Skip to content

Bump axios and acme-client#3270

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/multi-b027791f76
Open

Bump axios and acme-client#3270
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/multi-b027791f76

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 1, 2026

Bumps axios to 1.13.6 and updates ancestor dependency acme-client. These dependencies need to be updated together.

Updates axios from 0.26.1 to 1.13.6

Release notes

Sourced from axios's releases.

v1.13.6

This release focuses on platform compatibility, error handling improvements, and code quality maintenance.

⚠️ Important Changes

  • Breaking Changes: None identified in this release.
  • Action Required: Users targeting React Native should verify their integration, particularly if relying on specific Blob or FormData behaviours, as improvements have been made to support these objects.

🚀 New Features

  • React Native Blob Support: Axios now includes support for React Native Blob objects. Thanks to @​moh3n9595 for the initial implementation. (#5764)
  • Code Quality: Implemented prettier across the codebase and resolved associated formatting issues. (#7385)

🐛 Bug Fixes

  • Environment Compatibility:

    • Fixed module exports for React Native and Browserify environments. (#7386)
    • Added safe FormData detection for the WeChat Mini Program environment. (#7324)
  • Error Handling:

    • AxiosError.message is now correctly enumerable. (#7392)
    • AxiosError.from now correctly copies the status property from the source error, ensuring better error propagation. (#7403)

🔧 Maintenance & Chores

  • Dependencies: Updated the development_dependencies group (5 updates). (#7432)
  • Infrastructure: Migrated @​rollup/plugin-babel from v5.3.1 to v6.1.0. (#7424)
  • Documentation: Added missing JSDoc comments to utilities. (#7427)

🌟 New Contributors

We are thrilled to welcome our new contributors! Thank you for helping improve the project:

Full Changelog: v1.13.5...v1.13.6

v1.13.5

Release 1.13.5

Highlights

  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

  • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

... (truncated)

Commits
  • 7108c88 chore(release): prepare release 1.13.6 (#7446)
  • 20a0ba3 refactor(deps): migrate @​rollup/plugin-babel from v5.3.1 to v6.1.0 (#7424)
  • 885b4af feat: support react native blob objects (#5764)
  • 00d97b9 docs(utils): add missing JSDoc comments (#7427)
  • 9712548 chore(deps-dev): bump the development_dependencies group across 1 directory w...
  • d51accb fix(core): copy status from source error in AxiosError.from (#7403)
  • 3e30bbf chore: fix publish to only run on v1 tags
  • 672491d fix: safe FormData detection for WeChat Mini Program (#7306) (#7324)
  • 822e3e4 fix: make AxiosError.message property enumerable (#7392)
  • ef3711d feat: implement prettier and fix all issues (#7385)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates acme-client from 4.2.5 to 5.4.0

Changelog

Sourced from acme-client's changelog.

v5.4.0 (2024-07-16)

  • added Directory URLs for Google ACME provider
  • fixed Invalidate ACME provider directory cache after 24 hours
  • fixed Retry HTTP requests on server errors or when rate limited - #89

v5.3.1 (2024-05-22)

  • fixed Allow client.auto() being called with an empty CSR common name
  • fixed Bug when calling updateAccountKey() with external account binding

v5.3.0 (2024-02-05)

  • added Support and tests for satisfying tls-alpn-01 challenges
  • changed Replace jsrsasign with @peculiar/x509 for certificate and CSR handling
  • changed Method getChallengeKeyAuthorization() now returns $token.$thumbprint when called with a tls-alpn-01 challenge
    • Previously returned base64url encoded SHA256 digest of $token.$thumbprint erroneously
    • This change is not considered breaking since the previous behavior was incorrect

v5.2.0 (2024-01-22)

  • fixed Allow self-signed or invalid certs when validating http-01 challenges that redirect to HTTPS - #65
  • fixed Wait for all challenge promises to settle before rejecting client.auto() - #75

v5.1.0 (2024-01-20)

v5.0.0 (2022-07-28)

  • Upgrade guide here
  • added New native crypto interface, ECC/ECDSA support
  • breaking Remove support for Node v10, v12 and v14
  • breaking Prioritize issuer closest to root during preferred chain selection - #46
  • changed Replace bluebird dependency with native promise APIs
  • changed Replace backo2 dependency with internal utility
Commits
  • 9f293d2 Bump v5.4.0
  • 1785acd Bump dependencies
  • e4e8bde Retry HTTP requests on server errors or when rate limited
  • c291190 Forgot to refresh directory timestamp after successful get
  • 0038bd6 Add utility method tests
  • 91db7d1 Temp remove Node v22 from matrix, broke CNAME tests
  • 85d6eb2 Invalidate ACME directory cache after 24 hours
  • 217df2a Directory URLs for Google ACME provider
  • e611651 Bump Pebble v2.6.0
  • b024e7e Small crypto docs fix 2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [axios](https://github.com/axios/axios) to 1.13.6 and updates ancestor dependency [acme-client](https://github.com/publishlab/node-acme-client). These dependencies need to be updated together.


Updates `axios` from 0.26.1 to 1.13.6
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.26.1...v1.13.6)

Updates `acme-client` from 4.2.5 to 5.4.0
- [Changelog](https://github.com/publishlab/node-acme-client/blob/master/CHANGELOG.md)
- [Commits](publishlab/node-acme-client@v4.2.5...v5.4.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.13.6
  dependency-type: indirect
- dependency-name: acme-client
  dependency-version: 5.4.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 1, 2026
@dependabot dependabot bot mentioned this pull request Mar 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants