axios 1.7.9 → 1.8.0

package/lib/core/Axios.js

@@ -97,6 +97,15 @@ class Axios {
       }
     }
 
+    // Set config.allowAbsoluteUrls
+    if (config.allowAbsoluteUrls !== undefined) {
+      // do nothing
+    } else if (this.defaults.allowAbsoluteUrls !== undefined) {
+      config.allowAbsoluteUrls = this.defaults.allowAbsoluteUrls;
+    } else {
+      config.allowAbsoluteUrls = true;
+    }
+
     validator.assertOptions(config, {
       baseUrl: validators.spelling('baseURL'),
       withXsrfToken: validators.spelling('withXSRFToken')
@@ -192,7 +201,7 @@ class Axios {
 
   getUri(config) {
     config = mergeConfig(this.defaults, config);
-    const fullPath = buildFullPath(config.baseURL, config.url);
+    const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls);
     return buildURL(fullPath, config.params, config.paramsSerializer);
   }
 }

package/lib/core/buildFullPath.js

@@ -13,8 +13,9 @@ import combineURLs from '../helpers/combineURLs.js';
  *
  * @returns {string} The combined full path
  */
-export default function buildFullPath(baseURL, requestedURL) {
-  if (baseURL && !isAbsoluteURL(requestedURL)) {
+export default function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
+  let isRelativeUrl = !isAbsoluteURL(requestedURL);
+  if (baseURL && isRelativeUrl || allowAbsoluteUrls == false) {
     return combineURLs(baseURL, requestedURL);
   }
   return requestedURL;

package/lib/env/data.js

@@ -1 +1 @@
-export const VERSION = "1.7.9";
+export const VERSION = "1.8.0";

package/lib/utils.js

@@ -1,6 +1,7 @@
 'use strict';
 
 import bind from './helpers/bind.js';
+import crypto from 'crypto';
 
 // utils is a library of generic helper functions non-specific to axios
 
@@ -615,8 +616,10 @@ const ALPHABET = {
 const generateString = (size = 16, alphabet = ALPHABET.ALPHA_DIGIT) => {
   let str = '';
   const {length} = alphabet;
-  while (size--) {
-    str += alphabet[Math.random() * length|0]
+  const randomValues = new Uint32Array(size);
+  crypto.randomFillSync(randomValues);
+  for (let i = 0; i < size; i++) {
+    str += alphabet[randomValues[i] % length];
   }
 
   return str;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "axios",
-  "version": "1.7.9",
+  "version": "1.8.0",
   "description": "Promise based HTTP client for the browser and node.js",
   "main": "index.js",
   "exports": {
@@ -163,12 +163,12 @@
     "Dmitriy Mozgovoy (https://github.com/DigitalBrainJS)",
     "Jay (https://github.com/jasonsaayman)",
     "Emily Morehouse (https://github.com/emilyemorehouse)",
-    "Justin Beckwith (https://github.com/JustinBeckwith)",
     "Rubén Norte (https://github.com/rubennorte)",
+    "Justin Beckwith (https://github.com/JustinBeckwith)",
     "Martti Laine (https://github.com/codeclown)",
     "Xianming Zhong (https://github.com/chinesedfan)",
-    "Remco Haszing (https://github.com/remcohaszing)",
     "Rikki Gibson (https://github.com/RikkiGibson)",
+    "Remco Haszing (https://github.com/remcohaszing)",
     "Yasu Flores (https://github.com/yasuf)",
     "Ben Carp (https://github.com/carpben)"
   ],

package/SECURITY.md

@@ -1,6 +0,0 @@
-# Reporting a Vulnerability
-
-If you discover a security vulnerability in axios please disclose it via [our huntr page](https://huntr.dev/repos/axios/axios/). Bounty eligibility, CVE assignment, response times and past reports are all there.
-
-
-Thank you for improving the security of axios.