data.type : formContentType);
+                requestContentLength = data.size;
+              }
+
+              // Enforce maxBodyLength against known-size bodies before dispatch using
+              // the body's *actual* size — never a caller-declared Content-Length,
+              // which could under-report to slip an oversized body past the check.
+              // Unknown-size streams return undefined here and are counted per-chunk
+              // below as fetch consumes them.
               if (!(hasMaxBodyLength && method !== 'get' && method !== 'head')) {
                 _context4.n = 4;
                 break;
@@ -4768,7 +5339,7 @@
                 credentials: isCredentialsSupported ? withCredentials : undefined
               });
               if (isRequestSupported) {
-                utils$1.forEach(DEFAULT_REQUEST_OPTIONS, function (value, key) {
+                utils$1.forEach(requestDefaults, function (value, key) {
                   if (resolvedOptions[key] === undefined) {
                     resolvedOptions[key] = value;
                   }
@@ -4817,7 +5388,7 @@
                   if (hasMaxContentLength) {
                     bytesRead = loadedBytes;
                     if (bytesRead > maxContentLength) {
-                      throw new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, request);
+                      throw pendingResponseError = new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, request);
                     }
                   }
                   _onProgress && _onProgress(loadedBytes);
@@ -4900,15 +5471,21 @@
               request && !pendingBodyError.request && (pendingBodyError.request = request);
               throw pendingBodyError;
             case 18:
-              if (!(_t4 instanceof AxiosError)) {
+              if (!pendingResponseError) {
                 _context4.n = 19;
                 break;
               }
+              throw pendingResponseError;
+            case 19:
+              if (!(_t4 instanceof AxiosError)) {
+                _context4.n = 20;
+                break;
+              }
               request && !_t4.request && (_t4.request = request);
               throw _t4;
-            case 19:
+            case 20:
               if (!(_t4 && _t4.name === 'TypeError' && /Load failed|fetch/i.test(_t4.message))) {
-                _context4.n = 20;
+                _context4.n = 21;
                 break;
               }
               networkError = new AxiosError('Network Error', AxiosError.ERR_NETWORK, config, request, _t4 && _t4.response); // Non-enumerable to match native Error `cause` semantics so loggers
@@ -4921,9 +5498,9 @@
                 configurable: true
               });
               throw networkError;
-            case 20:
-              throw AxiosError.from(_t4, _t4 && _t4.code, config, request, _t4 && _t4.response);
             case 21:
+              throw AxiosError.from(_t4, _t4 && _t4.code, config, request, _t4 && _t4.response);
+            case 22:
               return _context4.a(2);
           }
         }, _callee4, null, [[1, 16]]);
@@ -4935,11 +5512,18 @@
   };
   var seedCache = new Map();
   var getFetch = function getFetch(config) {
-    var env = config && config.env || {};
+    var env = Object.create(null);
+    var configuredEnv = config && utils$1.hasOwnProp(config, 'env') && config.env;
+    ['fetch', 'Request', 'Response', 'Blob'].forEach(function (key) {
+      if (configuredEnv && utils$1.hasOwnProp(configuredEnv, key)) {
+        env[key] = configuredEnv[key];
+      }
+    });
     var fetch = env.fetch,
       Request = env.Request,
-      Response = env.Response;
-    var seeds = [Request, Response, fetch];
+      Response = env.Response,
+      Blob = env.Blob;
+    var seeds = [Request, Response, fetch, Blob];
     var len = seeds.length,
       i = len,
       seed,
@@ -5089,6 +5673,21 @@
     }
   }
 
+  /**
+   * Milliseconds elapsed since `start`, floored at zero.
+   *
+   * Wall-clock, to match the rest of the codebase (speedometer, throttle,
+   * AxiosTransformStream). A backwards clock adjustment mid-request would
+   * otherwise produce a negative duration, so the result is clamped.
+   *
+   * @param {number} start Timestamp from `Date.now()`
+   *
+   * @returns {number} Non-negative elapsed milliseconds
+   */
+  function elapsedSince(start) {
+    return Math.max(0, Date.now() - start);
+  }
+
   /**
    * Dispatch a request to the server using the configured adapter.
    *
@@ -5110,8 +5709,10 @@
       config.headers.setContentType('application/x-www-form-urlencoded', false);
     }
     var adapter = adapters.getAdapter(config.adapter || defaults.adapter, config);
+    var start = Date.now();
     return adapter(config).then(function onAdapterResolution(response) {
       throwIfCancellationRequested(config);
+      response.duration = elapsedSince(start);
 
