seatable-html-page-sdk 0.0.11 → 0.0.13-beta.1

package/dist/index.js

@@ -51,7 +51,7 @@
    *
    * @returns {boolean} True if the value is undefined, otherwise false
    */
-  const isUndefined = typeOfTest("undefined");
+  const isUndefined = typeOfTest('undefined');
 
   /**
    * Determine if a value is a Buffer
@@ -78,7 +78,7 @@
    *
    * @returns {boolean} True if value is an ArrayBuffer, otherwise false
    */
-  const isArrayBuffer = kindOfTest("ArrayBuffer");
+  const isArrayBuffer = kindOfTest('ArrayBuffer');
 
   /**
    * Determine if a value is a view on an ArrayBuffer
@@ -89,7 +89,7 @@
    */
   function isArrayBufferView(val) {
     let result;
-    if (typeof ArrayBuffer !== "undefined" && ArrayBuffer.isView) {
+    if (typeof ArrayBuffer !== 'undefined' && ArrayBuffer.isView) {
       result = ArrayBuffer.isView(val);
     } else {
       result = val && val.buffer && isArrayBuffer(val.buffer);
@@ -104,7 +104,7 @@
    *
    * @returns {boolean} True if value is a String, otherwise false
    */
-  const isString = typeOfTest("string");
+  const isString = typeOfTest('string');
 
   /**
    * Determine if a value is a Function
@@ -112,7 +112,7 @@
    * @param {*} val The value to test
    * @returns {boolean} True if value is a Function, otherwise false
    */
-  const isFunction$1 = typeOfTest("function");
+  const isFunction$1 = typeOfTest('function');
 
   /**
    * Determine if a value is a Number
@@ -121,7 +121,7 @@
    *
    * @returns {boolean} True if value is a Number, otherwise false
    */
-  const isNumber = typeOfTest("number");
+  const isNumber = typeOfTest('number');
 
   /**
    * Determine if a value is an Object
@@ -130,7 +130,7 @@
    *
    * @returns {boolean} True if value is an Object, otherwise false
    */
-  const isObject = (thing) => thing !== null && typeof thing === "object";
+  const isObject = (thing) => thing !== null && typeof thing === 'object';
 
   /**
    * Determine if a value is a Boolean
@@ -148,7 +148,7 @@
    * @returns {boolean} True if value is a plain Object, otherwise false
    */
   const isPlainObject = (val) => {
-    if (kindOf(val) !== "object") {
+    if (kindOf(val) !== 'object') {
       return false;
     }
 
@@ -176,10 +176,7 @@
     }
 
     try {
-      return (
-        Object.keys(val).length === 0 &&
-        Object.getPrototypeOf(val) === Object.prototype
-      );
+      return Object.keys(val).length === 0 && Object.getPrototypeOf(val) === Object.prototype;
     } catch (e) {
       // Fallback for any other objects that might cause RangeError with Object.keys()
       return false;
@@ -193,7 +190,7 @@
    *
    * @returns {boolean} True if value is a Date, otherwise false
    */
-  const isDate = kindOfTest("Date");
+  const isDate = kindOfTest('Date');
 
   /**
    * Determine if a value is a File
@@ -202,7 +199,32 @@
    *
    * @returns {boolean} True if value is a File, otherwise false
    */
-  const isFile = kindOfTest("File");
+  const isFile = kindOfTest('File');
+
+  /**
+   * Determine if a value is a React Native Blob
+   * React Native "blob": an object with a `uri` attribute. Optionally, it can
+   * also have a `name` and `type` attribute to specify filename and content type
+   *
+   * @see https://github.com/facebook/react-native/blob/26684cf3adf4094eb6c405d345a75bf8c7c0bf88/Libraries/Network/FormData.js#L68-L71
+   * 
+   * @param {*} value The value to test
+   * 
+   * @returns {boolean} True if value is a React Native Blob, otherwise false
+   */
+  const isReactNativeBlob = (value) => {
+    return !!(value && typeof value.uri !== 'undefined');
+  };
+
+  /**
+   * Determine if environment is React Native
+   * ReactNative `FormData` has a non-standard `getParts()` method
+   * 
+   * @param {*} formData The formData to test
+   * 
+   * @returns {boolean} True if environment is React Native, otherwise false
+   */
+  const isReactNative = (formData) => formData && typeof formData.getParts !== 'undefined';
 
   /**
    * Determine if a value is a Blob
@@ -211,7 +233,7 @@
    *
    * @returns {boolean} True if value is a Blob, otherwise false
    */
-  const isBlob = kindOfTest("Blob");
+  const isBlob = kindOfTest('Blob');
 
   /**
    * Determine if a value is a FileList
@@ -220,7 +242,7 @@
    *
    * @returns {boolean} True if value is a File, otherwise false
    */
-  const isFileList = kindOfTest("FileList");
+  const isFileList = kindOfTest('FileList');
 
   /**
    * Determine if a value is a Stream
@@ -238,18 +260,28 @@
    *
    * @returns {boolean} True if value is an FormData, otherwise false
    */
+  function getGlobal() {
+    if (typeof globalThis !== 'undefined') return globalThis;
+    if (typeof self !== 'undefined') return self;
+    if (typeof window !== 'undefined') return window;
+    if (typeof global !== 'undefined') return global;
+    return {};
+  }
+
+  const G = getGlobal();
+  const FormDataCtor = typeof G.FormData !== 'undefined' ? G.FormData : undefined;
+
   const isFormData = (thing) => {
-    let kind;
-    return (
-      thing &&
-      ((typeof FormData === "function" && thing instanceof FormData) ||
-        (isFunction$1(thing.append) &&
-          ((kind = kindOf(thing)) === "formdata" ||
-            // detect form-data instance
-            (kind === "object" &&
-              isFunction$1(thing.toString) &&
-              thing.toString() === "[object FormData]"))))
-    );
+    if (!thing) return false;
+    if (FormDataCtor && thing instanceof FormDataCtor) return true;
+    // Reject plain objects inheriting directly from Object.prototype so prototype-pollution gadgets can't spoof FormData (GHSA-6chq-wfr3-2hj9).
+    const proto = getPrototypeOf(thing);
+    if (!proto || proto === Object.prototype) return false;
+    if (!isFunction$1(thing.append)) return false;
+    const kind = kindOf(thing);
+    return kind === 'formdata' ||
+      // detect form-data instance
+      (kind === 'object' && isFunction$1(thing.toString) && thing.toString() === '[object FormData]');
   };
 
   /**
@@ -259,13 +291,13 @@
    *
    * @returns {boolean} True if value is a URLSearchParams object, otherwise false
    */
-  const isURLSearchParams = kindOfTest("URLSearchParams");
+  const isURLSearchParams = kindOfTest('URLSearchParams');
 
   const [isReadableStream, isRequest, isResponse, isHeaders] = [
-    "ReadableStream",
-    "Request",
-    "Response",
-    "Headers",
+    'ReadableStream',
+    'Request',
+    'Response',
+    'Headers',
   ].map(kindOfTest);
 
   /**
@@ -275,9 +307,9 @@
    *
    * @returns {String} The String freed of excess whitespace
    */
-  const trim = (str) =>
-    str.trim ? str.trim() : str.replace(/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g, "");
-
+  const trim = (str) => {
+    return str.trim ? str.trim() : str.replace(/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g, '');
+  };
   /**
    * Iterate over an Array or an Object invoking a function for each item.
    *
@@ -296,7 +328,7 @@
    */
   function forEach(obj, fn, { allOwnKeys = false } = {}) {
     // Don't bother if no value provided
-    if (obj === null || typeof obj === "undefined") {
+    if (obj === null || typeof obj === 'undefined') {
       return;
     }
 
@@ -304,7 +336,7 @@
     let l;
 
     // Force an array if not already something iterable
-    if (typeof obj !== "object") {
+    if (typeof obj !== 'object') {
       /*eslint no-param-reassign:0*/
       obj = [obj];
     }
@@ -321,9 +353,7 @@
       }
 
       // Iterate over object keys
-      const keys = allOwnKeys
-        ? Object.getOwnPropertyNames(obj)
-        : Object.keys(obj);
+      const keys = allOwnKeys ? Object.getOwnPropertyNames(obj) : Object.keys(obj);
       const len = keys.length;
       let key;
 
@@ -334,6 +364,14 @@
     }
   }
 
+  /**
+   * Finds a key in an object, case-insensitive, returning the actual key name.
+   * Returns null if the object is a Buffer or if no match is found.
+   *
+   * @param {Object} obj - The object to search.
+   * @param {string} key - The key to find (case-insensitive).
+   * @returns {?string} The actual key name if found, otherwise null.
+   */
   function findKey(obj, key) {
     if (isBuffer(obj)) {
       return null;
@@ -354,16 +392,11 @@
 
   const _global = (() => {
     /*eslint no-undef:0*/
-    if (typeof globalThis !== "undefined") return globalThis;
-    return typeof self !== "undefined"
-      ? self
-      : typeof window !== "undefined"
-        ? window
-        : global;
+    if (typeof globalThis !== 'undefined') return globalThis;
+    return typeof self !== 'undefined' ? self : typeof window !== 'undefined' ? window : global;
   })();
 
-  const isContextDefined = (context) =>
-    !isUndefined(context) && context !== _global;
+  const isContextDefined = (context) => !isUndefined(context) && context !== _global;
 
   /**
    * Accepts varargs expecting each argument to be an object, then
@@ -388,7 +421,7 @@
     const result = {};
     const assignValue = (val, key) => {
       // Skip dangerous property names to prevent prototype pollution
-      if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
         return;
       }
 
@@ -441,7 +474,7 @@
           });
         }
       },
-      { allOwnKeys },
+      { allOwnKeys }
     );
     return a;
   };
@@ -470,17 +503,14 @@
    * @returns {void}
    */
   const inherits = (constructor, superConstructor, props, descriptors) => {
-    constructor.prototype = Object.create(
-      superConstructor.prototype,
-      descriptors,
-    );
-    Object.defineProperty(constructor.prototype, "constructor", {
+    constructor.prototype = Object.create(superConstructor.prototype, descriptors);
+    Object.defineProperty(constructor.prototype, 'constructor', {
       value: constructor,
       writable: true,
       enumerable: false,
       configurable: true,
     });
-    Object.defineProperty(constructor, "super", {
+    Object.defineProperty(constructor, 'super', {
       value: superConstructor.prototype,
     });
     props && Object.assign(constructor.prototype, props);
@@ -510,20 +540,13 @@
       i = props.length;
       while (i-- > 0) {
         prop = props[i];
-        if (
-          (!propFilter || propFilter(prop, sourceObj, destObj)) &&
-          !merged[prop]
-        ) {
+        if ((!propFilter || propFilter(prop, sourceObj, destObj)) && !merged[prop]) {
           destObj[prop] = sourceObj[prop];
           merged[prop] = true;
         }
       }
       sourceObj = filter !== false && getPrototypeOf(sourceObj);
-    } while (
-      sourceObj &&
-      (!filter || filter(sourceObj, destObj)) &&
-      sourceObj !== Object.prototype
-    );
+    } while (sourceObj && (!filter || filter(sourceObj, destObj)) && sourceObj !== Object.prototype);
 
     return destObj;
   };
@@ -580,7 +603,7 @@
     return (thing) => {
       return TypedArray && thing instanceof TypedArray;
     };
-  })(typeof Uint8Array !== "undefined" && getPrototypeOf(Uint8Array));
+  })(typeof Uint8Array !== 'undefined' && getPrototypeOf(Uint8Array));
 
   /**
    * For each entry in the object, call the function with the key and value.
@@ -623,14 +646,12 @@
   };
 
   /* Checking if the kindOfTest function returns true when passed an HTMLFormElement. */
-  const isHTMLForm = kindOfTest("HTMLFormElement");
+  const isHTMLForm = kindOfTest('HTMLFormElement');
 
   const toCamelCase = (str) => {
-    return str
-      .toLowerCase()
-      .replace(/[-_\s]([a-z\d])(\w*)/g, function replacer(m, p1, p2) {
-        return p1.toUpperCase() + p2;
-      });
+    return str.toLowerCase().replace(/[-_\s]([a-z\d])(\w*)/g, function replacer(m, p1, p2) {
+      return p1.toUpperCase() + p2;
+    });
   };
 
   /* Creating a function that will check if an object has a property. */
@@ -647,7 +668,7 @@
    *
    * @returns {boolean} True if value is a RegExp object, otherwise false
    */
-  const isRegExp = kindOfTest("RegExp");
+  const isRegExp = kindOfTest('RegExp');
 
   const reduceDescriptors = (obj, reducer) => {
     const descriptors = Object.getOwnPropertyDescriptors(obj);
@@ -671,10 +692,7 @@
   const freezeMethods = (obj) => {
     reduceDescriptors(obj, (descriptor, name) => {
       // skip restricted props in strict mode
-      if (
-        isFunction$1(obj) &&
-        ["arguments", "caller", "callee"].indexOf(name) !== -1
-      ) {
+      if (isFunction$1(obj) && ['arguments', 'caller', 'callee'].indexOf(name) !== -1) {
         return false;
       }
 
@@ -684,7 +702,7 @@
 
       descriptor.enumerable = false;
 
-      if ("writable" in descriptor) {
+      if ('writable' in descriptor) {
         descriptor.writable = false;
         return;
       }
@@ -697,6 +715,14 @@
     });
   };
 
+  /**
+   * Converts an array or a delimited string into an object set with values as keys and true as values.
+   * Useful for fast membership checks.
+   *
+   * @param {Array|string} arrayOrString - The array or string to convert.
+   * @param {string} delimiter - The delimiter to use if input is a string.
+   * @returns {Object} An object with keys from the array or string, values set to true.
+   */
   const toObjectSet = (arrayOrString, delimiter) => {
     const obj = {};
 
@@ -706,9 +732,7 @@
       });
     };
 
-    isArray(arrayOrString)
-      ? define(arrayOrString)
-      : define(String(arrayOrString).split(delimiter));
+    isArray(arrayOrString) ? define(arrayOrString) : define(String(arrayOrString).split(delimiter));
 
     return obj;
   };
@@ -716,9 +740,7 @@
   const noop = () => {};
 
   const toFiniteNumber = (value, defaultValue) => {
-    return value != null && Number.isFinite((value = +value))
-      ? value
-      : defaultValue;
+    return value != null && Number.isFinite((value = +value)) ? value : defaultValue;
   };
 
   /**
@@ -732,11 +754,17 @@
     return !!(
       thing &&
       isFunction$1(thing.append) &&
-      thing[toStringTag] === "FormData" &&
+      thing[toStringTag] === 'FormData' &&
       thing[iterator]
     );
   }
 
