deps(backend): bump the backend-minor-patch group across 1 directory with 28 updates

[dependabot]

Bumps the backend-minor-patch group with 27 updates in the /Servers directory:

Package	From	To
@aws-sdk/client-ses	3.1054.0	3.1100.0
@azure/msal-node	5.4.2	5.4.3
@e2b/code-interpreter	2.5.0	2.7.0
@mastra/core	1.51.0	1.55.0
@mastra/memory	1.20.0	1.24.0
axios	1.18.1	1.19.0
docx	9.7.0	9.7.1
express-rate-limit	8.5.2	8.6.1
helmet	8.2.0	8.3.0
http-proxy-middleware	4.1.1	4.2.0
ioredis	5.11.0	5.11.1
mjml	5.3.0	5.4.0
node-cron	4.2.1	4.6.0
pg	8.21.0	8.22.0
playwright	1.60.0	1.62.1
redis	6.0.0	6.1.0
resend	6.12.4	6.18.1
sanitize-html	2.17.5	2.17.6
xstate	5.31.1	5.32.5
@types/multer	2.1.0	2.2.0
@types/node	26.1.1	26.1.2
@types/nodemailer	8.0.0	8.0.1
@types/supertest	7.2.0	7.2.1
lint-staged	17.0.5	17.3.0
prettier	3.8.3	3.9.6
ts-jest	29.4.11	29.4.12
tsc-watch	7.2.0	7.2.1

Updates @aws-sdk/client-ses from 3.1054.0 to 3.1100.0

Release notes

Sourced from @​aws-sdk/client-ses's releases.

v3.1100.0

3.1100.0(2026-07-31)

Chores

• add packages-internal to root tsconfig inclusion (#8240) (a0f3fb58)

New Features

• clients: update client endpoints as of 2026-07-31 (30d44c7e)
• client-bcm-pricing-calculator: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (edce242c)
• client-bcm-recommended-actions: Removing Smithy RPC v2 CBOR support that was added in previous SDK release. (7bed97ab)

Bug Fixes

• core/protocols: v2 JSON codec updates and JsonBytesStringAdapter (#8238) (a1001f4b)

Tests

• lib-transfer-manager: speed up tests (#8237) (b898c5dd)

---

For list of updated packages, view updated-packages.md in assets-3.1100.0.zip

v3.1099.0

3.1099.0(2026-07-30)

Chores

• update vscode repo settings (#8236) (10f5fc09)

New Features

• clients: update client endpoints as of 2026-07-30 (e93ec43a)
• client-pricing-plan-manager: Adds support for Public PricingPlanManager SDK (f5af47b6)
• client-securityagent: Adds support for providing a branch override when configured integrated repositories (0f5a2dd0)
• client-iam: Improved IAM Policy Simulator accuracy. Simulator now evaluates SCP conditions and resource scoping, returns explicitDeny for explicit SCP denials, and reports accurate cross-account decisions. (d8cd86e4)
• client-network-firewall: Adds UPDATING field to Container Association Status (65a8fd3f)
• client-kafka: Amazon MSK Express brokers now support streaming tables for Apache Iceberg, continuously materializing Apache Kafka topics as Iceberg tables in Amazon S3 Tables. Express brokers also now support data delivery to Amazon S3 general purpose buckets. (16236255)
• client-lambda: Add Python3.15 (python3.15) and NodeJs 26 (nodejs26.x) support to AWS Lambda (e9cf5069)
• client-sagemaker: Adds support for g7 family instance types for SageMaker Studio JupyterLab and CodeEditor apps for IAD (us-east-1), PDX (us-west-2), CMH (us-east-2). (5e4ec9ce)
• client-bedrock-agentcore-control: Adds support for configuring models through the OpenResponses API for custom evaluators. CreateEvaluator and UpdateEvaluator now accept an OpenResponses model configuration for LLM-as-a-Judge evaluations. (9cfbf372)

---

For list of updated packages, view updated-packages.md in assets-3.1099.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/client-ses's changelog.

3.1100.0 (2026-07-31)

Note: Version bump only for package @​aws-sdk/client-ses

3.1099.0 (2026-07-30)

Note: Version bump only for package @​aws-sdk/client-ses

3.1098.0 (2026-07-29)

Note: Version bump only for package @​aws-sdk/client-ses

3.1097.0 (2026-07-28)

Note: Version bump only for package @​aws-sdk/client-ses

3.1096.0 (2026-07-27)

Note: Version bump only for package @​aws-sdk/client-ses

3.1095.0 (2026-07-24)

Note: Version bump only for package @​aws-sdk/client-ses

3.1094.0 (2026-07-23)

... (truncated)

Commits

• 6969cf9 Publish v3.1100.0
• 5b15ca7 Publish v3.1099.0
• ee76673 Publish v3.1098.0
• e40ebac chore(codegen): sync for CBOR v2 codec (#8233)
• b24cb22 Publish v3.1097.0
• 1b94f0b Publish v3.1096.0
• 753d651 Publish v3.1095.0
• bb564e5 chore(codegen): sync for CBOR large map deser, event-streams exceptions, endp...
• c379112 Publish v3.1094.0
• 0f79b6a Publish v3.1093.0
• Additional commits viewable in compare view

Updates @azure/msal-node from 5.4.2 to 5.4.3

Release notes

Sourced from @​azure/msal-node's releases.

