[dependabot]

Bumps the dev-minor-patch group with 2 updates: axios and nock.

Updates axios from 1.21.0 to 1.21.1

Release notes

Sourced from axios's releases.

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

• follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)

🐛 Bug Fixes

• Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)
• TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#11404)

🔧 Maintenance & Chores

• Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

  • transformRequest runs for every method, and transformers receive (data, headers, status).
  • responseType and Content-Type have no default value.
  • AxiosHeaders#get and #normalize are described correctly.
  • Errors should be identified with axios.isAxiosError(), not by name.
  • The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.
  • New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

  (#11374, #11373, #11389, #11419, #11429, #11430)

• Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)

• Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)

• CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#11396)

• Dependencies: Updated development and tooling dependencies, including vitest and @vitest/* (to 5.x at the root), typescript (7.x at the root), vite, rollup, eslint, playwright, @commitlint/*, @rollup/plugin-alias, @rollup/plugin-terser, body-parser, multer, serialize-javascript, fast-uri, qs, zizmorcore/zizmor-action, and follow-redirects in /docs. (#11383, #11375, #11372, #11345, #11392, #11387, #11386, #11385, #11391, #11388, #11395, #11421, #11422, #11426)

• Release: Prepared the 1.21.1 release. (#11435)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​Ghoscro (#11374)
• @​pei711 (#11373)
• @​ivanhapaz (#11399)
• @​aelmanaa (#11404)
• @​Aryapatel-007 (#11429, #11430)
• @​umair-ghafoor-ai (#11376)
• @​yxshee (#11389)
• @​malinele (#11401)
• @​AnantDuhan (#11431)

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits

• 335e2f8 chore(release): prepare release 1.21.1 (#11435)
• c07e981 docs: note that FormData parsing has a fixed depth limit (#11430)
• f0fcec7 test(helpers): cover IDN, CIDR and port edge cases in shouldBypassProxy (#11431)
• 4f203a9 docs(i18n): add locale prefix to internal links in es, fr, zh docs (#11401)
• 98156ee docs: correct request config and AxiosHeaders descriptions (#11389)
• a81d62a test: cover cancellation lifecycle and timeout precedence (#11376)
• a42a19a docs: add missing error codes to the error tables (#11429)
• 1fcaf82 chore(deps-dev): refresh development dependencies (#11426)
• fb88a1b chore(deps-dev): bump the development_dependencies group with 4 updates (#11422)
• 31cc02a chore(deps): bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 in the github-...
• Additional commits viewable in compare view

Updates nock from 15.0.5 to 15.0.6

Release notes

Sourced from nock's releases.

v15.0.6

15.0.6 (2026-11-05)

Bug Fixes

• support @​mswjs/interceptors 0.45 by streaming delayed bodies wit… (#3056) (3e817ab)

Commits

• 3e817ab fix: support @​mswjs/interceptors 0.45 by streaming delayed bodies wit… (#3056)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

✅ Approved

🤖 Claude Sonnet 4.6 (claude-sonnet-4-6) via claude-bridge · mode: single-call · run

Dependency-only lockfile bump: axios 1.21.0→1.21.1 (patches CVE-2026-116689 via follow-redirects ^1.16.2→1.16.3), nock 15.0.5→15.0.6, and their transitive dependency @mswjs/interceptors 0.44.0→0.45.11. All are devDependencies with no runtime impact. The @upstash/context7-mcp removal from the lockfile root reflects a prior package.json change.

No blocking findings — clean diff.

---

Gate wrong or a false positive? Do not edit this workflow to pass — open an issue on lagowski/pr-review-gate.