axios 1.18.0 → 1.18.1

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## v1.18.0 — June 13, 2026
+
+This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.
+
+## 🔒 Security Fixes
+
+* **Redirect Header Safety:** Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (__#10892__)
+
+* **URL And Request Hardening:** Rejects malformed `http:` and `https:` URLs that omit `//` with `ERR_INVALID_URL`, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local `NO_PROXY` matching. (__#11000__)
+
+## 🐛 Bug Fixes
+
+* **Status Validation:** Added `transitional.validateStatusUndefinedResolves` so applications can opt in to treating `validateStatus: undefined` like the option was omitted, while `validateStatus: null` remains the explicit way to accept every status. (__#10899__)
+
+## 🔧 Maintenance & Chores
+
+* **Documentation:** Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the `proxy` request config as Node.js-only in the advanced docs. (__#10984__, __#10988__, __#10992__, __#10995__)
+
+* **Dependencies:** Bumped `@babel/core`, `@babel/preset-env`, `@commitlint/cli`, `@commitlint/config-conventional`, `@rollup/plugin-babel`, `@rollup/plugin-commonjs`, `@vitest/browser`, `@vitest/browser-playwright`, `eslint`, `lint-staged`, `rollup`, `vitest`, and `actions/checkout`. (__#10989__, __#10996__, __#10997__)
+
+* **Release Metadata:** Prepared the 1.18.0 release by updating package metadata and the runtime `VERSION` value. (__#11003__)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve axios:
+
+* __@drori12__ (__#10984__)
+* __@eyupcanakman__ (__#10899__)
+* __@Adi-Beker__ (__#10995__)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.17.0...v1.18.0)
+
 ## v1.17.0 — June 1, 2026
 
 This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

package/README.md

@@ -298,7 +298,6 @@
     </tr>
 </table>
 
-
 <!--<div>marker</div>-->
 
 <br><br>
@@ -430,6 +429,12 @@ Using bun:
 $ bun add axios
 ```
 
+Using Deno:
+
+```bash
+$ deno add axios
+```
+
 Once the package is installed, import it with `import` or `require`:
 
 ```js
@@ -513,16 +518,16 @@ axios
 // Want to use async/await? Add the `async` keyword to your outer function/method.
 async function getUser() {
   try {
-// Example: GET request with query parameters
-const response = await axios.get('/user', {
-  params: {
-    ID: 12345
-  }
-});
+    // Example: GET request with query parameters
+    const response = await axios.get('/user', {
+      params: {
+        ID: 12345,
+      },
+    });
 
-// Using the `params` option improves readability and automatically formats query strings
+    // Using the `params` option improves readability and automatically formats query strings
 
-console.log(response);
+    console.log(response);
   } catch (error) {
     console.error(error);
   }
@@ -770,6 +775,8 @@ These config options are available for requests. Only `url` is required. Request
 
   // `data` is the data to be sent as the request body
   // Only applicable for request methods 'PUT', 'POST', 'DELETE', and 'PATCH'
+  // `data` is request-specific: axios does not inherit or deep-merge it from defaults.
+  // To add shared body fields, use a request interceptor or transformRequest.
   // When no `transformRequest` is set, it must be of one of the following types:
   // - string, plain object, ArrayBuffer, ArrayBufferView, URLSearchParams
   // - Browser only: FormData, File, Blob
@@ -891,8 +898,11 @@ These config options are available for requests. Only `url` is required. Request
   redact: ['authorization', 'password'],
 
   // `validateStatus` defines whether to resolve or reject the promise for a given
-  // HTTP response status code. If `validateStatus` returns `true` (or is set to `null`
-  // or `undefined`), Axios resolves the promise; otherwise, Axios rejects it.
+  // HTTP response status code. If `validateStatus` returns `true` or is set to
+  // `null`, Axios resolves the promise; otherwise, Axios rejects it.
+  // Explicit `validateStatus: undefined` resolves every status by default for
+  // backward compatibility. Set `transitional.validateStatusUndefinedResolves`
+  // to `false` to make explicit `undefined` behave as if this option was omitted.
   validateStatus: function (status) {
     return status >= 200 && status < 300; // default
   },
@@ -902,9 +912,9 @@ These config options are available for requests. Only `url` is required. Request
   maxRedirects: 21, // default
 
