deps: bump axios from 1.18.1 to 1.19.0

[dependabot]

Bumps axios from 1.18.1 to 1.19.0.

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)
• @​Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)

... (truncated)

Commits

• 311fcc5 chore(release): prepare release 1.19.0 (#11095)
• cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
• 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
• 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
• c44f8d0 ci: use bundled npm for v1 publish (#11083)
• 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
• a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
• 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
• 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
• 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
care-sync	Error		Aug 10, 2026 11:18am

[github-actions]

🎉 Thank you for submitting a Pull Request to CareSync!

We appreciate your contribution.

Before review, please ensure:

✅ Your branch is up to date with the latest main branch
✅ Code follows project conventions
✅ Changes are focused and relevant
✅ Documentation is updated if necessary
✅ The application builds successfully

A maintainer will review your contribution soon.

Thank you for helping make CareSync better! 🚀

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/axios	1.19.0	🟢 8.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 7 Found 15/19 approved changesets -- score normalized to 7 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• package-lock.json

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🤖 CI Pipeline Results

Check	Status
ESLint	❌ Failed
TypeScript	❌ Failed
Tests	❌ Failed

📋 ESLint Output

> caresync-web@0.1.0 lint
> eslint "src/**/*.{js,jsx,ts,tsx}" "server/**/*.{js,jsx}"


Oops! Something went wrong! :(

ESLint: 10.6.0

ESLint couldn't find an eslint.config.(js|mjs|cjs) file.

From ESLint v9.0.0, the default configuration file is now eslint.config.js.
If you are using a .eslintrc.* file, please follow the migration guide
to update your configuration file to the new format:

https://eslint.org/docs/latest/use/configure/migration-guide

If you still have problems after following the migration guide, please stop by
https://eslint.org/chat/help to chat with the team.

🔷 TypeScript Output

Version 6.0.3
tsc: The TypeScript Compiler - Version 6.0.3

COMMON COMMANDS

  tsc
  Compiles the current project (tsconfig.json in the working directory.)

  tsc app.ts util.ts
  Ignoring tsconfig.json, compiles the specified files with default compiler options.

  tsc -b
  Build a composite project in the working directory.

  tsc --init
  Creates a tsconfig.json with the recommended settings in the working directory.

  tsc -p ./path/to/tsconfig.json
  Compiles the TypeScript project located at the specified path.

  tsc --help --all
  An expanded version of this information, showing all possible compiler options

  tsc --noEmit
  tsc --target esnext
  Compiles the current project, with additional settings.

COMMAND LINE FLAGS

--help, -h
Print this message.

--watch, -w
Watch input files.

--all
Show all compiler options.

--version, -v
Print the compiler's version.

--init
Initializes a TypeScript project and creates a tsconfig.json file.

--project, -p
Compile the project given the path to its configuration file, or to a folder with a 'tsconfig.json'.

--showConfig
Print the final configuration instead of building.

--ignoreConfig
Ignore the tsconfig found and build with commandline options and files.

--build, -b
Build one or more projects and their dependencies, if out of date

COMMON COMPILER OPTIONS

--pretty
Enable color and formatting in TypeScript's output to make compiler errors easier to read.
type: boolean
default: true

--declaration, -d
Generate .d.ts files 

🧪 Test Output

> caresync-web@0.1.0 test
> react-app-rewired test --coverage --ci

PASS src/utils/notifications.test.js
  ● Console

    console.warn
      This browser does not support notifications.

    �[0m �[90m 50 |�[39m �[36mexport�[39m �[36masync�[39m �[36mfunction�[39m requestNotificationPermission() {
     �[90m 51 |�[39m   �[36mif�[39m (�[36mtypeof�[39m window �[33m===�[39m �[32m'undefined'�[39m �[33m||�[39m �[33m!�[39m(�[32m'Notification'�[39m �[36min�[39m window)) {
    �[31m�[1m>�[22m�[39m�[90m 52 |�[39m     console�[33m.�[39mwarn(�[32m'This browser does not support notifications.'�[39m)�[33m;�[39m
     �[90m    |�[39m             �[31m�[1m^�[22m�[39m
     �[90m 53 |�[39m     �[36mreturn�[39m �[32m'denied'�[39m�[33m;�[39m
     �[90m 54 |�[39m   }
     �[90m 55 |�[39m�[0m

      at requestNotificationPermission (src/utils/notifications.js:52:13)
      at Object.<anonymous> (src/utils/notifications.test.js:57:55)

PASS src/utils/settingsPreferences.test.js
PASS src/utils/proxyConfig.test.js
PASS src/utils/sanitize.test.js
  ● Console

    console.warn
      Prototype pollution attempt blocked. Rejected key: "__proto__"

    �[0m �[90m 44 |�[39m   �[36mfor�[39m (�[36mconst�[39m key �[36mof�[39m �[33mObject�[39m�[33m.�[39mkeys(obj)) {
     �[90m 45 |�[39m     �[36mif�[39m (�[33mDANGEROUS_KEYS�[39m�[33m.�[39mhas(key�[33m.�[39mtrim()�[33m.�[39mtoLowerCase())) {
    �[31m�[1m>�[22m�[39m�[90m 46 |�[39m       console�[33m.�[39mwarn(�[32m`Prototype pollution attempt blocked. Rejected ke

Automated feedback by CareSync CI — fix any issues above before requesting review.