@​azure/msal-react v5.4.3

5.4.3

Fri, 05 Jun 2026 22:24:23 GMT

Patches

• Bump @​azure/msal-browser to v5.12.0 (beachball)

@​azure/msal-node v5.4.3

5.4.3

Wed, 29 Jul 2026 00:26:31 GMT

Patches

• Bump @​azure/msal-common to v16.11.3 (beachball)

Commits

• 3e4b837 Fix/telemetry broker fields consistency (#8699)
• cdab897 feat(msal-browser): Add retry logic and telemetry for token POST failures (#8...
• e1fbfbf Post-release PR (#8715)
• 83ab1ca Bump next from 15.5.19 to 15.5.21 (#8727)
• 1262aaf Bump shell-quote from 1.8.4 to 1.10.0 (#8731)
• 11f7233 Bump body-parser from 1.20.5 to 1.20.6 (#8719)
• 1afc948 Bump @​azure/msal-browser to 5.17.2 to match @​azure/msal-browser-1p (#8726)
• 0e34960 Streamline platform broker request to MSAL JS acquire-token contract params (...
• 3168a46 Bump tar from 7.5.16 to 7.5.21 (#8717)
• 489de12 Bump fast-uri from 3.1.2 to 3.1.4 (#8720)
• Additional commits viewable in compare view

Updates @e2b/code-interpreter from 2.5.0 to 2.7.0

Commits

• eb70a98 Support E2B_SANDBOX_URL env var for Jupyter requests (#310)
• 3faf568 [skip ci] Release new versions
• fe3e5db Throw descriptive error when sandbox is killed mid-request (#291)
• efadb49 [skip ci] Release new versions
• 94bebe8 chore: bump e2b (#290)
• 8deea75 Bump the npm_and_yarn group across 2 directories with 1 update (#275)
• 0b3906d [skip ci] Release new versions
• See full diff in compare view

Updates @mastra/core from 1.51.0 to 1.55.0

Release notes

Sourced from @​mastra/core's releases.

July 30, 2026

Highlights

In-process Code Mode execution (no workspace sandbox required)

Code Mode transports can now declare requiresSandbox: false, letting createCodeMode() run without a workspace sandbox for in-process execution boundaries. This enables secure in-process runtimes like V8 isolates and exports sanitizeToolId so transports can share consistent external_* naming.

New @mastra/isolated-vm package for V8-isolated Code Mode

Introduces @mastra/isolated-vm with IsolatedVmCodeModeTransport, running model-authored programs inside an in-process V8 isolate with no filesystem/network/process access (only bridged external_* tools). Note: requires isolated-vm native addon and Node 20+ hosts must start with --no-node-snapshot.

Built-in provider-native Web Search tool

@mastra/core adds webSearchTool, a first-party web search tool that resolves to provider-native search when supported by the configured model/provider, simplifying “current info” agent setups.

Stored agent drafts via autoPublish (Server + JS SDK)

Both @mastra/server and @mastra/client-js add autoPublish to stored agent creation so you can create an initial unpublished draft for review before publishing (existing calls still publish immediately by default).

New Factory channel identity domain + channels integration slot

@mastra/factory adds a channel-identity storage domain to link chat-platform senders to Factory users, plus a channels() integration slot to attach an AgentControllerChannels during prepare() so inbound platform messages can drive the same agents as the web UI.

Breaking Changes

• ChannelHandler context parameter is now required: the 4th parameter is ctx: ChannelHandlerContext (non-optional). Code that calls a ChannelHandler-typed function with only three args must be updated to pass ctx.

Changelog

@​mastra/core@1.55.0

Minor Changes

• Added support for Code Mode transports that provide their own execution boundary. A transport can now declare requiresSandbox: false and createCodeMode() will run it without a workspace sandbox, which enables in-process transports such as IsolatedVmCodeModeTransport from @mastra/isolated-vm: (#20359)

  import { createCodeMode } from '@mastra/core/tools';
  import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
  // No sandbox needed — the V8 isolate is the execution boundary
  const { tool, instructions } = createCodeMode({ tools }, new IsolatedVmCodeModeTransport());

  Also fixed the generated Code Mode instructions to describe isolation accurately instead of always claiming the program runs fully sandboxed, since the actual boundary depends on the configured sandbox and transport. The sanitizeToolId helper used for external_* naming is now exported from @mastra/core/tools so transports can reuse it instead of duplicating it.