+  /**
+   * Recursively converts an object to a JSON-compatible object, handling circular references and Buffers.
+   *
+   * @param {Object} obj - The object to convert.
+   * @returns {Object} The JSON-compatible object.
+   */
   const toJSONObject = (obj) => {
     const stack = new Array(10);
 
@@ -751,7 +779,7 @@
           return source;
         }
 
-        if (!("toJSON" in source)) {
+        if (!('toJSON' in source)) {
           stack[i] = source;
           const target = isArray(source) ? [] : {};
 
@@ -772,8 +800,20 @@
     return visit(obj, 0);
   };
 
-  const isAsyncFn = kindOfTest("AsyncFunction");
+  /**
+   * Determines if a value is an async function.
+   *
+   * @param {*} thing - The value to test.
+   * @returns {boolean} True if value is an async function, otherwise false.
+   */
+  const isAsyncFn = kindOfTest('AsyncFunction');
 
+  /**
+   * Determines if a value is thenable (has then and catch methods).
+   *
+   * @param {*} thing - The value to test.
+   * @returns {boolean} True if value is thenable, otherwise false.
+   */
   const isThenable = (thing) =>
     thing &&
     (isObject(thing) || isFunction$1(thing)) &&
@@ -783,6 +823,14 @@
   // original code
   // https://github.com/DigitalBrainJS/AxiosPromise/blob/16deab13710ec09779922131f3fa5954320f83ab/lib/utils.js#L11-L34
 
+  /**
+   * Provides a cross-platform setImmediate implementation.
+   * Uses native setImmediate if available, otherwise falls back to postMessage or setTimeout.
+   *
+   * @param {boolean} setImmediateSupported - Whether setImmediate is supported.
+   * @param {boolean} postMessageSupported - Whether postMessage is supported.
+   * @returns {Function} A function to schedule a callback asynchronously.
+   */
   const _setImmediate = ((setImmediateSupported, postMessageSupported) => {
     if (setImmediateSupported) {
       return setImmediate;
@@ -791,27 +839,33 @@
     return postMessageSupported
       ? ((token, callbacks) => {
           _global.addEventListener(
-            "message",
+            'message',
             ({ source, data }) => {
               if (source === _global && data === token) {
                 callbacks.length && callbacks.shift()();
               }
             },
-            false,
+            false
           );
 
           return (cb) => {
             callbacks.push(cb);
-            _global.postMessage(token, "*");
+            _global.postMessage(token, '*');
           };
         })(`axios@${Math.random()}`, [])
       : (cb) => setTimeout(cb);
-  })(typeof setImmediate === "function", isFunction$1(_global.postMessage));
+  })(typeof setImmediate === 'function', isFunction$1(_global.postMessage));
 
+  /**
+   * Schedules a microtask or asynchronous callback as soon as possible.
+   * Uses queueMicrotask if available, otherwise falls back to process.nextTick or _setImmediate.
+   *
+   * @type {Function}
+   */
   const asap =
-    typeof queueMicrotask !== "undefined"
+    typeof queueMicrotask !== 'undefined'
       ? queueMicrotask.bind(_global)
-      : (typeof process !== "undefined" && process.nextTick) || _setImmediate;
+      : (typeof process !== 'undefined' && process.nextTick) || _setImmediate;
 
   // *********************
 
@@ -836,6 +890,8 @@
     isUndefined,
     isDate,
     isFile,
+    isReactNativeBlob,
+    isReactNative,
     isBlob,
     isRegExp,
     isFunction: isFunction$1,
@@ -878,57 +934,74 @@
   };
 
   class AxiosError extends Error {
-      static from(error, code, config, request, response, customProps) {
-          const axiosError = new AxiosError(error.message, code || error.code, config, request, response);
-          axiosError.cause = error;
-          axiosError.name = error.name;
-          customProps && Object.assign(axiosError, customProps);
-          return axiosError;
+    static from(error, code, config, request, response, customProps) {
+      const axiosError = new AxiosError(error.message, code || error.code, config, request, response);
+      axiosError.cause = error;
+      axiosError.name = error.name;
+
+      // Preserve status from the original error if not already set from response
+      if (error.status != null && axiosError.status == null) {
+        axiosError.status = error.status;
       }
 
-      /**
-       * Create an Error with the specified message, config, error code, request and response.
-       *
-       * @param {string} message The error message.
-       * @param {string} [code] The error code (for example, 'ECONNABORTED').
-       * @param {Object} [config] The config.
-       * @param {Object} [request] The request.
-       * @param {Object} [response] The response.
-       *
-       * @returns {Error} The created error.
-       */
-      constructor(message, code, config, request, response) {
-          super(message);
-          this.name = 'AxiosError';
-          this.isAxiosError = true;
-          code && (this.code = code);
-          config && (this.config = config);
-          request && (this.request = request);
-          if (response) {
-              this.response = response;
-              this.status = response.status;
-          }
-      }
+      customProps && Object.assign(axiosError, customProps);
+      return axiosError;
+    }
 
-      toJSON() {
-          return {
-              // Standard
-              message: this.message,
-              name: this.name,
-              // Microsoft
-              description: this.description,
-              number: this.number,
-              // Mozilla
-              fileName: this.fileName,
-              lineNumber: this.lineNumber,
-              columnNumber: this.columnNumber,
-              stack: this.stack,
-              // Axios
-              config: utils$1.toJSONObject(this.config),
-              code: this.code,
-              status: this.status,
-          };
+    /**
+     * Create an Error with the specified message, config, error code, request and response.
+     *
+     * @param {string} message The error message.
+     * @param {string} [code] The error code (for example, 'ECONNABORTED').
+     * @param {Object} [config] The config.
+     * @param {Object} [request] The request.
+     * @param {Object} [response] The response.
+     *
+     * @returns {Error} The created error.
+     */
+    constructor(message, code, config, request, response) {
+      super(message);
+
+      // Make message enumerable to maintain backward compatibility
+      // The native Error constructor sets message as non-enumerable,
+      // but axios < v1.13.3 had it as enumerable
+      Object.defineProperty(this, 'message', {
+        value: message,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      });
+
+      this.name = 'AxiosError';
+      this.isAxiosError = true;
+      code && (this.code = code);
+      config && (this.config = config);
+      request && (this.request = request);
+      if (response) {
+        this.response = response;
+        this.status = response.status;
       }
+    }
+
+    toJSON() {
+      return {
+        // Standard
+        message: this.message,
+        name: this.name,
+        // Microsoft
+        description: this.description,
+        number: this.number,
+        // Mozilla
+        fileName: this.fileName,
+        lineNumber: this.lineNumber,
+        columnNumber: this.columnNumber,
+        stack: this.stack,
+        // Axios
+        config: utils$1.toJSONObject(this.config),
+        code: this.code,
+        status: this.status,
+      };
+    }
   }
 
   // This can be changed to static properties as soon as the parser options in .eslint.cjs are updated.
@@ -944,6 +1017,7 @@
   AxiosError.ERR_CANCELED = 'ERR_CANCELED';
   AxiosError.ERR_NOT_SUPPORT = 'ERR_NOT_SUPPORT';
   AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL';
+  AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED';
 
   var AxiosError$1 = AxiosError;
 
@@ -983,11 +1057,14 @@
    */
   function renderKey(path, key, dots) {
     if (!path) return key;
-    return path.concat(key).map(function each(token, i) {
-      // eslint-disable-next-line no-param-reassign
-      token = removeBrackets(token);
-      return !dots && i ? '[' + token + ']' : token;
-    }).join(dots ? '.' : '');
+    return path
+      .concat(key)
+      .map(function each(token, i) {
+        // eslint-disable-next-line no-param-reassign
+        token = removeBrackets(token);
+        return !dots && i ? '[' + token + ']' : token;
+      })
+      .join(dots ? '.' : '');
   }
 
   /**
@@ -1037,21 +1114,27 @@
     formData = formData || new (FormData)();
 
     // eslint-disable-next-line no-param-reassign
-    options = utils$1.toFlatObject(options, {
-      metaTokens: true,
-      dots: false,
-      indexes: false
-    }, false, function defined(option, source) {
-      // eslint-disable-next-line no-eq-null,eqeqeq
-      return !utils$1.isUndefined(source[option]);
-    });
+    options = utils$1.toFlatObject(
+      options,
+      {
+        metaTokens: true,
+        dots: false,
+        indexes: false,
+      },
+      false,
+      function defined(option, source) {
+        // eslint-disable-next-line no-eq-null,eqeqeq
+        return !utils$1.isUndefined(source[option]);
+      }
+    );
 
     const metaTokens = options.metaTokens;
     // eslint-disable-next-line no-use-before-define
     const visitor = options.visitor || defaultVisitor;
     const dots = options.dots;
     const indexes = options.indexes;
-    const _Blob = options.Blob || typeof Blob !== 'undefined' && Blob;
+    const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
+    const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
     const useBlob = _Blob && utils$1.isSpecCompliantForm(formData);
 
     if (!utils$1.isFunction(visitor)) {
@@ -1093,6 +1176,11 @@
     function defaultVisitor(value, key, path) {
       let arr = value;
 
+      if (utils$1.isReactNative(formData) && utils$1.isReactNativeBlob(value)) {
+        formData.append(renderKey(path, key, dots), convertValue(value));
+        return false;
+      }
+
       if (value && !path && typeof value === 'object') {
         if (utils$1.endsWith(key, '{}')) {
           // eslint-disable-next-line no-param-reassign
@@ -1101,17 +1189,22 @@
           value = JSON.stringify(value);
         } else if (
           (utils$1.isArray(value) && isFlatArray(value)) ||
-          ((utils$1.isFileList(value) || utils$1.endsWith(key, '[]')) && (arr = utils$1.toArray(value))
-          )) {
+          ((utils$1.isFileList(value) || utils$1.endsWith(key, '[]')) && (arr = utils$1.toArray(value)))
+        ) {
           // eslint-disable-next-line no-param-reassign
           key = removeBrackets(key);
 
           arr.forEach(function each(el, index) {
-            !(utils$1.isUndefined(el) || el === null) && formData.append(
-              // eslint-disable-next-line no-nested-ternary
-              indexes === true ? renderKey([key], index, dots) : (indexes === null ? key : key + '[]'),
-              convertValue(el)
-            );
+            !(utils$1.isUndefined(el) || el === null) &&
+              formData.append(
+                // eslint-disable-next-line no-nested-ternary
+                indexes === true
+                  ? renderKey([key], index, dots)
+                  : indexes === null
+                    ? key
+                    : key + '[]',
+                convertValue(el)
+              );
           });
           return false;
         }
@@ -1131,12 +1224,19 @@
     const exposedHelpers = Object.assign(predicates, {
       defaultVisitor,
       convertValue,
-      isVisitable
+      isVisitable,
     });
 
-    function build(value, path) {
+    function build(value, path, depth = 0) {
       if (utils$1.isUndefined(value)) return;
 
+      if (depth > maxDepth) {
+        throw new AxiosError$1(
+          'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+          AxiosError$1.ERR_FORM_DATA_DEPTH_EXCEEDED
+        );
+      }
+
       if (stack.indexOf(value) !== -1) {
         throw Error('Circular reference detected in ' + path.join('.'));
       }
@@ -1144,12 +1244,12 @@
       stack.push(value);
 
       utils$1.forEach(value, function each(el, key) {
-        const result = !(utils$1.isUndefined(el) || el === null) && visitor.call(
-          formData, el, utils$1.isString(key) ? key.trim() : key, path, exposedHelpers
-        );
+        const result =
+          !(utils$1.isUndefined(el) || el === null) &&
+          visitor.call(formData, el, utils$1.isString(key) ? key.trim() : key, path, exposedHelpers);
 
         if (result === true) {
-          build(el, path ? path.concat(key) : [key]);
+          build(el, path ? path.concat(key) : [key], depth + 1);
         }
       });
 
@@ -1181,9 +1281,8 @@
       ')': '%29',
       '~': '%7E',
       '%20': '+',
-      '%00': '\x00'
     };
-    return encodeURIComponent(str).replace(/[!'()~]|%20|%00/g, function replacer(match) {
+    return encodeURIComponent(str).replace(/[!'()~]|%20/g, function replacer(match) {
       return charMap[match];
     });
   }
@@ -1209,29 +1308,33 @@
   };
 
   prototype.toString = function toString(encoder) {
-    const _encode = encoder ? function(value) {
-      return encoder.call(this, value, encode$1);
-    } : encode$1;
+    const _encode = encoder
+      ? function (value) {
+          return encoder.call(this, value, encode$1);
+        }
+      : encode$1;
 
-    return this._pairs.map(function each(pair) {
-      return _encode(pair[0]) + '=' + _encode(pair[1]);
-    }, '').join('&');
+    return this._pairs
+      .map(function each(pair) {
+        return _encode(pair[0]) + '=' + _encode(pair[1]);
+      }, '')
+      .join('&');
   };
 
   /**
-   * It replaces all instances of the characters `:`, `$`, `,`, `+`, `[`, and `]` with their
-   * URI encoded counterparts
+   * It replaces URL-encoded forms of `:`, `$`, `,`, and spaces with
+   * their plain counterparts (`:`, `$`, `,`, `+`).
    *
    * @param {string} val The value to be encoded.
    *
    * @returns {string} The encoded value.
    */
   function encode(val) {
-    return encodeURIComponent(val).
-      replace(/%3A/gi, ':').
-      replace(/%24/g, '$').
-      replace(/%2C/gi, ',').
-      replace(/%20/g, '+');
+    return encodeURIComponent(val)
+      .replace(/%3A/gi, ':')
+      .replace(/%24/g, '$')
+      .replace(/%2C/gi, ',')
+      .replace(/%20/g, '+');
   }
 
   /**
@@ -1248,11 +1351,13 @@
       return url;
     }
 
-    const _encode = options && options.encode || encode;
+    const _encode = (options && options.encode) || encode;
 
-    const _options = utils$1.isFunction(options) ? {
-      serialize: options
-    } : options;
+    const _options = utils$1.isFunction(options)
+      ? {
+          serialize: options,
+        }
+      : options;
 
     const serializeFn = _options && _options.serialize;
 