   // `sensitiveHeaders` (Node only option) lists custom secret-bearing headers
-  // to remove from cross-origin redirects. Matching is case-insensitive.
-  // Same-origin redirects keep these headers. If `maxRedirects` is 0, this
-  // option is not used.
+  // (such as `X-API-Key`) to remove from cross-origin redirects. Matching is
+  // case-insensitive. Same-origin redirects keep these headers. If
+  // `maxRedirects` is 0, this option is not used.
   sensitiveHeaders: ['X-API-Key'],
 
   // `beforeRedirect` defines a function that Axios calls before redirect.
@@ -966,6 +976,12 @@ These config options are available for requests. Only `url` is required. Request
   // for your proxy configuration, you can also define a `no_proxy` environment
   // variable as a comma-separated list of domains that should not be proxied.
   // Use `false` to disable proxies, ignoring environment variables.
+  // On Node.js versions with native environment proxy support, axios defers
+  // environment proxy handling to Node when the selected agent has `proxyEnv`
+  // enabled, including processes started with `NODE_USE_ENV_PROXY=1`,
+  // `--use-env-proxy`, or `NODE_OPTIONS=--use-env-proxy`. Custom agents without
+  // `proxyEnv` continue to use axios environment proxy resolution. Explicit
+  // `proxy` config is still handled by axios.
   // `auth` indicates that HTTP Basic auth should be used to connect to the proxy, and
   // supplies credentials.
   // For `http://` targets, axios sends the request to the proxy in
@@ -1042,6 +1058,11 @@ These config options are available for requests. Only `url` is required. Request
     // throw ETIMEDOUT error instead of generic ECONNABORTED on request timeouts
     clarifyTimeoutError: false,
 
+    // keep explicit `validateStatus: undefined` resolving every response status
+    // for backward compatibility. Set to false to make explicit undefined behave
+    // as if validateStatus was omitted.
+    validateStatusUndefinedResolves: true,
+
     // advertise `zstd` in the default Accept-Encoding header when the current
     // Node.js runtime supports zstd decompression. Axios still decompresses
     // zstd responses when support exists and `decompress` is true.
@@ -1072,6 +1093,15 @@ These config options are available for requests. Only `url` is required. Request
 }
 ```
 
+For custom secret-bearing headers in Node.js, list them in `sensitiveHeaders` so Axios removes them when following a redirect to another origin:
+
+```js
+axios.get('https://api.example.com/users', {
+  headers: { 'X-API-Key': 'secret' },
+  sensitiveHeaders: ['X-API-Key'],
+});
+```
+
 ### Strict RFC 3986 percent-encoding for query params
 
 By default, axios decodes `%3A`, `%24`, `%2C` and `%20` back to `:`, `$`, `,` and `+` for readability (the `+` follows the `application/x-www-form-urlencoded` convention for spaces in query strings). These characters are valid in a query component under [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986#section-3.4), so the default output is correct, but some backends require strict percent-encoding and reject the readable form.
@@ -1082,12 +1112,12 @@ Override the default encoder via `paramsSerializer.encode`:
 // Per-request: emit strict RFC 3986 percent-encoding for query values
 axios.get('/foo', {
   params: { filter: JSON.stringify({ startedAt: '2026-01-23' }) },
-  paramsSerializer: { encode: encodeURIComponent }
+  paramsSerializer: { encode: encodeURIComponent },
 });
 
 // Or set it on the instance defaults
 const client = axios.create({
-  paramsSerializer: { encode: encodeURIComponent }
+  paramsSerializer: { encode: encodeURIComponent },
 });
 ```
 
@@ -1176,6 +1206,8 @@ instance.defaults.headers.common['Authorization'] = AUTH_TOKEN;
 
 Axios merges config in this order: library defaults from [lib/defaults/index.js](https://github.com/axios/axios/blob/main/lib/defaults/index.js#L49), the instance `defaults` property, and the request `config` argument. Later values take precedence over earlier ones.
 