• Added retry callbacks for stream error policies and ensured explicit matcher policies override provider retry metadata. (#19724)

• Channel handlers can now contribute to the request context of the run they start. (#20060)

  ChannelHandlerContext gains a requestContext field holding the RequestContext for the run the inbound message is about to start. It is constructed fresh for every message, and a handler may write to it before calling defaultHandler. Core then adds its own channel and render-context entries and dispatches with the same instance, so anything the handler wrote reaches the run.

  import { AgentControllerChannels } from '@mastra/core/channels';
  const channels = new AgentControllerChannels({
  adapters,
  handlers: {

... (truncated)

Commits

• bccb45d chore: version - exit prerelease mode
• 4696963 fix(core): persist delegation prompt exactly once in sub-agent threads (#20174)
• 6b86123 chore: version packages (alpha) (#20419)
• 723aa54 feat(factory): stricter review agent — weigh existing comments, calibrated ve...
• ef8a7ce chore: version packages (alpha) (#20358)
• 07f5b4b fix(core): avoid serializing result comparisons (#20340)
• 9c16d7b chore: regenerate providers and docs [skip ci]
• 55c9e24 Run Slack messages as the sender's Mastra tenant (#20060)
• cfb2899 chore: version packages
• ba369f2 feat(isolated-vm): add IsolatedVmCodeModeTransport for in-process Code Mode i...
• Additional commits viewable in compare view

Updates @mastra/memory from 1.20.0 to 1.24.0

Release notes

Sourced from @​mastra/memory's releases.

April 7, 2026

Highlights

AI SDK v6 Message Support + Message Interop Helpers

@mastra/core MessageList can now accept AI SDK v6 UI/model messages and project stored messages via messageList.get.all.aiV6.ui(), supporting v6 approval request/response flows. @mastra/ai-sdk adds toAISdkMessages() to load stored Mastra messages into AI SDK v5 or v6 chat UIs.

Inline Traces Page in Mastra Studio

The Observability page has been redesigned — trace, span, and score details now open in stacked side panels instead of full-screen dialogs. URL deep-linking supports traceId, spanId, tab, and scoreId params for easy sharing. New "Evaluate Trace" and "Save as Dataset Item" actions let you annotate and capture traces directly from the UI.

End-to-end RAG Tracing + New RAG/Graph Span Types

RAG ingestion and query operations are now visible in Mastra tracing with new span types (e.g., RAG_INGESTION, RAG_EMBEDDING, RAG_VECTOR_OPERATION, RAG_ACTION, GRAPH_ACTION) plus helpers like startRagIngestion() / withRagIngestion(). Instrumentation is opt-in via an observabilityContext, and @mastra/rag automatically threads context from agent TOOL_CALL spans into vector and graph tools.

CloudExporter Now Ships All Observability Signals (Not Just Traces)

@mastra/observability CloudExporter can now batch and upload logs, metrics, scores, and feedback in addition to tracing spans, enabling a single exporter path to Mastra Cloud for all signals. This also changes the endpoint configuration to use a base collector URL and derive publish paths automatically.

Span Filtering to Reduce Observability Noise and Cost

excludeSpanTypes and spanFilter were added to ObservabilityInstanceConfig in both @mastra/core and @mastra/observability, allowing you to drop entire span categories (e.g., MODEL_CHUNK) or apply predicate-based filtering before export—useful for pay-per-span backends.

Better Reliability and Debuggability Across Logs + MCP + Memory

Observability log correlation is fixed so logs inside agent runs carry the active span correlation fields (restoring trace↔log linking), and deepClean() now applies to all signals and better preserves Map/Set/Error detail. MCP tool discovery now retries after reconnectable errors and the MCP server returns spec-correct 404s for stale sessions; memory recall gains more precise browsing (partType, toolName, threadId: "current", anchor paging), and message parts now include createdAt timestamps for accurate part-level timing.

Agent Editor Improvements in Mastra Studio

The Agent Editor now supports publishing older versions with a dedicated "Publish This Version" button, and the Publish button is disabled until a draft is saved to prevent errors. Code-only agents no longer trigger spurious 404 logs, and the System Prompt, Tools, and Variables sections are collapsed by default for a cleaner editing experience.

Breaking Changes

• CloudExporter endpoint format changed: configure a base endpoint URL (publisher paths are derived automatically) when using CloudExporter for Mastra Cloud uploads.