@@ -1261,13 +1366,13 @@
     if (serializeFn) {
       serializedParams = serializeFn(params, _options);
     } else {
-      serializedParams = utils$1.isURLSearchParams(params) ?
-        params.toString() :
-        new AxiosURLSearchParams(params, _options).toString(_encode);
+      serializedParams = utils$1.isURLSearchParams(params)
+        ? params.toString()
+        : new AxiosURLSearchParams(params, _options).toString(_encode);
     }
 
     if (serializedParams) {
-      const hashmarkIndex = url.indexOf("#");
+      const hashmarkIndex = url.indexOf('#');
 
       if (hashmarkIndex !== -1) {
         url = url.slice(0, hashmarkIndex);
@@ -1297,7 +1402,7 @@
         fulfilled,
         rejected,
         synchronous: options ? options.synchronous : false,
-        runWhen: options ? options.runWhen : null
+        runWhen: options ? options.runWhen : null,
       });
       return this.handlers.length - 1;
     }
@@ -1351,7 +1456,7 @@
     silentJSONParsing: true,
     forcedJSONParsing: true,
     clarifyTimeoutError: false,
-    legacyInterceptorReqResOrdering: true
+    legacyInterceptorReqResOrdering: true,
   };
 
   var URLSearchParams$1 = typeof URLSearchParams !== 'undefined' ? URLSearchParams : AxiosURLSearchParams;
@@ -1365,14 +1470,14 @@
     classes: {
       URLSearchParams: URLSearchParams$1,
       FormData: FormData$1,
-      Blob: Blob$1
+      Blob: Blob$1,
     },
-    protocols: ['http', 'https', 'file', 'blob', 'url', 'data']
+    protocols: ['http', 'https', 'file', 'blob', 'url', 'data'],
   };
 
   const hasBrowserEnv = typeof window !== 'undefined' && typeof document !== 'undefined';
 
-  const _navigator = typeof navigator === 'object' && navigator || undefined;
+  const _navigator = (typeof navigator === 'object' && navigator) || undefined;
 
   /**
    * Determine if we're running in a standard browser environment
@@ -1391,7 +1496,8 @@
    *
    * @returns {boolean}
    */
-  const hasStandardBrowserEnv = hasBrowserEnv &&
+  const hasStandardBrowserEnv =
+    hasBrowserEnv &&
     (!_navigator || ['ReactNative', 'NativeScript', 'NS'].indexOf(_navigator.product) < 0);
 
   /**
@@ -1412,7 +1518,7 @@
     );
   })();
 
-  const origin = hasBrowserEnv && window.location.href || 'http://localhost';
+  const origin = (hasBrowserEnv && window.location.href) || 'http://localhost';
 
   var utils = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -1425,12 +1531,12 @@
 
   var platform = {
     ...utils,
-    ...platform$1
+    ...platform$1,
   };
 
   function toURLEncodedForm(data, options) {
     return toFormData(data, new platform.classes.URLSearchParams(), {
-      visitor: function(value, key, path, helpers) {
+      visitor: function (value, key, path, helpers) {
         if (platform.isNode && utils$1.isBuffer(value)) {
           this.append(key, value.toString('base64'));
           return false;
@@ -1438,7 +1544,7 @@
 
         return helpers.defaultVisitor.apply(this, arguments);
       },
-      ...options
+      ...options,
     });
   }
 
@@ -1454,7 +1560,7 @@
     // foo.x.y.z
     // foo-x-y-z
     // foo x y z
-    return utils$1.matchAll(/\w+|\[(\w*)]/g, name).map(match => {
+    return utils$1.matchAll(/\w+|\[(\w*)]/g, name).map((match) => {
       return match[0] === '[]' ? '' : match[1] || match[0];
     });
   }
@@ -1498,7 +1604,9 @@
 
       if (isLast) {
         if (utils$1.hasOwnProp(target, name)) {
-          target[name] = [target[name], value];
+          target[name] = utils$1.isArray(target[name])
+            ? target[name].concat(value)
+            : [target[name], value];
         } else {
           target[name] = value;
         }
@@ -1532,6 +1640,8 @@
     return null;
   }
 
+  const own = (obj, key) => (obj != null && utils$1.hasOwnProp(obj, key) ? obj[key] : undefined);
+
   /**
    * It takes a string, tries to parse it, and if it fails, it returns the stringified version
    * of the input
@@ -1558,96 +1668,110 @@
   }
 
   const defaults = {
-
     transitional: transitionalDefaults,
 
     adapter: ['xhr', 'http', 'fetch'],
 
-    transformRequest: [function transformRequest(data, headers) {
-      const contentType = headers.getContentType() || '';
-      const hasJSONContentType = contentType.indexOf('application/json') > -1;
-      const isObjectPayload = utils$1.isObject(data);
-
-      if (isObjectPayload && utils$1.isHTMLForm(data)) {
-        data = new FormData(data);
-      }
-
-      const isFormData = utils$1.isFormData(data);
+    transformRequest: [
+      function transformRequest(data, headers) {
+        const contentType = headers.getContentType() || '';
+        const hasJSONContentType = contentType.indexOf('application/json') > -1;
+        const isObjectPayload = utils$1.isObject(data);
 
-      if (isFormData) {
-        return hasJSONContentType ? JSON.stringify(formDataToJSON(data)) : data;
-      }
+        if (isObjectPayload && utils$1.isHTMLForm(data)) {
+          data = new FormData(data);
+        }
 
-      if (utils$1.isArrayBuffer(data) ||
-        utils$1.isBuffer(data) ||
-        utils$1.isStream(data) ||
-        utils$1.isFile(data) ||
-        utils$1.isBlob(data) ||
-        utils$1.isReadableStream(data)
-      ) {
-        return data;
-      }
-      if (utils$1.isArrayBufferView(data)) {
-        return data.buffer;
-      }
-      if (utils$1.isURLSearchParams(data)) {
-        headers.setContentType('application/x-www-form-urlencoded;charset=utf-8', false);
-        return data.toString();
-      }
+        const isFormData = utils$1.isFormData(data);
 
-      let isFileList;
+        if (isFormData) {
+          return hasJSONContentType ? JSON.stringify(formDataToJSON(data)) : data;
+        }
 
-      if (isObjectPayload) {
-        if (contentType.indexOf('application/x-www-form-urlencoded') > -1) {
-          return toURLEncodedForm(data, this.formSerializer).toString();
+        if (
+          utils$1.isArrayBuffer(data) ||
+          utils$1.isBuffer(data) ||
+          utils$1.isStream(data) ||
+          utils$1.isFile(data) ||
+          utils$1.isBlob(data) ||
+          utils$1.isReadableStream(data)
+        ) {
+          return data;
+        }
+        if (utils$1.isArrayBufferView(data)) {
+          return data.buffer;
+        }
+        if (utils$1.isURLSearchParams(data)) {
+          headers.setContentType('application/x-www-form-urlencoded;charset=utf-8', false);
+          return data.toString();
         }
 
-        if ((isFileList = utils$1.isFileList(data)) || contentType.indexOf('multipart/form-data') > -1) {
-          const _FormData = this.env && this.env.FormData;
+        let isFileList;
 
-          return toFormData(
-            isFileList ? {'files[]': data} : data,
-            _FormData && new _FormData(),
-            this.formSerializer
-          );
+        if (isObjectPayload) {
+          const formSerializer = own(this, 'formSerializer');
+          if (contentType.indexOf('application/x-www-form-urlencoded') > -1) {
+            return toURLEncodedForm(data, formSerializer).toString();
+          }
+
+          if (
+            (isFileList = utils$1.isFileList(data)) ||
+            contentType.indexOf('multipart/form-data') > -1
+          ) {
+            const env = own(this, 'env');
+            const _FormData = env && env.FormData;
+
+            return toFormData(
+              isFileList ? { 'files[]': data } : data,
+              _FormData && new _FormData(),
+              formSerializer
+            );
+          }
         }
-      }
 
-      if (isObjectPayload || hasJSONContentType ) {
-        headers.setContentType('application/json', false);
-        return stringifySafely(data);
-      }
+        if (isObjectPayload || hasJSONContentType) {
+          headers.setContentType('application/json', false);
+          return stringifySafely(data);
+        }
 
-      return data;
-    }],
+        return data;
+      },
+    ],
 
-    transformResponse: [function transformResponse(data) {
-      const transitional = this.transitional || defaults.transitional;
-      const forcedJSONParsing = transitional && transitional.forcedJSONParsing;
-      const JSONRequested = this.responseType === 'json';
+    transformResponse: [
+      function transformResponse(data) {
+        const transitional = own(this, 'transitional') || defaults.transitional;
+        const forcedJSONParsing = transitional && transitional.forcedJSONParsing;
+        const responseType = own(this, 'responseType');
+        const JSONRequested = responseType === 'json';
 
-      if (utils$1.isResponse(data) || utils$1.isReadableStream(data)) {
-        return data;
-      }
+        if (utils$1.isResponse(data) || utils$1.isReadableStream(data)) {
+          return data;
+        }
 
-      if (data && utils$1.isString(data) && ((forcedJSONParsing && !this.responseType) || JSONRequested)) {
-        const silentJSONParsing = transitional && transitional.silentJSONParsing;
-        const strictJSONParsing = !silentJSONParsing && JSONRequested;
+        if (
+          data &&
+          utils$1.isString(data) &&
+          ((forcedJSONParsing && !responseType) || JSONRequested)
+        ) {
+          const silentJSONParsing = transitional && transitional.silentJSONParsing;
+          const strictJSONParsing = !silentJSONParsing && JSONRequested;
 
-        try {
-          return JSON.parse(data, this.parseReviver);
-        } catch (e) {
-          if (strictJSONParsing) {
-            if (e.name === 'SyntaxError') {
-              throw AxiosError$1.from(e, AxiosError$1.ERR_BAD_RESPONSE, this, null, this.response);
+          try {
+            return JSON.parse(data, own(this, 'parseReviver'));
+          } catch (e) {
+            if (strictJSONParsing) {
+              if (e.name === 'SyntaxError') {
+                throw AxiosError$1.from(e, AxiosError$1.ERR_BAD_RESPONSE, this, null, own(this, 'response'));
+              }
+              throw e;
             }
-            throw e;
           }
         }
-      }
 
-      return data;
-    }],
+        return data;
+      },
+    ],
 
     /**
      * A timeout in milliseconds to abort a request. If set to 0 (default) a
@@ -1663,7 +1787,7 @@
 
     env: {
       FormData: platform.classes.FormData,
-      Blob: platform.classes.Blob
+      Blob: platform.classes.Blob,
     },
 
     validateStatus: function validateStatus(status) {
@@ -1672,10 +1796,10 @@
 
     headers: {
       common: {
-        'Accept': 'application/json, text/plain, */*',
-        'Content-Type': undefined
-      }
-    }
+        Accept: 'application/json, text/plain, */*',
+        'Content-Type': undefined,
+      },
+    },
   };
 
   utils$1.forEach(['delete', 'get', 'head', 'post', 'put', 'patch'], (method) => {
@@ -1687,10 +1811,23 @@
   // RawAxiosHeaders whose duplicates are ignored by node
   // c.f. https://nodejs.org/api/http.html#http_message_headers
   const ignoreDuplicateOf = utils$1.toObjectSet([
-    'age', 'authorization', 'content-length', 'content-type', 'etag',
-    'expires', 'from', 'host', 'if-modified-since', 'if-unmodified-since',
-    'last-modified', 'location', 'max-forwards', 'proxy-authorization',
-    'referer', 'retry-after', 'user-agent'
+    'age',
+    'authorization',
+    'content-length',
+    'content-type',
+    'etag',
+    'expires',
+    'from',
+    'host',
+    'if-modified-since',
+    'if-unmodified-since',
+    'last-modified',
+    'location',
+    'max-forwards',
+    'proxy-authorization',
+    'referer',
+    'retry-after',
+    'user-agent',
   ]);
 
   /**
@@ -1707,47 +1844,81 @@
    *
    * @returns {Object} Headers parsed into an object
    */
-  var parseHeaders = rawHeaders => {
+  var parseHeaders = (rawHeaders) => {
     const parsed = {};
     let key;
     let val;
     let i;
 
-    rawHeaders && rawHeaders.split('\n').forEach(function parser(line) {
-      i = line.indexOf(':');
-      key = line.substring(0, i).trim().toLowerCase();
-      val = line.substring(i + 1).trim();
+    rawHeaders &&
+      rawHeaders.split('\n').forEach(function parser(line) {
+        i = line.indexOf(':');
+        key = line.substring(0, i).trim().toLowerCase();
+        val = line.substring(i + 1).trim();
 
-      if (!key || (parsed[key] && ignoreDuplicateOf[key])) {
-        return;
-      }
+        if (!key || (parsed[key] && ignoreDuplicateOf[key])) {
+          return;
+        }
 
-      if (key === 'set-cookie') {
-        if (parsed[key]) {
-          parsed[key].push(val);
+        if (key === 'set-cookie') {
+          if (parsed[key]) {
+            parsed[key].push(val);
+          } else {
+            parsed[key] = [val];
+          }
         } else {
-          parsed[key] = [val];
+          parsed[key] = parsed[key] ? parsed[key] + ', ' + val : val;
         }
-      } else {
-        parsed[key] = parsed[key] ? parsed[key] + ', ' + val : val;
-      }
-    });
+      });
 
     return parsed;
   };
 
   const $internals = Symbol('internals');
 
+  const INVALID_HEADER_VALUE_CHARS_RE = /[^\x09\x20-\x7E\x80-\xFF]/g;
+
+  function trimSPorHTAB(str) {
+    let start = 0;
+    let end = str.length;
+
+    while (start < end) {
+      const code = str.charCodeAt(start);
+
+      if (code !== 0x09 && code !== 0x20) {
+        break;
+      }
+
+      start += 1;
+    }
+
+    while (end > start) {
+      const code = str.charCodeAt(end - 1);
+
+      if (code !== 0x09 && code !== 0x20) {
+        break;
+      }
+
+      end -= 1;
+    }
+
+    return start === 0 && end === str.length ? str : str.slice(start, end);
+  }
+
   function normalizeHeader(header) {
     return header && String(header).trim().toLowerCase();
   }
 
+  function sanitizeHeaderValue(str) {
+    return trimSPorHTAB(str.replace(INVALID_HEADER_VALUE_CHARS_RE, ''));
+  }
+
   function normalizeValue(value) {
     if (value === false || value == null) {
       return value;
     }
 
-    return utils$1.isArray(value) ? value.map(normalizeValue) : String(value);
+    return utils$1.isArray(value) ? value.map(normalizeValue) : sanitizeHeaderValue(String(value));
   }
 
   function parseTokens(str) {
@@ -1785,8 +1956,10 @@
   }
 
   function formatHeader(header) {
-    return header.trim()
-      .toLowerCase().replace(/([a-z\d])(\w*)/g, (w, char, str) => {
+    return header
+      .trim()
+      .toLowerCase()
+      .replace(/([a-z\d])(\w*)/g, (w, char, str) => {
         return char.toUpperCase() + str;
       });
   }
@@ -1794,12 +1967,12 @@
   function buildAccessors(obj, header) {
     const accessorName = utils$1.toCamelCase(' ' + header);
 
-    ['get', 'set', 'has'].forEach(methodName => {
+    ['get', 'set', 'has'].forEach((methodName) => {
       Object.defineProperty(obj, methodName + accessorName, {
-        value: function(arg1, arg2, arg3) {
+        value: function (arg1, arg2, arg3) {
           return this[methodName].call(this, header, arg1, arg2, arg3);
         },
-        configurable: true
+        configurable: true,
       });
     });
   }
@@ -1821,7 +1994,12 @@
 
         const key = utils$1.findKey(self, lHeader);
 