+Some options are request-specific and are only taken from the request `config`. `data` is one of those options: axios does not inherit or deep-merge request bodies from global or instance defaults. If every request needs shared body fields, add them with a request interceptor or `transformRequest`, and scope that logic carefully so sensitive values are not sent to the wrong endpoint.
+
 ```js
 // Create an instance using the config defaults provided by the library
 // At this point the timeout config value is `0` as is the default for the library
@@ -1369,7 +1401,7 @@ These are the internal Axios error codes:
 | ERR_INVALID_URL           | Invalid URL provided for axios request.                                                                                                                                                                                                                                                                                                                                                        |
 | ECONNABORTED              | Typically indicates that the request has been timed out (unless `transitional.clarifyTimeoutError` is set) or aborted by the browser or its plugin.                                                                                                                                                                                                                                            |
 | ERR_CANCELED              | The user explicitly canceled the request with an AbortSignal or CancelToken.                                                                                                                                                                                                                                                                                                                   |
-| ETIMEDOUT                 | Request timed out after exceeding the configured Axios timeout. Set `transitional.clarifyTimeoutError` to `true`; otherwise Axios throws a generic `ECONNABORTED` error.                                                                                                                                                                                                                        |
+| ETIMEDOUT                 | Request timed out after exceeding the configured Axios timeout. Set `transitional.clarifyTimeoutError` to `true`; otherwise Axios throws a generic `ECONNABORTED` error.                                                                                                                                                                                                                       |
 | ERR_NETWORK               | Network-related issue. In the browser, this error can also be caused by a [CORS](https://developer.mozilla.org/ru/docs/Web/HTTP/Guides/CORS) or [Mixed Content](https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content) policy violation. The browser does not allow the JS code to clarify the real reason for the error caused by security issues, so please check the console. |
 | ERR_FR_TOO_MANY_REDIRECTS | Request exceeded the configured maximum number of redirects.                                                                                                                                                                                                                                                                                                                                   |
 | ERR_BAD_RESPONSE          | Response cannot be parsed properly or is in an unexpected format. Usually related to a response with `5xx` status code.                                                                                                                                                                                                                                                                        |
@@ -1410,6 +1442,19 @@ axios.get('/user/12345', {
 });
 ```
 
+By default, explicit `validateStatus: undefined` keeps legacy behavior and resolves every response status because `transitional.validateStatusUndefinedResolves` defaults to `true`. Set it to `false` to make explicit `validateStatus: undefined` behave like the option was omitted, so Axios uses the configured/default validator and rejects non-2xx responses by default.
+
+`validateStatus: null` still accepts every response status. If you disable the transitional behavior and intentionally want all statuses to resolve, use `null` or `() => true`.
+
+```js
+axios.get('/user/12345', {
+  validateStatus: undefined,
+  transitional: {
+    validateStatusUndefinedResolves: false,
+  },
+});
+```
+
 Use `toJSON` to get more information about the HTTP error.
 
 ```js
@@ -1421,12 +1466,14 @@ axios.get('/user/12345').catch(function (error) {
 To avoid logging secrets from `error.config`, pass a `redact` array in the request config. Matching config keys are masked case-insensitively at any depth when `AxiosError#toJSON()` is called.
 
 ```js
-axios.get('/user/12345', {
-  headers: { Authorization: 'Bearer token' },
-  redact: ['authorization']
-}).catch(function (error) {
-  console.log(error.toJSON().config.headers.Authorization); // [REDACTED ****]
-});
+axios
+  .get('/user/12345', {
+    headers: { Authorization: 'Bearer token' },
+    redact: ['authorization'],
+  })
+  .catch(function (error) {
+    console.log(error.toJSON().config.headers.Authorization); // [REDACTED ****]
+  });
 ```
 
 ## Handling timeouts
@@ -1536,11 +1583,44 @@ axios.get('/user/12345', {
 cancel();
 ```
 
+`CancelToken` also exposes low-level helpers for legacy integrations:
+
+```js
+const source = axios.CancelToken.source();
+
+const listener = (cancel) => {
+  console.log(cancel.message);
+};
+
+source.token.subscribe(listener);
+
+const signal = source.token.toAbortSignal();
+// Pass `signal` to APIs that accept AbortSignal.
+
+source.cancel('Operation canceled by the user.');
+source.token.unsubscribe(listener);
+```
+
+Canceled requests reject with `axios.CanceledError`. The legacy `axios.Cancel` export is an alias of `axios.CanceledError`, and cancellation errors include `__CANCEL__` for `axios.isCancel` compatibility.
+
 > Note: You can cancel several requests with the same cancel token or abort controller.
 > If a cancellation token is already cancelled when an Axios request starts, Axios cancels the request immediately without making a real request.
 