       // Expose the current response on config so that transformResponse can
       // attach it to any AxiosError it throws (e.g. on JSON parse failure).
@@ -5130,6 +5731,7 @@
 
         // Transform response data
         if (reason && reason.response) {
+          reason.response.duration = elapsedSince(start);
           config.response = reason.response;
           try {
             reason.response.data = transformData.call(config, config.transformResponse, reason.response);
@@ -5229,6 +5831,23 @@
 
   var validators = validator.validators;
 
+  // Recognize header maps without consuming objects intended as literal values.
+  // AxiosHeaders from other builds share a brand and header-container interface,
+  // but not constructor identity. A tag and toJSON alone can describe a literal.
+  var isHeadersBucket = function isHeadersBucket(value) {
+    if (value == null || utils$1.isPlainObject(value) || value instanceof AxiosHeaders) {
+      return true;
+    }
+    try {
+      return utils$1.isObject(value) && utils$1.getSafeProp(value, Symbol.toStringTag) === 'AxiosHeaders' && ['toJSON', 'set', 'get', 'has', 'delete', 'clear', 'normalize', 'concat', 'toString', Symbol.iterator].every(function (method) {
+        return utils$1.isFunction(utils$1.getSafeProp(value, method));
+      });
+    } catch (e) {
+      // A failed optional brand probe must not prevent literal header serialization.
+      return false;
+    }
+  };
+
   /**
    * Create a new instance of Axios
    *
@@ -5258,7 +5877,7 @@
       key: "request",
       value: (function () {
         var _request2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(configOrUrl, config) {
-          var dummy, dummyStack, stack, firstNewlineIndex, _firstNewlineIndex, secondNewlineIndex, stackWithoutTwoTopLines, _t;
+          var dummy, dummyStack, stack, firstNewlineIndex, _firstNewlineIndex, secondNewlineIndex, duplicateCheckSuffix, currentStack, causeIndex, stackHead, causeSection, _t;
           return _regenerator().w(function (_context) {
             while (1) switch (_context.p = _context.n) {
               case 0:
@@ -5282,13 +5901,21 @@
                     }
                     if (!_t.stack) {
                       _t.stack = stack;
-                      // match without the 2 top stack lines
                     } else if (stack) {
+                      // Match a common suffix after the 2 top frames when available,
+                      // otherwise compare the full reconstructed stack.
                       _firstNewlineIndex = stack.indexOf('\n');
                       secondNewlineIndex = _firstNewlineIndex === -1 ? -1 : stack.indexOf('\n', _firstNewlineIndex + 1);
-                      stackWithoutTwoTopLines = secondNewlineIndex === -1 ? '' : stack.slice(secondNewlineIndex + 1);
-                      if (!String(_t.stack).endsWith(stackWithoutTwoTopLines)) {
-                        _t.stack += '\n' + stack;
+                      duplicateCheckSuffix = secondNewlineIndex === -1 ? stack : stack.slice(secondNewlineIndex + 1); // `AxiosError.from()` may have already inlined the wrapped error's
+                      // stack under a `Caused by:` marker. Keep the reconstructed caller
+                      // frames ahead of that marker so stack-only reporters do not read
+                      // them as part of the low-level cause.
+                      currentStack = String(_t.stack);
+                      causeIndex = getCauseStackIndex(_t, currentStack);
+                      stackHead = causeIndex === -1 ? currentStack : currentStack.slice(0, causeIndex);
+                      causeSection = causeIndex === -1 ? '' : currentStack.slice(causeIndex);
+                      if (!stackHead.endsWith(duplicateCheckSuffix)) {
+                        _t.stack = stackHead + '\n' + stack + causeSection;
                       }
                     }
                   } catch (e) {
@@ -5330,7 +5957,8 @@
             clarifyTimeoutError: validators.transitional(validators["boolean"]),
             legacyInterceptorReqResOrdering: validators.transitional(validators["boolean"]),
             advertiseZstdAcceptEncoding: validators.transitional(validators["boolean"]),
-            validateStatusUndefinedResolves: validators.transitional(validators["boolean"])
+            validateStatusUndefinedResolves: validators.transitional(validators["boolean"]),
+            encodeBasicAuthUsername: validators.transitional(validators["boolean"])
           }, false);
         }
         if (paramsSerializer != null) {
@@ -5347,7 +5975,7 @@
         }
 