-        if(!key || self[key] === undefined || _rewrite === true || (_rewrite === undefined && self[key] !== false)) {
+        if (
+          !key ||
+          self[key] === undefined ||
+          _rewrite === true ||
+          (_rewrite === undefined && self[key] !== false)
+        ) {
           self[key || _header] = normalizeValue(_value);
         }
       }
@@ -1831,17 +2009,22 @@
 
       if (utils$1.isPlainObject(header) || header instanceof this.constructor) {
         setHeaders(header, valueOrRewrite);
-      } else if(utils$1.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) {
+      } else if (utils$1.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) {
         setHeaders(parseHeaders(header), valueOrRewrite);
       } else if (utils$1.isObject(header) && utils$1.isIterable(header)) {
-        let obj = {}, dest, key;
+        let obj = {},
+          dest,
+          key;
         for (const entry of header) {
           if (!utils$1.isArray(entry)) {
             throw TypeError('Object iterator must return a key-value pair');
           }
 
-          obj[key = entry[0]] = (dest = obj[key]) ?
-            (utils$1.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]]) : entry[1];
+          obj[(key = entry[0])] = (dest = obj[key])
+            ? utils$1.isArray(dest)
+              ? [...dest, entry[1]]
+              : [dest, entry[1]]
+            : entry[1];
         }
 
         setHeaders(obj, valueOrRewrite);
@@ -1888,7 +2071,11 @@
       if (header) {
         const key = utils$1.findKey(this, header);
 
-        return !!(key && this[key] !== undefined && (!matcher || matchHeaderValue(this, this[key], key, matcher)));
+        return !!(
+          key &&
+          this[key] !== undefined &&
+          (!matcher || matchHeaderValue(this, this[key], key, matcher))
+        );
       }
 
       return false;
@@ -1928,7 +2115,7 @@
 
       while (i--) {
         const key = keys[i];
-        if(!matcher || matchHeaderValue(this, this[key], key, matcher, true)) {
+        if (!matcher || matchHeaderValue(this, this[key], key, matcher, true)) {
           delete this[key];
           deleted = true;
         }
@@ -1972,7 +2159,9 @@
       const obj = Object.create(null);
 
       utils$1.forEach(this, (value, header) => {
-        value != null && value !== false && (obj[header] = asStrings && utils$1.isArray(value) ? value.join(', ') : value);
+        value != null &&
+          value !== false &&
+          (obj[header] = asStrings && utils$1.isArray(value) ? value.join(', ') : value);
       });
 
       return obj;
@@ -1983,11 +2172,13 @@
     }
 
     toString() {
-      return Object.entries(this.toJSON()).map(([header, value]) => header + ': ' + value).join('\n');
+      return Object.entries(this.toJSON())
+        .map(([header, value]) => header + ': ' + value)
+        .join('\n');
     }
 
     getSetCookie() {
-      return this.get("set-cookie") || [];
+      return this.get('set-cookie') || [];
     }
 
     get [Symbol.toStringTag]() {
@@ -2007,9 +2198,12 @@
     }
 
     static accessor(header) {
-      const internals = this[$internals] = (this[$internals] = {
-        accessors: {}
-      });
+      const internals =
+        (this[$internals] =
+        this[$internals] =
+          {
+            accessors: {},
+          });
 
       const accessors = internals.accessors;
       const prototype = this.prototype;
@@ -2029,17 +2223,24 @@
     }
   }
 
-  AxiosHeaders.accessor(['Content-Type', 'Content-Length', 'Accept', 'Accept-Encoding', 'User-Agent', 'Authorization']);
+  AxiosHeaders.accessor([
+    'Content-Type',
+    'Content-Length',
+    'Accept',
+    'Accept-Encoding',
+    'User-Agent',
+    'Authorization',
+  ]);
 
   // reserved names hotfix
-  utils$1.reduceDescriptors(AxiosHeaders.prototype, ({value}, key) => {
+  utils$1.reduceDescriptors(AxiosHeaders.prototype, ({ value }, key) => {
     let mapped = key[0].toUpperCase() + key.slice(1); // map `set` => `Set`
     return {
       get: () => value,
       set(headerValue) {
         this[mapped] = headerValue;
-      }
-    }
+      },
+    };
   });
 
   utils$1.freezeMethods(AxiosHeaders);
@@ -2106,19 +2307,23 @@
     if (!response.status || !validateStatus || validateStatus(response.status)) {
       resolve(response);
     } else {
-      reject(new AxiosError$1(
-        'Request failed with status code ' + response.status,
-        [AxiosError$1.ERR_BAD_REQUEST, AxiosError$1.ERR_BAD_RESPONSE][Math.floor(response.status / 100) - 4],
-        response.config,
-        response.request,
-        response
-      ));
+      reject(
+        new AxiosError$1(
+          'Request failed with status code ' + response.status,
+          [AxiosError$1.ERR_BAD_REQUEST, AxiosError$1.ERR_BAD_RESPONSE][
+            Math.floor(response.status / 100) - 4
+          ],
+          response.config,
+          response.request,
+          response
+        )
+      );
     }
   }
 
   function parseProtocol(url) {
     const match = /^([-+\w]{1,25})(:?\/\/|:)/.exec(url);
-    return match && match[1] || '';
+    return (match && match[1]) || '';
   }
 
   /**
@@ -2169,7 +2374,7 @@
 
       const passed = startedAt && now - startedAt;
 
-      return passed ? Math.round(bytesCount * 1000 / passed) : undefined;
+      return passed ? Math.round((bytesCount * 1000) / passed) : undefined;
     };
   }
 
@@ -2198,7 +2403,7 @@
     const throttled = (...args) => {
       const now = Date.now();
       const passed = now - timestamp;
-      if ( passed >= threshold) {
+      if (passed >= threshold) {
         invoke(args, now);
       } else {
         lastArgs = args;
@@ -2220,25 +2425,25 @@
     let bytesNotified = 0;
     const _speedometer = speedometer(50, 250);
 
-    return throttle(e => {
-      const loaded = e.loaded;
+    return throttle((e) => {
+      const rawLoaded = e.loaded;
       const total = e.lengthComputable ? e.total : undefined;
-      const progressBytes = loaded - bytesNotified;
+      const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+      const progressBytes = Math.max(0, loaded - bytesNotified);
       const rate = _speedometer(progressBytes);
-      const inRange = loaded <= total;
 
-      bytesNotified = loaded;
+      bytesNotified = Math.max(bytesNotified, loaded);
 
       const data = {
         loaded,
         total,
-        progress: total ? (loaded / total) : undefined,
+        progress: total ? loaded / total : undefined,
         bytes: progressBytes,
         rate: rate ? rate : undefined,
-        estimated: rate && total && inRange ? (total - loaded) / rate : undefined,
+        estimated: rate && total ? (total - loaded) / rate : undefined,
         event: e,
         lengthComputable: total != null,
-        [isDownloadStream ? 'download' : 'upload']: true
+        [isDownloadStream ? 'download' : 'upload']: true,
       };
 
       listener(data);
@@ -2248,77 +2453,82 @@
   const progressEventDecorator = (total, throttled) => {
     const lengthComputable = total != null;
 
-    return [(loaded) => throttled[0]({
-      lengthComputable,
-      total,
-      loaded
-    }), throttled[1]];
+    return [
+      (loaded) =>
+        throttled[0]({
+          lengthComputable,
+          total,
+          loaded,
+        }),
+      throttled[1],
+    ];
   };
 
-  const asyncDecorator = (fn) => (...args) => utils$1.asap(() => fn(...args));
-
-  var isURLSameOrigin = platform.hasStandardBrowserEnv ? ((origin, isMSIE) => (url) => {
-    url = new URL(url, platform.origin);
-
-    return (
-      origin.protocol === url.protocol &&
-      origin.host === url.host &&
-      (isMSIE || origin.port === url.port)
-    );
-  })(
-    new URL(platform.origin),
-    platform.navigator && /(msie|trident)/i.test(platform.navigator.userAgent)
-  ) : () => true;
-
-  var cookies = platform.hasStandardBrowserEnv ?
+  const asyncDecorator =
+    (fn) =>
+    (...args) =>
+      utils$1.asap(() => fn(...args));
 
-    // Standard browser envs support document.cookie
-    {
-      write(name, value, expires, path, domain, secure, sameSite) {
-        if (typeof document === 'undefined') return;
+  var isURLSameOrigin = platform.hasStandardBrowserEnv
+    ? ((origin, isMSIE) => (url) => {
+        url = new URL(url, platform.origin);
 
-        const cookie = [`${name}=${encodeURIComponent(value)}`];
-
-        if (utils$1.isNumber(expires)) {
-          cookie.push(`expires=${new Date(expires).toUTCString()}`);
-        }
-        if (utils$1.isString(path)) {
-          cookie.push(`path=${path}`);
-        }
-        if (utils$1.isString(domain)) {
-          cookie.push(`domain=${domain}`);
-        }
-        if (secure === true) {
-          cookie.push('secure');
-        }
-        if (utils$1.isString(sameSite)) {
-          cookie.push(`SameSite=${sameSite}`);
-        }
+        return (
+          origin.protocol === url.protocol &&
+          origin.host === url.host &&
+          (isMSIE || origin.port === url.port)
+        );
+      })(
+        new URL(platform.origin),
+        platform.navigator && /(msie|trident)/i.test(platform.navigator.userAgent)
+      )
+    : () => true;
+
+  var cookies = platform.hasStandardBrowserEnv
+    ? // Standard browser envs support document.cookie
+      {
+        write(name, value, expires, path, domain, secure, sameSite) {
+          if (typeof document === 'undefined') return;
+
+          const cookie = [`${name}=${encodeURIComponent(value)}`];
+
+          if (utils$1.isNumber(expires)) {
+            cookie.push(`expires=${new Date(expires).toUTCString()}`);
+          }
+          if (utils$1.isString(path)) {
+            cookie.push(`path=${path}`);
+          }
+          if (utils$1.isString(domain)) {
+            cookie.push(`domain=${domain}`);
+          }
+          if (secure === true) {
+            cookie.push('secure');
+          }
+          if (utils$1.isString(sameSite)) {
+            cookie.push(`SameSite=${sameSite}`);
+          }
 
-        document.cookie = cookie.join('; ');
-      },
+          document.cookie = cookie.join('; ');
+        },
 
-      read(name) {
-        if (typeof document === 'undefined') return null;
-        const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));
-        return match ? decodeURIComponent(match[1]) : null;
-      },
+        read(name) {
+          if (typeof document === 'undefined') return null;
+          const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));
+          return match ? decodeURIComponent(match[1]) : null;
+        },
 
-      remove(name) {
-        this.write(name, '', Date.now() - 86400000, '/');
+        remove(name) {
+          this.write(name, '', Date.now() - 86400000, '/');
+        },
       }
-    }
-
-    :
-
-    // Non-standard browser env (web workers, react-native) lack needed support.
-    {
-      write() {},
-      read() {
-        return null;
-      },
-      remove() {}
-    };
+    : // Non-standard browser env (web workers, react-native) lack needed support.
+      {
+        write() {},
+        read() {
+          return null;
+        },
+        remove() {},
+      };
 
   /**
    * Determines whether the specified URL is absolute
@@ -2364,14 +2574,13 @@
    */
   function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
     let isRelativeUrl = !isAbsoluteURL(requestedURL);
-    if (baseURL && (isRelativeUrl || allowAbsoluteUrls == false)) {
+    if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
       return combineURLs(baseURL, requestedURL);
     }
     return requestedURL;
   }
 
-  const headersToObject = (thing) =>
-    thing instanceof AxiosHeaders$1 ? { ...thing } : thing;
+  const headersToObject = (thing) => (thing instanceof AxiosHeaders$1 ? { ...thing } : thing);
 
   /**
    * Config-specific merge-function which creates a new config-object
@@ -2385,7 +2594,18 @@
   function mergeConfig(config1, config2) {
     // eslint-disable-next-line no-param-reassign
     config2 = config2 || {};
-    const config = {};
+
+    // Use a null-prototype object so that downstream reads such as `config.auth`
+    // or `config.baseURL` cannot inherit polluted values from Object.prototype
+    // (see GHSA-q8qp-cvcw-x6jj). `hasOwnProperty` is restored as a non-enumerable
+    // own slot to preserve ergonomics for user code that relies on it.
+    const config = Object.create(null);
+    Object.defineProperty(config, 'hasOwnProperty', {
+      value: Object.prototype.hasOwnProperty,
+      enumerable: false,
+      writable: true,
+      configurable: true,
+    });
 
     function getMergedValue(target, source, prop, caseless) {
       if (utils$1.isPlainObject(target) && utils$1.isPlainObject(source)) {
@@ -2424,9 +2644,9 @@
 
     // eslint-disable-next-line consistent-return
     function mergeDirectKeys(a, b, prop) {
-      if (prop in config2) {
+      if (utils$1.hasOwnProp(config2, prop)) {
         return getMergedValue(a, b);
-      } else if (prop in config1) {
+      } else if (utils$1.hasOwnProp(config1, prop)) {
         return getMergedValue(undefined, a);
       }
     }
@@ -2458,29 +2678,21 @@
       httpsAgent: defaultToConfig2,
       cancelToken: defaultToConfig2,
       socketPath: defaultToConfig2,
+      allowedSocketPaths: defaultToConfig2,
       responseEncoding: defaultToConfig2,
       validateStatus: mergeDirectKeys,
       headers: (a, b, prop) =>
         mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true),
     };
 
-    utils$1.forEach(
-      Object.keys({ ...config1, ...config2 }),
-      function computeConfigValue(prop) {
-        if (
-          prop === "__proto__" ||
-          prop === "constructor" ||
-          prop === "prototype"
-        )
-          return;
-        const merge = utils$1.hasOwnProp(mergeMap, prop)
-          ? mergeMap[prop]
-          : mergeDeepProperties;
-        const configValue = merge(config1[prop], config2[prop], prop);
-        (utils$1.isUndefined(configValue) && merge !== mergeDirectKeys) ||
-          (config[prop] = configValue);
-      },
-    );
+    utils$1.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
+      if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
+      const merge = utils$1.hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
+      const a = utils$1.hasOwnProp(config1, prop) ? config1[prop] : undefined;
+      const b = utils$1.hasOwnProp(config2, prop) ? config2[prop] : undefined;
+      const configValue = merge(a, b, prop);
+      (utils$1.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
+    });
 
     return config;
   }
@@ -2488,16 +2700,38 @@
   var resolveConfig = (config) => {
     const newConfig = mergeConfig({}, config);
 