 > During the transition period, you can use both cancellation APIs, even for the same request:
 
+```js
+const controller = new AbortController();
+const source = axios.CancelToken.source();
+
+axios.get('/user/12345', {
+  cancelToken: source.token,
+  signal: controller.signal,
+});
+
+controller.abort();
+source.cancel('Operation canceled by the user.');
+```
+
 ## Using `application/x-www-form-urlencoded` format
 
 ### URLSearchParams
@@ -1742,6 +1822,9 @@ FormData serializer supports additional options via `config.formSerializer: obje
   input object exceeds this depth, an `AxiosError` with `code: 'ERR_FORM_DATA_DEPTH_EXCEEDED'` is
   thrown instead of overflowing the call stack. This protects server applications from DoS
   attacks via deeply nested payloads. Set to `Infinity` to disable the limit and restore pre-fix behaviour.
+- `Blob: typeof Blob` - Blob constructor used when converting ArrayBuffer-like values for spec-compliant
+  `FormData`. Override it only for runtimes that provide a compatible `Blob` constructor under a
+  different binding.
 
 ```js
 // Raise the limit for a schema that genuinely nests deeper than 100 levels:
@@ -2068,6 +2151,7 @@ console.log(headers);
 set(headerName, value: Axios, rewrite?: boolean);
 set(headerName, value, rewrite?: (this: AxiosHeaders, value: string, name: string, headers: RawAxiosHeaders) => boolean);
 set(headers?: RawAxiosHeaders | AxiosHeaders | string, rewrite?: boolean);
+set(headers?: Iterable<[string, AxiosHeaderValue]>, rewrite?: boolean);
 ```
 
 The `rewrite` argument controls the overwriting behavior:
@@ -2080,6 +2164,19 @@ The option can also accept a user-defined function that determines whether to ov
 
 Empty or whitespace-only header names are ignored.
 
+Iterable key/value pairs, such as a `Map`, are accepted:
+
+```js
+const headers = new AxiosHeaders();
+
+headers.set(
+  new Map([
+    ['X-Trace-Id', 'abc123'],
+    ['Accept', 'application/json'],
+  ])
+);
+```
+
 Returns `this`.
 
 ### AxiosHeaders#get(header)
@@ -2200,6 +2297,14 @@ toJSON(asStrings?: false): Record<string, string | string[]>;
 Resolves all internal header values into a new null prototype object.
 Set `asStrings` to true to resolve arrays as a string containing all elements, separated by commas.
 