         // Set config.allowAbsoluteUrls
-        if (config.allowAbsoluteUrls !== undefined) ; else if (this.defaults.allowAbsoluteUrls !== undefined) {
+        if (config.allowAbsoluteUrls !== undefined) ; else if (utils$1.hasOwnProp(this.defaults, 'allowAbsoluteUrls') && this.defaults.allowAbsoluteUrls !== undefined) {
           config.allowAbsoluteUrls = this.defaults.allowAbsoluteUrls;
         } else {
           config.allowAbsoluteUrls = true;
@@ -5360,10 +5988,14 @@
         // Set config.method
         config.method = (utils$1.getSafeProp(config, 'method') || utils$1.getSafeProp(this.defaults, 'method') || 'get').toLowerCase();
 
-        // Flatten headers
-        var contextHeaders = headers && utils$1.merge(headers.common, headers[config.method]);
+        // Flatten header defaults without consuming literal method-named headers.
+        var commonHeaders = utils$1.getSafeProp(headers, 'common');
+        var methodHeaders = utils$1.getSafeProp(headers, config.method);
+        var contextHeaders = headers && utils$1.merge(isHeadersBucket(commonHeaders) ? commonHeaders : undefined, isHeadersBucket(methodHeaders) ? methodHeaders : undefined);
         headers && utils$1.forEach(methodList.concat('common'), function (method) {
-          delete headers[method];
+          if (isHeadersBucket(utils$1.getSafeProp(headers, method))) {
+            delete headers[method];
+          }
         });
         config.headers = AxiosHeaders.concat(contextHeaders, headers);
 
@@ -5451,26 +6083,47 @@
   }(); // Provide aliases for supported request methods
   utils$1.forEach(['delete', 'get', 'head', 'options'], function forEachMethodNoData(method) {
     /*eslint func-names:0*/
-    Axios.prototype[method] = function (url, config) {
-      return this.request(mergeConfig(config || {}, {
-        method: method,
-        url: url,
-        data: config && utils$1.hasOwnProp(config, 'data') ? config.data : undefined
+    Axios.prototype[method] = /*#__PURE__*/function () {
+      var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(url, config) {
+        return _regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              return _context2.a(2, this.request(mergeConfig(config || {}, {
+                method: method,
+                url: url,
+                data: config && utils$1.hasOwnProp(config, 'data') ? config.data : undefined
+              })));
+          }
+        }, _callee2, this);
       }));
-    };
+      return function (_x3, _x4) {
+        return _ref.apply(this, arguments);
+      };
+    }();
   });
   utils$1.forEach(['post', 'put', 'patch', 'query'], function forEachMethodWithData(method) {
     function generateHTTPMethod(isForm) {
-      return function httpMethod(url, data, config) {
-        return this.request(mergeConfig(config || {}, {
-          method: method,
-          headers: isForm ? {
-            'Content-Type': 'multipart/form-data'
-          } : {},
-          url: url,
-          data: data
+      return /*#__PURE__*/function () {
+        var _httpMethod = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(url, data, config) {
+          return _regenerator().w(function (_context3) {
+            while (1) switch (_context3.n) {
+              case 0:
+                return _context3.a(2, this.request(mergeConfig(config || {}, {
+                  method: method,
+                  headers: isForm ? {
+                    'Content-Type': 'multipart/form-data'
+                  } : {},
+                  url: url,
+                  data: data
+                })));
+            }
+          }, _callee3, this);
         }));
-      };
+        function httpMethod(_x5, _x6, _x7) {
+          return _httpMethod.apply(this, arguments);
+        }
+        return httpMethod;
+      }();
     }
     Axios.prototype[method] = generateHTTPMethod();