-    let { data, withXSRFToken, xsrfHeaderName, xsrfCookieName, headers, auth } = newConfig;
+    // Read only own properties to prevent prototype pollution gadgets
+    // (e.g. Object.prototype.baseURL = 'https://evil.com'). See GHSA-q8qp-cvcw-x6jj.
+    const own = (key) => (utils$1.hasOwnProp(newConfig, key) ? newConfig[key] : undefined);
+
+    const data = own('data');
+    let withXSRFToken = own('withXSRFToken');
+    const xsrfHeaderName = own('xsrfHeaderName');
+    const xsrfCookieName = own('xsrfCookieName');
+    let headers = own('headers');
+    const auth = own('auth');
+    const baseURL = own('baseURL');
+    const allowAbsoluteUrls = own('allowAbsoluteUrls');
+    const url = own('url');
 
     newConfig.headers = headers = AxiosHeaders$1.from(headers);
 
-    newConfig.url = buildURL(buildFullPath(newConfig.baseURL, newConfig.url, newConfig.allowAbsoluteUrls), config.params, config.paramsSerializer);
+    newConfig.url = buildURL(
+      buildFullPath(baseURL, url, allowAbsoluteUrls),
+      config.params,
+      config.paramsSerializer
+    );
 
     // HTTP basic authentication
     if (auth) {
-      headers.set('Authorization', 'Basic ' +
-        btoa((auth.username || '') + ':' + (auth.password ? unescape(encodeURIComponent(auth.password)) : ''))
+      headers.set(
+        'Authorization',
+        'Basic ' +
+          btoa(
+            (auth.username || '') +
+              ':' +
+              (auth.password ? unescape(encodeURIComponent(auth.password)) : '')
+          )
       );
     }
 
@@ -2515,17 +2749,25 @@
           }
         });
       }
-    }  
+    }
 
     // Add xsrf header
     // This is only done if running in a standard browser environment.
     // Specifically not if we're in a web worker, or react-native.
 
     if (platform.hasStandardBrowserEnv) {
-      withXSRFToken && utils$1.isFunction(withXSRFToken) && (withXSRFToken = withXSRFToken(newConfig));
+      if (utils$1.isFunction(withXSRFToken)) {
+        withXSRFToken = withXSRFToken(newConfig);
+      }
 
-      if (withXSRFToken || (withXSRFToken !== false && isURLSameOrigin(newConfig.url))) {
-        // Add xsrf header
+      // Strict boolean check — prevents proto-pollution gadgets (e.g. Object.prototype.withXSRFToken = 1)
+      // and misconfigurations (e.g. "false") from short-circuiting the same-origin check and leaking
+      // the XSRF token cross-origin. See GHSA-xx6v-rp6x-q39c.
+      const shouldSendXSRF =
+        withXSRFToken === true ||
+        (withXSRFToken == null && isURLSameOrigin(newConfig.url));
+
+      if (shouldSendXSRF) {
         const xsrfValue = xsrfHeaderName && xsrfCookieName && cookies.read(xsrfCookieName);
 
         if (xsrfValue) {
@@ -2539,196 +2781,218 @@
 
   const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
 
-  var xhrAdapter = isXHRAdapterSupported && function (config) {
-    return new Promise(function dispatchXhrRequest(resolve, reject) {
-      const _config = resolveConfig(config);
-      let requestData = _config.data;
-      const requestHeaders = AxiosHeaders$1.from(_config.headers).normalize();
-      let {responseType, onUploadProgress, onDownloadProgress} = _config;
-      let onCanceled;
-      let uploadThrottled, downloadThrottled;
-      let flushUpload, flushDownload;
+  var xhrAdapter = isXHRAdapterSupported &&
+    function (config) {
+      return new Promise(function dispatchXhrRequest(resolve, reject) {
+        const _config = resolveConfig(config);
+        let requestData = _config.data;
+        const requestHeaders = AxiosHeaders$1.from(_config.headers).normalize();
+        let { responseType, onUploadProgress, onDownloadProgress } = _config;
+        let onCanceled;
+        let uploadThrottled, downloadThrottled;
+        let flushUpload, flushDownload;
 
-      function done() {
-        flushUpload && flushUpload(); // flush events
-        flushDownload && flushDownload(); // flush events
+        function done() {
+          flushUpload && flushUpload(); // flush events
+          flushDownload && flushDownload(); // flush events
 
-        _config.cancelToken && _config.cancelToken.unsubscribe(onCanceled);
+          _config.cancelToken && _config.cancelToken.unsubscribe(onCanceled);
 
-        _config.signal && _config.signal.removeEventListener('abort', onCanceled);
-      }
+          _config.signal && _config.signal.removeEventListener('abort', onCanceled);
+        }
 
-      let request = new XMLHttpRequest();
+        let request = new XMLHttpRequest();
 
-      request.open(_config.method.toUpperCase(), _config.url, true);
+        request.open(_config.method.toUpperCase(), _config.url, true);
 
-      // Set the request timeout in MS
-      request.timeout = _config.timeout;
+        // Set the request timeout in MS
+        request.timeout = _config.timeout;
 
-      function onloadend() {
-        if (!request) {
-          return;
+        function onloadend() {
+          if (!request) {
+            return;
+          }
+          // Prepare the response
+          const responseHeaders = AxiosHeaders$1.from(
+            'getAllResponseHeaders' in request && request.getAllResponseHeaders()
+          );
+          const responseData =
+            !responseType || responseType === 'text' || responseType === 'json'
+              ? request.responseText
+              : request.response;
+          const response = {
+            data: responseData,
+            status: request.status,
+            statusText: request.statusText,
+            headers: responseHeaders,
+            config,
+            request,
+          };
+
+          settle(
+            function _resolve(value) {
+              resolve(value);
+              done();
+            },
+            function _reject(err) {
+              reject(err);
+              done();
+            },
+            response
+          );
+
+          // Clean up request
+          request = null;
         }
-        // Prepare the response
-        const responseHeaders = AxiosHeaders$1.from(
-          'getAllResponseHeaders' in request && request.getAllResponseHeaders()
-        );
-        const responseData = !responseType || responseType === 'text' || responseType === 'json' ?
-          request.responseText : request.response;
-        const response = {
-          data: responseData,
-          status: request.status,
-          statusText: request.statusText,
-          headers: responseHeaders,
-          config,
-          request
-        };
 
-        settle(function _resolve(value) {
-          resolve(value);
-          done();
-        }, function _reject(err) {
-          reject(err);
-          done();
-        }, response);
+        if ('onloadend' in request) {
+          // Use onloadend if available
+          request.onloadend = onloadend;
+        } else {
+          // Listen for ready state to emulate onloadend
+          request.onreadystatechange = function handleLoad() {
+            if (!request || request.readyState !== 4) {
+              return;
+            }
 
-        // Clean up request
-        request = null;
-      }
+            // The request errored out and we didn't get a response, this will be
+            // handled by onerror instead
+            // With one exception: request that using file: protocol, most browsers
+            // will return status as 0 even though it's a successful request
+            if (
+              request.status === 0 &&
+              !(request.responseURL && request.responseURL.indexOf('file:') === 0)
+            ) {
+              return;
+            }
+            // readystate handler is calling before onerror or ontimeout handlers,
+            // so we should call onloadend on the next 'tick'
+            setTimeout(onloadend);
+          };
+        }
 
-      if ('onloadend' in request) {
-        // Use onloadend if available
-        request.onloadend = onloadend;
-      } else {
-        // Listen for ready state to emulate onloadend
-        request.onreadystatechange = function handleLoad() {
-          if (!request || request.readyState !== 4) {
+        // Handle browser request cancellation (as opposed to a manual cancellation)
+        request.onabort = function handleAbort() {
+          if (!request) {
             return;
           }
 
-          // The request errored out and we didn't get a response, this will be
-          // handled by onerror instead
-          // With one exception: request that using file: protocol, most browsers
-          // will return status as 0 even though it's a successful request
-          if (request.status === 0 && !(request.responseURL && request.responseURL.indexOf('file:') === 0)) {
-            return;
-          }
-          // readystate handler is calling before onerror or ontimeout handlers,
-          // so we should call onloadend on the next 'tick'
-          setTimeout(onloadend);
+          reject(new AxiosError$1('Request aborted', AxiosError$1.ECONNABORTED, config, request));
+
+          // Clean up request
+          request = null;
         };
-      }
 
-      // Handle browser request cancellation (as opposed to a manual cancellation)
-      request.onabort = function handleAbort() {
-        if (!request) {
-          return;
-        }
+        // Handle low level network errors
+        request.onerror = function handleError(event) {
+          // Browsers deliver a ProgressEvent in XHR onerror
+          // (message may be empty; when present, surface it)
+          // See https://developer.mozilla.org/docs/Web/API/XMLHttpRequest/error_event
+          const msg = event && event.message ? event.message : 'Network Error';
+          const err = new AxiosError$1(msg, AxiosError$1.ERR_NETWORK, config, request);
+          // attach the underlying event for consumers who want details
+          err.event = event || null;
+          reject(err);
+          request = null;
+        };
 
-        reject(new AxiosError$1('Request aborted', AxiosError$1.ECONNABORTED, config, request));
+        // Handle timeout
+        request.ontimeout = function handleTimeout() {
+          let timeoutErrorMessage = _config.timeout
+            ? 'timeout of ' + _config.timeout + 'ms exceeded'
+            : 'timeout exceeded';
+          const transitional = _config.transitional || transitionalDefaults;
+          if (_config.timeoutErrorMessage) {
+            timeoutErrorMessage = _config.timeoutErrorMessage;
+          }
+          reject(
+            new AxiosError$1(
+              timeoutErrorMessage,
+              transitional.clarifyTimeoutError ? AxiosError$1.ETIMEDOUT : AxiosError$1.ECONNABORTED,
+              config,
+              request
+            )
+          );
 
-        // Clean up request
-        request = null;
-      };
+          // Clean up request
+          request = null;
+        };
 
-      // Handle low level network errors
-    request.onerror = function handleError(event) {
-         // Browsers deliver a ProgressEvent in XHR onerror
-         // (message may be empty; when present, surface it)
-         // See https://developer.mozilla.org/docs/Web/API/XMLHttpRequest/error_event
-         const msg = event && event.message ? event.message : 'Network Error';
-         const err = new AxiosError$1(msg, AxiosError$1.ERR_NETWORK, config, request);
-         // attach the underlying event for consumers who want details
-         err.event = event || null;
-         reject(err);
-         request = null;
-      };
-      
-      // Handle timeout
-      request.ontimeout = function handleTimeout() {
-        let timeoutErrorMessage = _config.timeout ? 'timeout of ' + _config.timeout + 'ms exceeded' : 'timeout exceeded';
-        const transitional = _config.transitional || transitionalDefaults;
-        if (_config.timeoutErrorMessage) {
-          timeoutErrorMessage = _config.timeoutErrorMessage;
-        }
-        reject(new AxiosError$1(
-          timeoutErrorMessage,
-          transitional.clarifyTimeoutError ? AxiosError$1.ETIMEDOUT : AxiosError$1.ECONNABORTED,
-          config,
-          request));
-
-        // Clean up request
-        request = null;
-      };
+        // Remove Content-Type if data is undefined
+        requestData === undefined && requestHeaders.setContentType(null);
 
-      // Remove Content-Type if data is undefined
-      requestData === undefined && requestHeaders.setContentType(null);
+        // Add headers to the request
+        if ('setRequestHeader' in request) {
+          utils$1.forEach(requestHeaders.toJSON(), function setRequestHeader(val, key) {
+            request.setRequestHeader(key, val);
+          });
+        }
 
-      // Add headers to the request
-      if ('setRequestHeader' in request) {
-        utils$1.forEach(requestHeaders.toJSON(), function setRequestHeader(val, key) {
-          request.setRequestHeader(key, val);
-        });
-      }
+        // Add withCredentials to request if needed
+        if (!utils$1.isUndefined(_config.withCredentials)) {
+          request.withCredentials = !!_config.withCredentials;
+        }
 
-      // Add withCredentials to request if needed
-      if (!utils$1.isUndefined(_config.withCredentials)) {
-        request.withCredentials = !!_config.withCredentials;
-      }
+        // Add responseType to request if needed
+        if (responseType && responseType !== 'json') {
+          request.responseType = _config.responseType;
+        }
 
-      // Add responseType to request if needed
-      if (responseType && responseType !== 'json') {
-        request.responseType = _config.responseType;
-      }
+        // Handle progress if needed
+        if (onDownloadProgress) {
+          [downloadThrottled, flushDownload] = progressEventReducer(onDownloadProgress, true);
+          request.addEventListener('progress', downloadThrottled);
+        }
 
-      // Handle progress if needed
-      if (onDownloadProgress) {
-        ([downloadThrottled, flushDownload] = progressEventReducer(onDownloadProgress, true));
-        request.addEventListener('progress', downloadThrottled);
-      }
+        // Not all browsers support upload events
+        if (onUploadProgress && request.upload) {
+          [uploadThrottled, flushUpload] = progressEventReducer(onUploadProgress);
 
-      // Not all browsers support upload events
-      if (onUploadProgress && request.upload) {
-        ([uploadThrottled, flushUpload] = progressEventReducer(onUploadProgress));
+          request.upload.addEventListener('progress', uploadThrottled);
 
-        request.upload.addEventListener('progress', uploadThrottled);
+          request.upload.addEventListener('loadend', flushUpload);
+        }
 
-        request.upload.addEventListener('loadend', flushUpload);
-      }
+        if (_config.cancelToken || _config.signal) {
+          // Handle cancellation
+          // eslint-disable-next-line func-names
+          onCanceled = (cancel) => {
+            if (!request) {
+              return;
+            }
+            reject(!cancel || cancel.type ? new CanceledError$1(null, config, request) : cancel);
+            request.abort();
+            request = null;
+          };
 
-      if (_config.cancelToken || _config.signal) {
-        // Handle cancellation
-        // eslint-disable-next-line func-names
-        onCanceled = cancel => {
-          if (!request) {
-            return;
+          _config.cancelToken && _config.cancelToken.subscribe(onCanceled);
+          if (_config.signal) {
+            _config.signal.aborted
+              ? onCanceled()
+              : _config.signal.addEventListener('abort', onCanceled);
           }
-          reject(!cancel || cancel.type ? new CanceledError$1(null, config, request) : cancel);
-          request.abort();
-          request = null;
-        };
-
-        _config.cancelToken && _config.cancelToken.subscribe(onCanceled);
-        if (_config.signal) {
-          _config.signal.aborted ? onCanceled() : _config.signal.addEventListener('abort', onCanceled);
         }
-      }
 
-      const protocol = parseProtocol(_config.url);
-
-      if (protocol && platform.protocols.indexOf(protocol) === -1) {
-        reject(new AxiosError$1('Unsupported protocol ' + protocol + ':', AxiosError$1.ERR_BAD_REQUEST, config));
-        return;
-      }
+        const protocol = parseProtocol(_config.url);
 