+### AxiosHeaders#toString()
+
+```
+toString(): string;
+```
+
+Returns the headers as a CRLF-free HTTP header block, one `name: value` pair per line.
+
 ### AxiosHeaders.from(thing?)
 
 ```

package/dist/axios.js

@@ -1,4 +1,4 @@
-/*! Axios v1.18.0 Copyright (c) 2026 Matt Zabriskie and contributors */
+/*! Axios v1.18.1 Copyright (c) 2026 Matt Zabriskie and contributors */
 (function (global, factory) {
   typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
   typeof define === 'function' && define.amd ? define(factory) :
@@ -2040,7 +2040,19 @@
       key: "from",
       value: function from(error, code, config, request, response, customProps) {
         var axiosError = new AxiosError(error.message, code || error.code, config, request, response);
-        axiosError.cause = error;
+        // Match native `Error` `cause` semantics: non-enumerable. The wrapped
+        // error often carries circular internals (sockets, requests, agents), so
+        // an enumerable `cause` makes structured loggers (pino/winston) and any
+        // own-property walk throw "Converting circular structure to JSON".
+        // Regression from #6982; see #7205. `__proto__: null` mirrors the
+        // `message` descriptor below (prototype-pollution-safe descriptor).
+        Object.defineProperty(axiosError, 'cause', {
+          __proto__: null,
+          value: error,
+          writable: true,
+          enumerable: false,
+          configurable: true
+        });
         axiosError.name = error.name;
 
         // Preserve status from the original error if not already set from response
@@ -2192,7 +2204,13 @@
         throw new AxiosError('Blob is not supported. Use a Buffer instead.');
       }
       if (utils$1.isArrayBuffer(value) || utils$1.isTypedArray(value)) {
-        return useBlob && typeof Blob === 'function' ? new Blob([value]) : Buffer.from(value);
+        if (useBlob && typeof _Blob === 'function') {
+          return new _Blob([value]);
+        }
+        if (typeof Buffer !== 'undefined') {
+          return Buffer.from(value);
+        }
+        throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT);
       }
       return value;
     }
@@ -2325,8 +2343,9 @@
     this._pairs.push([name, value]);
   };
   prototype.toString = function toString(encoder) {
+    var _this = this;
     var _encode = encoder ? function (value) {
-      return encoder.call(this, value, encode$1);
+      return encoder.call(_this, value, encode$1);
     } : encode$1;
     return this._pairs.map(function each(pair) {
       return _encode(pair[0]) + '=' + _encode(pair[1]);
@@ -2358,6 +2377,7 @@
     if (!params) {
       return url;
     }
+    url = url || '';
     var _options = utils$1.isFunction(options) ? {
       serialize: options
     } : options;
@@ -3005,7 +3025,11 @@
         var cookie = cookies[i].replace(/^\s+/, '');
         var eq = cookie.indexOf('=');
         if (eq !== -1 && cookie.slice(0, eq) === name) {
-          return decodeURIComponent(cookie.slice(eq + 1));
+          try {
+            return decodeURIComponent(cookie.slice(eq + 1));
+          } catch (e) {
+            return cookie.slice(eq + 1);
+          }
         }
       }
       return null;
@@ -3105,6 +3129,7 @@
    */
   function mergeConfig(config1, config2) {
     // eslint-disable-next-line no-param-reassign
+    config1 = config1 || {};
     config2 = config2 || {};
 
     // Use a null-prototype object so that downstream reads such as `config.auth`
@@ -3240,7 +3265,7 @@
       headers.set(formHeaders);
       return;
     }
-    Object.entries(formHeaders).forEach(function (_ref) {
+    Object.entries(formHeaders || {}).forEach(function (_ref) {
       var _ref2 = _slicedToArray(_ref, 2),
         key = _ref2[0],
         val = _ref2[1];
@@ -3287,7 +3312,11 @@
     if (auth) {
       var username = utils$1.getSafeProp(auth, 'username') || '';
       var password = utils$1.getSafeProp(auth, 'password') || '';
-      headers.set('Authorization', 'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : '')));
+      try {
+        headers.set('Authorization', 'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : '')));
+      } catch (e) {
+        throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);
+      }
     }
     if (utils$1.isFormData(data)) {
       if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv || utils$1.isReactNative(data)) {
@@ -3492,6 +3521,7 @@
       var protocol = parseProtocol(_config.url);
       if (protocol && !platform.protocols.includes(protocol)) {
         reject(new AxiosError('Unsupported protocol ' + protocol + ':', AxiosError.ERR_BAD_REQUEST, config));
+        done();
         return;
       }
 
@@ -3531,7 +3561,9 @@
       signals = null;
     };
     signals.forEach(function (signal) {
-      return signal.addEventListener('abort', onabort);
+      return signal.addEventListener('abort', onabort, {