+        if (protocol && platform.protocols.indexOf(protocol) === -1) {
+          reject(
+            new AxiosError$1(
+              'Unsupported protocol ' + protocol + ':',
+              AxiosError$1.ERR_BAD_REQUEST,
+              config
+            )
+          );
+          return;
+        }
 
-      // Send the request
-      request.send(requestData || null);
-    });
-  };
+        // Send the request
+        request.send(requestData || null);
+      });
+    };
 
   const composeSignals = (signals, timeout) => {
-    const {length} = (signals = signals ? signals.filter(Boolean) : []);
+    const { length } = (signals = signals ? signals.filter(Boolean) : []);
 
     if (timeout || length) {
       let controller = new AbortController();
@@ -2740,21 +3004,29 @@
           aborted = true;
           unsubscribe();
           const err = reason instanceof Error ? reason : this.reason;
-          controller.abort(err instanceof AxiosError$1 ? err : new CanceledError$1(err instanceof Error ? err.message : err));
+          controller.abort(
+            err instanceof AxiosError$1
+              ? err
+              : new CanceledError$1(err instanceof Error ? err.message : err)
+          );
         }
       };
 
-      let timer = timeout && setTimeout(() => {
-        timer = null;
-        onabort(new AxiosError$1(`timeout of ${timeout}ms exceeded`, AxiosError$1.ETIMEDOUT));
-      }, timeout);
+      let timer =
+        timeout &&
+        setTimeout(() => {
+          timer = null;
+          onabort(new AxiosError$1(`timeout of ${timeout}ms exceeded`, AxiosError$1.ETIMEDOUT));
+        }, timeout);
 
       const unsubscribe = () => {
         if (signals) {
           timer && clearTimeout(timer);
           timer = null;
-          signals.forEach(signal => {
-            signal.unsubscribe ? signal.unsubscribe(onabort) : signal.removeEventListener('abort', onabort);
+          signals.forEach((signal) => {
+            signal.unsubscribe
+              ? signal.unsubscribe(onabort)
+              : signal.removeEventListener('abort', onabort);
           });
           signals = null;
         }
@@ -2762,7 +3034,7 @@
 
       signals.forEach((signal) => signal.addEventListener('abort', onabort));
 
-      const {signal} = controller;
+      const { signal } = controller;
 
       signal.unsubscribe = () => utils$1.asap(unsubscribe);
 
@@ -2805,7 +3077,7 @@
     const reader = stream.getReader();
     try {
       for (;;) {
-        const {done, value} = await reader.read();
+        const { done, value } = await reader.read();
         if (done) {
           break;
         }
@@ -2828,64 +3100,69 @@
       }
     };
 
-    return new ReadableStream({
-      async pull(controller) {
-        try {
-          const {done, value} = await iterator.next();
+    return new ReadableStream(
+      {
+        async pull(controller) {
+          try {
+            const { done, value } = await iterator.next();
 
-          if (done) {
-           _onFinish();
-            controller.close();
-            return;
-          }
+            if (done) {
+              _onFinish();
+              controller.close();
+              return;
+            }
 
-          let len = value.byteLength;
-          if (onProgress) {
-            let loadedBytes = bytes += len;
-            onProgress(loadedBytes);
+            let len = value.byteLength;
+            if (onProgress) {
+              let loadedBytes = (bytes += len);
+              onProgress(loadedBytes);
+            }
+            controller.enqueue(new Uint8Array(value));
+          } catch (err) {
+            _onFinish(err);
+            throw err;
           }
-          controller.enqueue(new Uint8Array(value));
-        } catch (err) {
-          _onFinish(err);
-          throw err;
-        }
+        },
+        cancel(reason) {
+          _onFinish(reason);
+          return iterator.return();
+        },
       },
-      cancel(reason) {
-        _onFinish(reason);
-        return iterator.return();
+      {
+        highWaterMark: 2,
       }
-    }, {
-      highWaterMark: 2
-    })
+    );
   };
 
   const DEFAULT_CHUNK_SIZE = 64 * 1024;
 
-  const {isFunction} = utils$1;
+  const { isFunction } = utils$1;
 
-  const globalFetchAPI = (({Request, Response}) => ({
-    Request, Response
+  const globalFetchAPI = (({ Request, Response }) => ({
+    Request,
+    Response,
   }))(utils$1.global);
 
-  const {
-    ReadableStream: ReadableStream$1, TextEncoder
-  } = utils$1.global;
-
+  const { ReadableStream: ReadableStream$1, TextEncoder } = utils$1.global;
 
   const test = (fn, ...args) => {
     try {
       return !!fn(...args);
     } catch (e) {
-      return false
+      return false;
     }
   };
 
   const factory = (env) => {
-    env = utils$1.merge.call({
-      skipUndefined: true
-    }, globalFetchAPI, env);
+    env = utils$1.merge.call(
+      {
+        skipUndefined: true,
+      },
+      globalFetchAPI,
+      env
+    );
 
-    const {fetch: envFetch, Request, Response} = env;
+    const { fetch: envFetch, Request, Response } = env;
     const isFetchSupported = envFetch ? isFunction(envFetch) : typeof fetch === 'function';
     const isRequestSupported = isFunction(Request);
     const isResponseSupported = isFunction(Response);
@@ -2896,46 +3173,67 @@
 
     const isReadableStreamSupported = isFetchSupported && isFunction(ReadableStream$1);
 
-    const encodeText = isFetchSupported && (typeof TextEncoder === 'function' ?
-        ((encoder) => (str) => encoder.encode(str))(new TextEncoder()) :
-        async (str) => new Uint8Array(await new Request(str).arrayBuffer())
-    );
+    const encodeText =
+      isFetchSupported &&
+      (typeof TextEncoder === 'function'
+        ? (
+            (encoder) => (str) =>
+              encoder.encode(str)
+          )(new TextEncoder())
+        : async (str) => new Uint8Array(await new Request(str).arrayBuffer()));
+
+    const supportsRequestStream =
+      isRequestSupported &&
+      isReadableStreamSupported &&
+      test(() => {
+        let duplexAccessed = false;
+
+        const request = new Request(platform.origin, {
+          body: new ReadableStream$1(),
+          method: 'POST',
+          get duplex() {
+            duplexAccessed = true;
+            return 'half';
+          },
+        });
 
-    const supportsRequestStream = isRequestSupported && isReadableStreamSupported && test(() => {
-      let duplexAccessed = false;
+        const hasContentType = request.headers.has('Content-Type');
 
-      const hasContentType = new Request(platform.origin, {
-        body: new ReadableStream$1(),
-        method: 'POST',
-        get duplex() {
-          duplexAccessed = true;
-          return 'half';
-        },
-      }).headers.has('Content-Type');
+        if (request.body != null) {
+          request.body.cancel();
+        }
 
-      return duplexAccessed && !hasContentType;
-    });
+        return duplexAccessed && !hasContentType;
+      });
 
-    const supportsResponseStream = isResponseSupported && isReadableStreamSupported &&
+    const supportsResponseStream =
+      isResponseSupported &&
+      isReadableStreamSupported &&
       test(() => utils$1.isReadableStream(new Response('').body));
 
     const resolvers = {
-      stream: supportsResponseStream && ((res) => res.body)
+      stream: supportsResponseStream && ((res) => res.body),
     };
 
-    isFetchSupported && ((() => {
-      ['text', 'arrayBuffer', 'blob', 'formData', 'stream'].forEach(type => {
-        !resolvers[type] && (resolvers[type] = (res, config) => {
-          let method = res && res[type];
+    isFetchSupported &&
+      (() => {
+        ['text', 'arrayBuffer', 'blob', 'formData', 'stream'].forEach((type) => {
+          !resolvers[type] &&
+            (resolvers[type] = (res, config) => {
+              let method = res && res[type];
 
-          if (method) {
-            return method.call(res);
-          }
+              if (method) {
+                return method.call(res);
+              }
 
-          throw new AxiosError$1(`Response type '${type}' is not supported`, AxiosError$1.ERR_NOT_SUPPORT, config);
+              throw new AxiosError$1(
+                `Response type '${type}' is not supported`,
+                AxiosError$1.ERR_NOT_SUPPORT,
+                config
+              );
+            });
         });
-      });
-    })());
+      })();
 
     const getBodyLength = async (body) => {
       if (body == null) {
@@ -2986,32 +3284,41 @@
         responseType,
         headers,
         withCredentials = 'same-origin',
-        fetchOptions
+        fetchOptions,
       } = resolveConfig(config);
 
       let _fetch = envFetch || fetch;
 
       responseType = responseType ? (responseType + '').toLowerCase() : 'text';
 
-      let composedSignal = composeSignals$1([signal, cancelToken && cancelToken.toAbortSignal()], timeout);
+      let composedSignal = composeSignals$1(
+        [signal, cancelToken && cancelToken.toAbortSignal()],
+        timeout
+      );
 
       let request = null;
 
-      const unsubscribe = composedSignal && composedSignal.unsubscribe && (() => {
-        composedSignal.unsubscribe();
-      });
+      const unsubscribe =
+        composedSignal &&
+        composedSignal.unsubscribe &&
+        (() => {
+          composedSignal.unsubscribe();
+        });
 
       let requestContentLength;
 
       try {
         if (
-          onUploadProgress && supportsRequestStream && method !== 'get' && method !== 'head' &&
+          onUploadProgress &&
+          supportsRequestStream &&
+          method !== 'get' &&
+          method !== 'head' &&
           (requestContentLength = await resolveBodyLength(headers, data)) !== 0
         ) {
           let _request = new Request(url, {
             method: 'POST',
             body: data,
-            duplex: "half"
+            duplex: 'half',
           });
 
           let contentTypeHeader;
@@ -3036,7 +3343,20 @@
 
         // Cloudflare Workers throws when credentials are defined
         // see https://github.com/cloudflare/workerd/issues/902
-        const isCredentialsSupported = isRequestSupported && "credentials" in Request.prototype;
+        const isCredentialsSupported = isRequestSupported && 'credentials' in Request.prototype;
+
+        // If data is FormData and Content-Type is multipart/form-data without boundary,
+        // delete it so fetch can set it correctly with the boundary
+        if (utils$1.isFormData(data)) {
+          const contentType = headers.getContentType();
+          if (
+            contentType &&
+            /^multipart\/form-data/i.test(contentType) &&
+            !/boundary=/i.test(contentType)
+          ) {
+            headers.delete('content-type');
+          }
+        }
 
         const resolvedOptions = {
           ...fetchOptions,
@@ -3044,29 +3364,35 @@
           method: method.toUpperCase(),
           headers: headers.normalize().toJSON(),
           body: data,
-          duplex: "half",
-          credentials: isCredentialsSupported ? withCredentials : undefined
+          duplex: 'half',
+          credentials: isCredentialsSupported ? withCredentials : undefined,
         };
 
         request = isRequestSupported && new Request(url, resolvedOptions);
 
-        let response = await (isRequestSupported ? _fetch(request, fetchOptions) : _fetch(url, resolvedOptions));
+        let response = await (isRequestSupported
+          ? _fetch(request, fetchOptions)
+          : _fetch(url, resolvedOptions));
 
-        const isStreamResponse = supportsResponseStream && (responseType === 'stream' || responseType === 'response');
+        const isStreamResponse =
+          supportsResponseStream && (responseType === 'stream' || responseType === 'response');
 
         if (supportsResponseStream && (onDownloadProgress || (isStreamResponse && unsubscribe))) {
           const options = {};
 
-          ['status', 'statusText', 'headers'].forEach(prop => {
+          ['status', 'statusText', 'headers'].forEach((prop) => {
             options[prop] = response[prop];
           });
 
           const responseContentLength = utils$1.toFiniteNumber(response.headers.get('content-length'));
 
-          const [onProgress, flush] = onDownloadProgress && progressEventDecorator(
-            responseContentLength,
-            progressEventReducer(asyncDecorator(onDownloadProgress), true)
-          ) || [];
+          const [onProgress, flush] =
+            (onDownloadProgress &&
+              progressEventDecorator(
+                responseContentLength,
+                progressEventReducer(asyncDecorator(onDownloadProgress), true)
+              )) ||
+            [];
 
           response = new Response(
             trackStream(response.body, DEFAULT_CHUNK_SIZE, onProgress, () => {
@@ -3079,7 +3405,10 @@
 
         responseType = responseType || 'text';
 
-        let responseData = await resolvers[utils$1.findKey(resolvers, responseType) || 'text'](response, config);
+        let responseData = await resolvers[utils$1.findKey(resolvers, responseType) || 'text'](
+          response,
+          config
+        );
 
         !isStreamResponse && unsubscribe && unsubscribe();
 
@@ -3090,43 +3419,50 @@
             status: response.status,
             statusText: response.statusText,
             config,
-            request
+            request,
           });
-        })
+        });
       } catch (err) {
         unsubscribe && unsubscribe();
 
         if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) {
           throw Object.assign(
-            new AxiosError$1('Network Error', AxiosError$1.ERR_NETWORK, config, request, err && err.response),
+            new AxiosError$1(
+              'Network Error',
+              AxiosError$1.ERR_NETWORK,
+              config,
+              request,
+              err && err.response
+            ),
             {
-              cause: err.cause || err
+              cause: err.cause || err,
             }
-          )
+          );
         }
 
         throw AxiosError$1.from(err, err && err.code, config, request, err && err.response);
       }
-    }
+    };
   };
 
   const seedCache = new Map();
 
   const getFetch = (config) => {
     let env = (config && config.env) || {};
-    const {fetch, Request, Response} = env;
-    const seeds = [
-      Request, Response, fetch
-    ];
+    const { fetch, Request, Response } = env;
+    const seeds = [Request, Response, fetch];
 
-    let len = seeds.length, i = len,
-      seed, target, map = seedCache;
+    let len = seeds.length,
+      i = len,
+      seed,
+      target,
+      map = seedCache;
 
     while (i--) {
       seed = seeds[i];
       target = map.get(seed);
 
-      target === undefined && map.set(seed, target = (i ? new Map() : factory(env)));
+      target === undefined && map.set(seed, (target = i ? new Map() : factory(env)));
 
       map = target;
     }
@@ -3142,7 +3478,7 @@
    * - `http` for Node.js
    * - `xhr` for browsers
    * - `fetch` for fetch API-based requests
-   * 
+   *
    * @type {Object<string, Function|Object>}
    */
   const knownAdapters = {
@@ -3150,7 +3486,7 @@
     xhr: xhrAdapter,
     fetch: {
       get: getFetch,
-    }
+    },
   };
 
   // Assign adapter names for easier debugging and identification
@@ -3167,7 +3503,7 @@
 
   /**
    * Render a rejection reason string for unknown or unsupported adapters
-   * 
+   *
    * @param {string} reason
    * @returns {string}
    */
@@ -3175,17 +3511,18 @@
 