+        once: true
+      });
     });
     var signal = controller.signal;
     signal.unsubscribe = function () {
@@ -3841,7 +3873,7 @@
     return bytes;
   }
 
-  var VERSION = "1.18.0";
+  var VERSION = "1.18.1";
 
   var DEFAULT_CHUNK_SIZE = 64 * 1024;
   var isFunction = utils$1.isFunction;
@@ -4045,7 +4077,7 @@
     }();
     return /*#__PURE__*/function () {
       var _ref4 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(config) {
-        var _resolveConfig, url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, _resolveConfig$withCr, withCredentials, fetchOptions, maxContentLength, maxBodyLength, hasMaxContentLength, hasMaxBodyLength, own, _fetch, composedSignal, request, unsubscribe, requestContentLength, pendingBodyError, maxBodyLengthError, auth, configAuth, username, password, parsedURL, urlUsername, urlPassword, estimated, outboundLength, mustEnforceStreamBody, trackRequestStream, _request, contentTypeHeader, _ref5, _ref6, onProgress, flush, isCredentialsSupported, contentType, resolvedOptions, response, responseHeaders, declaredLength, isStreamResponse, options, responseContentLength, _ref7, _ref8, _onProgress, _flush, bytesRead, onChunkProgress, responseData, materializedSize, canceledError, _t3, _t4;
+        var _resolveConfig, url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, _resolveConfig$withCr, withCredentials, fetchOptions, maxContentLength, maxBodyLength, hasMaxContentLength, hasMaxBodyLength, own, _fetch, composedSignal, request, unsubscribe, requestContentLength, pendingBodyError, maxBodyLengthError, auth, configAuth, username, password, parsedURL, urlUsername, urlPassword, estimated, outboundLength, mustEnforceStreamBody, trackRequestStream, _request, contentTypeHeader, _ref5, _ref6, onProgress, flush, isCredentialsSupported, contentType, resolvedOptions, response, responseHeaders, declaredLength, isStreamResponse, options, responseContentLength, _ref7, _ref8, _onProgress, _flush, bytesRead, onChunkProgress, responseData, materializedSize, canceledError, networkError, _t3, _t4;
         return _regenerator().w(function (_context4) {
           while (1) switch (_context4.p = _context4.n) {
             case 0:
@@ -4317,7 +4349,17 @@
               canceledError = composedSignal.reason;
               canceledError.config = config;
               request && (canceledError.request = request);
-              _t4 !== canceledError && (canceledError.cause = _t4);
+              if (_t4 !== canceledError) {
+                // Non-enumerable to match native Error `cause` semantics so loggers
+                // don't recurse into circular fetch internals (see #7205).
+                Object.defineProperty(canceledError, 'cause', {
+                  __proto__: null,
+                  value: _t4,
+                  writable: true,
+                  enumerable: false,
+                  configurable: true
+                });
+              }
               throw canceledError;
             case 17:
               if (!pendingBodyError) {
@@ -4338,9 +4380,16 @@
                 _context4.n = 20;
                 break;
               }
-              throw Object.assign(new AxiosError('Network Error', AxiosError.ERR_NETWORK, config, request, _t4 && _t4.response), {
-                cause: _t4.cause || _t4
+              networkError = new AxiosError('Network Error', AxiosError.ERR_NETWORK, config, request, _t4 && _t4.response); // Non-enumerable to match native Error `cause` semantics so loggers
+              // don't recurse into circular fetch internals (see #7205).
+              Object.defineProperty(networkError, 'cause', {
+                __proto__: null,
+                value: _t4.cause || _t4,
+                writable: true,
+                enumerable: false,
+                configurable: true
               });
+              throw networkError;
             case 20:
               throw AxiosError.from(_t4, _t4 && _t4.code, config, request, _t4 && _t4.response);
             case 21:
@@ -4472,7 +4521,7 @@
         return "adapter ".concat(id, " ") + (state === false ? 'is not supported by the environment' : 'is not available in the build');
       });
       var s = length ? reasons.length > 1 ? 'since :\n' + reasons.map(renderReason).join('\n') : ' ' + renderReason(reasons[0]) : 'as no adapter specified';
-      throw new AxiosError("There is no suitable adapter to dispatch the request " + s, 'ERR_NOT_SUPPORT');
+      throw new AxiosError("There is no suitable adapter to dispatch the request " + s, AxiosError.ERR_NOT_SUPPORT);
     }
     return adapter;
   }
@@ -4615,7 +4664,7 @@
    */
 
   function assertOptions(options, schema, allowUnknown) {
-    if (_typeof(options) !== 'object') {
+    if (_typeof(options) !== 'object' || options === null) {
       throw new AxiosError('options must be an object', AxiosError.ERR_BAD_OPTION_VALUE);
     }
     var keys = Object.keys(options);