   /**
    * Check if the adapter is resolved (function, null, or false)
-   * 
+   *
    * @param {Function|null|false} adapter
    * @returns {boolean}
    */
-  const isResolvedHandle = (adapter) => utils$1.isFunction(adapter) || adapter === null || adapter === false;
+  const isResolvedHandle = (adapter) =>
+    utils$1.isFunction(adapter) || adapter === null || adapter === false;
 
   /**
    * Get the first suitable adapter from the provided list.
    * Tries each adapter in order until a supported one is found.
    * Throws an AxiosError if no adapter is suitable.
-   * 
+   *
    * @param {Array<string|Function>|string|Function} adapters - Adapter(s) by name or function.
    * @param {Object} config - Axios request configuration
    * @throws {AxiosError} If no suitable adapter is available
@@ -3222,14 +3559,17 @@
     }
 
     if (!adapter) {
-      const reasons = Object.entries(rejectedReasons)
-        .map(([id, state]) => `adapter ${id} ` +
+      const reasons = Object.entries(rejectedReasons).map(
+        ([id, state]) =>
+          `adapter ${id} ` +
           (state === false ? 'is not supported by the environment' : 'is not available in the build')
-        );
+      );
 
-      let s = length ?
-        (reasons.length > 1 ? 'since :\n' + reasons.map(renderReason).join('\n') : ' ' + renderReason(reasons[0])) :
-        'as no adapter specified';
+      let s = length
+        ? reasons.length > 1
+          ? 'since :\n' + reasons.map(renderReason).join('\n')
+          : ' ' + renderReason(reasons[0])
+        : 'as no adapter specified';
 
       throw new AxiosError$1(
         `There is no suitable adapter to dispatch the request ` + s,
@@ -3254,7 +3594,7 @@
      * Exposes all known adapters
      * @type {Object<string, Function|Object>}
      */
-    adapters: knownAdapters
+    adapters: knownAdapters,
   };
 
   /**
@@ -3287,10 +3627,7 @@
     config.headers = AxiosHeaders$1.from(config.headers);
 
     // Transform request data
-    config.data = transformData.call(
-      config,
-      config.transformRequest
-    );
+    config.data = transformData.call(config, config.transformRequest);
 
     if (['post', 'put', 'patch'].indexOf(config.method) !== -1) {
       config.headers.setContentType('application/x-www-form-urlencoded', false);
@@ -3298,39 +3635,38 @@
 
     const adapter = adapters.getAdapter(config.adapter || defaults$1.adapter, config);
 
-    return adapter(config).then(function onAdapterResolution(response) {
-      throwIfCancellationRequested(config);
-
-      // Transform response data
-      response.data = transformData.call(
-        config,
-        config.transformResponse,
-        response
-      );
-
-      response.headers = AxiosHeaders$1.from(response.headers);
-
-      return response;
-    }, function onAdapterRejection(reason) {
-      if (!isCancel(reason)) {
+    return adapter(config).then(
+      function onAdapterResolution(response) {
         throwIfCancellationRequested(config);
 
         // Transform response data
-        if (reason && reason.response) {
-          reason.response.data = transformData.call(
-            config,
-            config.transformResponse,
-            reason.response
-          );
-          reason.response.headers = AxiosHeaders$1.from(reason.response.headers);
+        response.data = transformData.call(config, config.transformResponse, response);
+
+        response.headers = AxiosHeaders$1.from(response.headers);
+
+        return response;
+      },
+      function onAdapterRejection(reason) {
+        if (!isCancel(reason)) {
+          throwIfCancellationRequested(config);
+
+          // Transform response data
+          if (reason && reason.response) {
+            reason.response.data = transformData.call(
+              config,
+              config.transformResponse,
+              reason.response
+            );
+            reason.response.headers = AxiosHeaders$1.from(reason.response.headers);
+          }
         }
-      }
 
-      return Promise.reject(reason);
-    });
+        return Promise.reject(reason);
+      }
+    );
   }
 
-  const VERSION = "1.13.5";
+  const VERSION = "1.15.2";
 
   const validators$1 = {};
 
@@ -3354,7 +3690,15 @@
    */
   validators$1.transitional = function transitional(validator, version, message) {
     function formatMessage(opt, desc) {
-      return '[Axios v' + VERSION + '] Transitional option \'' + opt + '\'' + desc + (message ? '. ' + message : '');
+      return (
+        '[Axios v' +
+        VERSION +
+        "] Transitional option '" +
+        opt +
+        "'" +
+        desc +
+        (message ? '. ' + message : '')
+      );
     }
 
     // eslint-disable-next-line func-names
@@ -3386,7 +3730,7 @@
       // eslint-disable-next-line no-console
       console.warn(`${opt} is likely a misspelling of ${correctSpelling}`);
       return true;
-    }
+    };
   };
 
   /**
@@ -3407,12 +3751,17 @@
     let i = keys.length;
     while (i-- > 0) {
       const opt = keys[i];
-      const validator = schema[opt];
+      // Use hasOwnProperty so a polluted Object.prototype.<opt> cannot supply
+      // a non-function validator and cause a TypeError. See GHSA-q8qp-cvcw-x6jj.
+      const validator = Object.prototype.hasOwnProperty.call(schema, opt) ? schema[opt] : undefined;
       if (validator) {
         const value = options[opt];
         const result = value === undefined || validator(value, opt, options);
         if (result !== true) {
-          throw new AxiosError$1('option ' + opt + ' must be ' + result, AxiosError$1.ERR_BAD_OPTION_VALUE);
+          throw new AxiosError$1(
+            'option ' + opt + ' must be ' + result,
+            AxiosError$1.ERR_BAD_OPTION_VALUE
+          );
         }
         continue;
       }
@@ -3424,7 +3773,7 @@
 
   var validator = {
     assertOptions,
-    validators: validators$1
+    validators: validators$1,
   };
 
   const validators = validator.validators;
@@ -3441,7 +3790,7 @@
       this.defaults = instanceConfig || {};
       this.interceptors = {
         request: new InterceptorManager$1(),
-        response: new InterceptorManager$1()
+        response: new InterceptorManager$1(),
       };
     }
 
@@ -3463,13 +3812,29 @@
           Error.captureStackTrace ? Error.captureStackTrace(dummy) : (dummy = new Error());
 
           // slice off the Error: ... line
-          const stack = dummy.stack ? dummy.stack.replace(/^.+\n/, '') : '';
+          const stack = (() => {
+            if (!dummy.stack) {
+              return '';
+            }
+
+            const firstNewlineIndex = dummy.stack.indexOf('\n');
+
+            return firstNewlineIndex === -1 ? '' : dummy.stack.slice(firstNewlineIndex + 1);
+          })();
           try {
             if (!err.stack) {
               err.stack = stack;
               // match without the 2 top stack lines
-            } else if (stack && !String(err.stack).endsWith(stack.replace(/^.+\n.+\n/, ''))) {
-              err.stack += '\n' + stack;
+            } else if (stack) {
+              const firstNewlineIndex = stack.indexOf('\n');
+              const secondNewlineIndex =
+                firstNewlineIndex === -1 ? -1 : stack.indexOf('\n', firstNewlineIndex + 1);
+              const stackWithoutTwoTopLines =
+                secondNewlineIndex === -1 ? '' : stack.slice(secondNewlineIndex + 1);
+
+              if (!String(err.stack).endsWith(stackWithoutTwoTopLines)) {
+                err.stack += '\n' + stack;
+              }
             }
           } catch (e) {
             // ignore the case where "stack" is an un-writable property
@@ -3492,27 +3857,35 @@
 
       config = mergeConfig(this.defaults, config);
 
-      const {transitional, paramsSerializer, headers} = config;
+      const { transitional, paramsSerializer, headers } = config;
 
       if (transitional !== undefined) {
-        validator.assertOptions(transitional, {
-          silentJSONParsing: validators.transitional(validators.boolean),
-          forcedJSONParsing: validators.transitional(validators.boolean),
-          clarifyTimeoutError: validators.transitional(validators.boolean),
-          legacyInterceptorReqResOrdering: validators.transitional(validators.boolean)
-        }, false);
+        validator.assertOptions(
+          transitional,
+          {
+            silentJSONParsing: validators.transitional(validators.boolean),
+            forcedJSONParsing: validators.transitional(validators.boolean),
+            clarifyTimeoutError: validators.transitional(validators.boolean),
+            legacyInterceptorReqResOrdering: validators.transitional(validators.boolean),
+          },
+          false
+        );
       }
 
       if (paramsSerializer != null) {
         if (utils$1.isFunction(paramsSerializer)) {
           config.paramsSerializer = {
-            serialize: paramsSerializer
+            serialize: paramsSerializer,
           };
         } else {
-          validator.assertOptions(paramsSerializer, {
-            encode: validators.function,
-            serialize: validators.function
-          }, true);
+          validator.assertOptions(
+            paramsSerializer,
+            {
+              encode: validators.function,
+              serialize: validators.function,
+            },
+            true
+          );
         }
       }
 
@@ -3523,26 +3896,25 @@
         config.allowAbsoluteUrls = true;
       }
 
-      validator.assertOptions(config, {
-        baseUrl: validators.spelling('baseURL'),
-        withXsrfToken: validators.spelling('withXSRFToken')
-      }, true);
+      validator.assertOptions(
+        config,
+        {
+          baseUrl: validators.spelling('baseURL'),
+          withXsrfToken: validators.spelling('withXSRFToken'),
+        },
+        true
+      );
 
       // Set config.method
       config.method = (config.method || this.defaults.method || 'get').toLowerCase();
 
       // Flatten headers
-      let contextHeaders = headers && utils$1.merge(
-        headers.common,
-        headers[config.method]
-      );
+      let contextHeaders = headers && utils$1.merge(headers.common, headers[config.method]);
 
-      headers && utils$1.forEach(
-        ['delete', 'get', 'head', 'post', 'put', 'patch', 'common'],
-        (method) => {
+      headers &&
+        utils$1.forEach(['delete', 'get', 'head', 'post', 'put', 'patch', 'common'], (method) => {
           delete headers[method];
-        }
-      );
+        });
 
       config.headers = AxiosHeaders$1.concat(contextHeaders, headers);
 
@@ -3557,7 +3929,8 @@
         synchronousRequestInterceptors = synchronousRequestInterceptors && interceptor.synchronous;
 
         const transitional = config.transitional || transitionalDefaults;
-        const legacyInterceptorReqResOrdering = transitional && transitional.legacyInterceptorReqResOrdering;
+        const legacyInterceptorReqResOrdering =
+          transitional && transitional.legacyInterceptorReqResOrdering;
 
         if (legacyInterceptorReqResOrdering) {
           requestInterceptorChain.unshift(interceptor.fulfilled, interceptor.rejected);
@@ -3631,28 +4004,32 @@
   // Provide aliases for supported request methods
   utils$1.forEach(['delete', 'get', 'head', 'options'], function forEachMethodNoData(method) {
     /*eslint func-names:0*/
-    Axios.prototype[method] = function(url, config) {
-      return this.request(mergeConfig(config || {}, {
-        method,
-        url,
-        data: (config || {}).data
-      }));
+    Axios.prototype[method] = function (url, config) {
+      return this.request(
+        mergeConfig(config || {}, {
+          method,
+          url,
+          data: (config || {}).data,
+        })
+      );
     };
   });
 
   utils$1.forEach(['post', 'put', 'patch'], function forEachMethodWithData(method) {
-    /*eslint func-names:0*/
-
     function generateHTTPMethod(isForm) {
       return function httpMethod(url, data, config) {
-        return this.request(mergeConfig(config || {}, {
-          method,
-          headers: isForm ? {
-            'Content-Type': 'multipart/form-data'
-          } : {},
-          url,
-          data
-        }));
+        return this.request(
+          mergeConfig(config || {}, {
+            method,
+            headers: isForm
+              ? {
+                  'Content-Type': 'multipart/form-data',
+                }
+              : {},
+            url,
+            data,
+          })
+        );
       };
     }
 
@@ -3685,7 +4062,7 @@
       const token = this;
 
       // eslint-disable-next-line func-names
-      this.promise.then(cancel => {
+      this.promise.then((cancel) => {
         if (!token._listeners) return;
 
         let i = token._listeners.length;
@@ -3697,10 +4074,10 @@
       });
 
       // eslint-disable-next-line func-names
-      this.promise.then = onfulfilled => {
+      this.promise.then = (onfulfilled) => {
         let _resolve;
         // eslint-disable-next-line func-names
-        const promise = new Promise(resolve => {
+        const promise = new Promise((resolve) => {
           token.subscribe(resolve);
           _resolve = resolve;
         }).then(onfulfilled);
@@ -3788,7 +4165,7 @@
       });
       return {
         token,
-        cancel
+        cancel,
       };
     }
   }
@@ -3830,7 +4207,7 @@
    * @returns {boolean} True if the payload is an error thrown by Axios, otherwise false
    */
   function isAxiosError(payload) {
-    return utils$1.isObject(payload) && (payload.isAxiosError === true);
+    return utils$1.isObject(payload) && payload.isAxiosError === true;
   }
 
   const HttpStatusCode = {
@@ -3923,10 +4300,10 @@
     const instance = bind(Axios$1.prototype.request, context);
 
     // Copy axios.prototype to instance
-    utils$1.extend(instance, Axios$1.prototype, context, {allOwnKeys: true});
+    utils$1.extend(instance, Axios$1.prototype, context, { allOwnKeys: true });
 
     // Copy context to instance
-    utils$1.extend(instance, context, null, {allOwnKeys: true});
+    utils$1.extend(instance, context, null, { allOwnKeys: true });
 
     // Factory for creating new instances
     instance.create = function create(instanceConfig) {
@@ -3970,7 +4347,7 @@
 
   axios.AxiosHeaders = AxiosHeaders$1;
 
-  axios.formToJSON = thing => formDataToJSON(utils$1.isHTMLForm(thing) ? new FormData(thing) : thing);
+  axios.formToJSON = (thing) => formDataToJSON(utils$1.isHTMLForm(thing) ? new FormData(thing) : thing);
 
   axios.getAdapter = adapters.getAdapter;
 
@@ -4166,8 +4543,132 @@
     HTML_PAGE_REQUEST: 'HTML_PAGE_REQUEST',
     HTML_PAGE_RESPONSE: 'HTML_PAGE_RESPONSE',
     HTML_PAGE_EVENT: 'HTML_PAGE_EVENT',
+    HTML_PAGE_ENABLE_COMMENT_MODE: 'HTML_PAGE_ENABLE_COMMENT_MODE',
+    HTML_PAGE_DISABLE_COMMENT_MODE: 'HTML_PAGE_DISABLE_COMMENT_MODE',
+    HTML_PAGE_COMMENT_MODE_ELEMENT_HOVER: 'HTML_PAGE_COMMENT_MODE_ELEMENT_HOVER',
+    HTML_PAGE_COMMENT_MODE_ELEMENT_SELECTED: 'HTML_PAGE_COMMENT_MODE_ELEMENT_SELECTED',
     WINDOW_EVENT: 'WINDOW_EVENT'
   };
+
+  const countSameTagSiblingsBefore = element => {
+    let count = 0;
+    let sibling = element.previousElementSibling;
+    while (sibling) {
+      if (sibling.tagName === element.tagName) count += 1;
+      sibling = sibling.previousElementSibling;
+    }
+    return count;
+  };
+  const generateSelector = element => {
+    if (!element || element === document.body) return null;
+    const parts = [];
+    let current = element;
+    while (current && current !== document.body) {
+      const tag = current.tagName.toLowerCase();
+      const index = countSameTagSiblingsBefore(current) + 1;
+      parts.unshift(`${tag}:nth-of-type(${index})`);
+      current = current.parentElement;
+    }
+    return 'body > ' + parts.join(' > ');
+  };
+  const getHtmlHint = function (element) {
+    let maxLen = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 180;
+    const html = element.outerHTML || '';
+    return html.length > maxLen ? html.slice(0, maxLen) : html;
+  };
+  const getCurrentText = function (element) {
+    let maxLen = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 160;
+    const text = (element.textContent || '').replace(/\s+/g, ' ').trim();
+    return text.length > maxLen ? text.slice(0, maxLen) : text;
+  };
+  const computeStyle = element => {
+    const style = window.getComputedStyle(element);
+    return {
+      backgroundColor: style.backgroundColor,
+      color: style.color,
+      fontSize: style.fontSize,
+      fontWeight: style.fontWeight,
+      fontFamily: style.fontFamily,
+      lineHeight: style.lineHeight,
+      borderRadius: style.borderRadius,
+      paddingBottom: style.paddingBottom,
+      paddingLeft: style.paddingLeft,
+      paddingRight: style.paddingRight,
+      paddingTop: style.paddingTop,
+      marginBottom: style.marginBottom,
+      marginLeft: style.marginLeft,
+      marginRight: style.marginRight,
+      marginTop: style.marginTop,
+      textAlign: style.textAlign,
+      display: style.display,
+      width: style.width,
+      height: style.height
+    };
+  };
+  const generateLabel = element => {
+    const tag = element.tagName.toLowerCase();
+    const classes = element.classList.length > 0 ? '.' + Array.from(element.classList).join('.') : '';
+    return `${tag}${classes}`;
+  };
+  class CommentModeAdapter {
+    constructor() {
+      this.isActive = false;
+      this._handleEvent = this._handleEvent.bind(this);
+      this.mouseEvents = ['click', 'dblclick', 'mousedown', 'mouseup', 'mousemove', 'mouseover', 'mouseout', 'mouseenter', 'mouseleave', 'contextmenu'];
+    }
+    enable() {
+      if (this.isActive) return;
+      this.isActive = true;
+      this.mouseEvents.forEach(eventType => {
+        window.addEventListener(eventType, this._handleEvent, true);
+      });
+    }
+    disable() {
+      if (!this.isActive) return;
+      this.isActive = false;
+      this.mouseEvents.forEach(eventType => {
+        window.removeEventListener(eventType, this._handleEvent, true);
+      });
+    }
+    _handleEvent(event) {
+      if (!this.isActive) return;
+      event.preventDefault();
+      event.stopPropagation();
+      event.stopImmediatePropagation();
+      const target = event.target;
+      if (event.type === 'mouseover') {
+        const data = this.buildElementData(target);
+        if (data) {
+          window.parent.postMessage({
+            type: POST_MESSAGE_TYPE.HTML_PAGE_COMMENT_MODE_ELEMENT_HOVER,
+            data
+          }, '*');
+        }
+      } else if (event.type === 'click') {
+        const data = this.buildElementData(target);
+        if (data) {
+          window.parent.postMessage({
+            type: POST_MESSAGE_TYPE.HTML_PAGE_COMMENT_MODE_ELEMENT_SELECTED,
+            data
+          }, '*');
+        }
+      }
+    }
+    buildElementData(target) {
+      const selector = generateSelector(target) || null;
+      return {
+        selector,
+        currentText: getCurrentText(target),
+        htmlHint: getHtmlHint(target),
+        computedStyle: computeStyle(target),
+        label: generateLabel(target)
+      };
+    }
+    destroy() {
+      this.disable();
+    }
+  }
+
   const POST_MESSAGE_REQUEST_TYPE = {
     GET_SERVER: 'get_server',
     GET_ACCESS_TOKEN: 'get_access_token',
@@ -4182,6 +4683,7 @@
   const SUPPORT_WINDOW_KEYBOARD_EVENT_TYPES = ['keydown', 'keyup', 'keypress'];
   const SUPPORT_WINDOW_DRAG_EVENT_TYPES = ['dragstart', 'dragover', 'drag', 'dragend', 'dragenter', 'dragleave', 'drop'];
   const HIGH_FREQUENCY_WINDOW_EVENT_TYPES = ['mousemove', 'dragover'];
+  const INTERACTIVE_TAGS = ['SELECT', 'INPUT', 'TEXTAREA', 'BUTTON'];
   const hasOwnProperty = (obj, key) => {
     return Object.prototype.hasOwnProperty.call(obj, key);
   };
@@ -4243,6 +4745,8 @@
       this.pendingRequests = {};
       this.eventHandlers = {};
       this.timeout = this.options.timeout || 10000;
+      this.isCommentMode = false;
+      this.commentModeAdapter = new CommentModeAdapter();
       this.setupMessageListener();
     }
     generatorRequestId() {
@@ -4270,41 +4774,57 @@
       }, this.targetOrigin);
     }
     setEventsListener() {
-      let rafId = null;
-      let pendingEvent = null;
-      [...SUPPORT_WINDOW_MOUSE_EVENT_TYPES, ...SUPPORT_WINDOW_KEYBOARD_EVENT_TYPES, ...SUPPORT_WINDOW_DRAG_EVENT_TYPES].forEach(eventType => {
-        window.addEventListener(eventType, event => {
-          if (event.source === WINDOW_EVENT_SOURCE_TYPE.APP) return;
-          if (HIGH_FREQUENCY_WINDOW_EVENT_TYPES.includes(eventType)) {
-            // High-frequency events that need throttling (use RAF to limit to 60fps)
-            // Use requestAnimationFrame for throttling high-frequency events
-            // Store the latest event with necessary data
-            pendingEvent = createWindowEventData({
-              eventType,
-              event
-            });
-
-            // Only schedule a new frame if one isn't already scheduled
-            if (rafId === null) {
-              rafId = requestAnimationFrame(() => {
-                if (pendingEvent) {
-                  this.postWindowEvent(pendingEvent);
-                  pendingEvent = null;
-                  rafId = null;
-                }
-              });
-            }
-            return;
-          }
-
-          // Low-frequency events
-          this.postWindowEvent(createWindowEventData({
-            eventType,
-            event
-          }));
-        }, true);
+      this._windowEventHandler = this._windowEventHandler.bind(this);
+      this.interactiveEventTypes = [...SUPPORT_WINDOW_MOUSE_EVENT_TYPES, ...SUPPORT_WINDOW_KEYBOARD_EVENT_TYPES, ...SUPPORT_WINDOW_DRAG_EVENT_TYPES];
+      this.rafId = null;
+      this.pendingEvent = null;
+      this.bindInteractiveEvents();
+    }
+    bindInteractiveEvents() {
+      this.interactiveEventTypes.forEach(eventType => {
+        window.addEventListener(eventType, this._windowEventHandler, true);
       });
     }
+    unbindInteractiveEvents() {
+      this.interactiveEventTypes.forEach(eventType => {
+        window.removeEventListener(eventType, this._windowEventHandler, true);
+      });
+      if (this.rafId !== null) {
+        cancelAnimationFrame(this.rafId);
+        this.rafId = null;
+      }
+      this.pendingEvent = null;
+    }
+    _windowEventHandler(event) {
+      if (event.source === WINDOW_EVENT_SOURCE_TYPE.APP) return;
+      const target = event.target;
+      if (target && INTERACTIVE_TAGS.includes(target.tagName)) return;
+      const eventType = event.type;
+      if (SUPPORT_WINDOW_KEYBOARD_EVENT_TYPES.includes(eventType)) {
+        const active = document.activeElement;
+        if (active && INTERACTIVE_TAGS.includes(active.tagName)) return;
+      }
+      if (HIGH_FREQUENCY_WINDOW_EVENT_TYPES.includes(eventType)) {
+        this.pendingEvent = createWindowEventData({
+          eventType,
+          event
+        });
+        if (this.rafId === null) {
+          this.rafId = requestAnimationFrame(() => {
+            if (this.pendingEvent) {
+              this.postWindowEvent(this.pendingEvent);
+              this.pendingEvent = null;
+              this.rafId = null;
+            }
+          });
+        }
+        return;
+      }
+      this.postWindowEvent(createWindowEventData({
+        eventType,
+        event
+      }));
+    }
     async request(method, params) {
       if (this.selfWindow) {
         return new Promise(resolve => {
@@ -4362,62 +4882,75 @@
         }
       } else if (type === POST_MESSAGE_TYPE.HTML_PAGE_EVENT) {
         this.emitEvent(eventType, payload);
+      } else if (type === POST_MESSAGE_TYPE.HTML_PAGE_ENABLE_COMMENT_MODE) {
+        this.isCommentMode = true;
+        document.body.style.cursor = 'crosshair';
+        this.unbindInteractiveEvents();
+        if (this.commentModeAdapter) this.commentModeAdapter.enable();
+      } else if (type === POST_MESSAGE_TYPE.HTML_PAGE_DISABLE_COMMENT_MODE) {
+        this.isCommentMode = false;
+        document.body.style.cursor = '';
+        if (this.commentModeAdapter) this.commentModeAdapter.disable();
+        this.bindInteractiveEvents();
       } else if (type === POST_MESSAGE_TYPE.WINDOW_EVENT) {
-        const eventData = data.event_data;
-        if (!eventData) return;
-        let syntheticEvent;
-        let targetElement;
-        if (SUPPORT_WINDOW_KEYBOARD_EVENT_TYPES.includes(eventData.type)) {
-          syntheticEvent = new KeyboardEvent(eventData.type, {
-            bubbles: true,
-            cancelable: true,
-            key: eventData.key,
-            code: eventData.code,
-            keyCode: eventData.keyCode,
-            ctrlKey: eventData.ctrlKey,
-            shiftKey: eventData.shiftKey,
-            altKey: eventData.altKey,
-            metaKey: eventData.metaKey,
-            repeat: eventData.repeat,
-            view: window
-          });
-          targetElement = document.activeElement || document.body;
-        } else if (SUPPORT_WINDOW_MOUSE_EVENT_TYPES.includes(eventData.type)) {
-          syntheticEvent = new MouseEvent(eventData.type, {
-            bubbles: true,
-            cancelable: true,
-            view: window,
-            clientX: eventData.x,
-            clientY: eventData.y,
-            screenX: eventData.x,
-            screenY: eventData.y,
-            button: eventData.button,
-            buttons: eventData.buttons
-          });
-          const elementAtPoint = document.elementFromPoint(eventData.x, eventData.y);
-          targetElement = elementAtPoint || document.body;
-        } else if (SUPPORT_WINDOW_DRAG_EVENT_TYPES.includes(eventData.type)) {
-          syntheticEvent = new DragEvent(eventData.type, {
-            bubbles: true,
-            cancelable: true,
-            view: window,
-            clientX: eventData.x,
-            clientY: eventData.y,
-            screenX: eventData.x,
-            screenY: eventData.y,
-            button: eventData.button,
-            buttons: eventData.buttons
-          });
-          const elementAtPoint = document.elementFromPoint(eventData.x, eventData.y);
-          targetElement = elementAtPoint || document.body;
-        }
-        if (!targetElement || !syntheticEvent) return;
-
-        // Dispatch once on the target element, it will bubble up naturally
-        syntheticEvent.source = eventData.source;
-        targetElement.dispatchEvent(syntheticEvent);
+        this.handleWindowEvent(data);
       }
     }
+    handleWindowEvent(data) {
+      const eventData = data.event_data;
+      if (!eventData || this.isCommentMode) return;
+      let syntheticEvent;
+      let targetElement;
+      if (SUPPORT_WINDOW_KEYBOARD_EVENT_TYPES.includes(eventData.type)) {
+        syntheticEvent = new KeyboardEvent(eventData.type, {
+          bubbles: true,
+          cancelable: true,
+          key: eventData.key,
+          code: eventData.code,
+          keyCode: eventData.keyCode,
+          ctrlKey: eventData.ctrlKey,
+          shiftKey: eventData.shiftKey,
+          altKey: eventData.altKey,
+          metaKey: eventData.metaKey,
+          repeat: eventData.repeat,
+          view: window
+        });
+        targetElement = document.activeElement || document.body;
+      } else if (SUPPORT_WINDOW_MOUSE_EVENT_TYPES.includes(eventData.type)) {
+        syntheticEvent = new MouseEvent(eventData.type, {
+          bubbles: true,
+          cancelable: true,
+          view: window,
+          clientX: eventData.x,
+          clientY: eventData.y,
+          screenX: eventData.x,
+          screenY: eventData.y,
+          button: eventData.button,
+          buttons: eventData.buttons
+        });
+        const elementAtPoint = document.elementFromPoint(eventData.x, eventData.y);
+        targetElement = elementAtPoint || document.body;
+      } else if (SUPPORT_WINDOW_DRAG_EVENT_TYPES.includes(eventData.type)) {
+        syntheticEvent = new DragEvent(eventData.type, {
+          bubbles: true,
+          cancelable: true,
+          view: window,
+          clientX: eventData.x,
+          clientY: eventData.y,
+          screenX: eventData.x,
+          screenY: eventData.y,
+          button: eventData.button,
+          buttons: eventData.buttons
+        });
+        const elementAtPoint = document.elementFromPoint(eventData.x, eventData.y);
+        targetElement = elementAtPoint || document.body;
+      }
+      if (!targetElement || !syntheticEvent) return;
+
+      // Dispatch once on the target element, it will bubble up naturally
+      syntheticEvent.source = eventData.source;
+      targetElement.dispatchEvent(syntheticEvent);
+    }
     on(eventType, handler) {
       if (!hasOwnProperty(this.eventHandlers, eventType)) {
         this.eventHandlers[eventType] = [];
@@ -4452,6 +4985,9 @@
       });
       this.pendingRequests = {};
       this.eventHandlers = {};
+      if (this.commentModeAdapter) {
+        this.commentModeAdapter.destroy();
+      }
     }
   }