Changelog

@​mastra/core@1.24.0

Minor Changes

• Added excludeSpanTypes and spanFilter options to ObservabilityInstanceConfig for selectively filtering spans before export. Use excludeSpanTypes to drop entire categories of spans by type (e.g., MODEL_CHUNK, MODEL_STEP) or spanFilter for fine-grained predicate-based filtering by attributes, metadata, entity, or any combination. Both options help reduce noise and costs in observability platforms that charge per-span. (#15131)

  excludeSpanTypes example:

  excludeSpanTypes: [SpanType.MODEL_CHUNK, SpanType.MODEL_STEP, SpanType.WORKFLOW_SLEEP];

  spanFilter example:

... (truncated)

Changelog

Sourced from @​mastra/memory's changelog.

1.24.0

Minor Changes

• Added exact metadata filtering to message history queries across Memory APIs and supported storage providers. (#19991)

  const messages = await memory.recall({
    threadId: 'thread-1',
    filter: {
      metadata: {
        status: 'done',
        priority: 'high',
      },
    },
  });

  Multiple fields use AND semantics. Supported values are strings, finite numbers, booleans, and null.

Patch Changes

• Updated dependencies [ce93a3c, 5718a22, a211d09, 0dca9d0, 6218217, 5807d3a, 57661af, 05db566, 57661af, 57661af, 5718a22, 57661af, d1b7e3a, 29c584a, c093146, 8124754, d12b2e4]:
  • @​mastra/core@​1.54.0

1.24.0-alpha.0

Minor Changes

• Added exact metadata filtering to message history queries across Memory APIs and supported storage providers. (#19991)

  const messages = await memory.recall({
    threadId: 'thread-1',
    filter: {
      metadata: {
        status: 'done',
        priority: 'high',
      },
    },
  });

  Multiple fields use AND semantics. Supported values are strings, finite numbers, booleans, and null.

Patch Changes

• Updated dependencies [0dca9d0]:
  • @​mastra/core@​1.54.0-alpha.0

... (truncated)

Commits

• 162f3da chore: version - exit prerelease mode
• d271d37 chore: migrate package builds to tsdown (#19829)
• dc67047 chore: version packages
• 0dca9d0 feat(memory): add metadata filters to message history (#19991)
• bdeaef5 chore: migrate linting to oxlint (#20173)
• 3a507cb chore: migrate repository formatting to oxfmt (#19807)
• 79ee78c chore: version - exit prerelease mode
• da48879 chore(deps): update dependency next to v16.2.11 [security] (#20044)
• eec6a54 feat(factory): store memory settings, custom providers and model packs in the...
• 1aad619 chore(deps): lock file maintenance (#19903)
• Additional commits viewable in compare view

Updates @smithy/node-http-handler from 4.7.4 to 4.9.13

Release notes

Sourced from @​smithy/node-http-handler's releases.

@​smithy/node-http-handler@​4.9.13

Patch Changes

• Updated dependencies [fcf1366]
  • @​smithy/core@​3.31.1

@​smithy/node-http-handler@​4.9.12

Patch Changes

• Updated dependencies [a14bb71]
  • @​smithy/core@​3.31.0

Changelog

Sourced from @​smithy/node-http-handler's changelog.

4.9.13

Patch Changes

• Updated dependencies [fcf1366]
  • @​smithy/core@​3.31.1

4.9.12

Patch Changes

• Updated dependencies [a14bb71]
  • @​smithy/core@​3.31.0

4.9.11

Patch Changes

• Updated dependencies [54040ef]
• Updated dependencies [155bb56]
  • @​smithy/core@​3.30.0

4.9.10

Patch Changes

• Updated dependencies [d6e6f8b]
  • @​smithy/core@​3.29.8

4.9.9

Patch Changes

• Updated dependencies [44b21e6]
  • @​smithy/core@​3.29.7

4.9.8

Patch Changes

• Updated dependencies [3248fbd]
  • @​smithy/core@​3.29.6

4.9.7

Patch Changes

• Updated dependencies [b44cb0a]
  • @​smithy/core@​3.29.5

... (truncated)

Commits

• bcff71d Version NPM packages (#2193)
• d3804a6 Version NPM packages (#2188)
• b1b9a49 Version NPM packages (#2181)
• 5458500 Version NPM packages (#2179)
• 7bc145b Version NPM packages (#2173)
• 5e1e7df Version NPM packages (#2161)
• 530c06b chore: enable sortPackageJson in oxfmt and format (#2153)
• 642aa1c Version NPM packages (#2154)
• 2e3e680 Version NPM packages (#2143)
• 172249c chore(packages): oxlint and oxfmt replace eslint and prettier (#2132)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​smithy/node-http-handler since your current version.

Updates axios from 1.18.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)
• @​Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)
• @​andrewkernel (#11053)
• @​Sagargupta16 (#11059)

... (truncated)

Commits

• 311fcc5 chore(release): prepare release 1.19.0 (#11095)
• cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
• 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
• 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
• c44f8d0 ci: use bundled npm for v1 publish (#11083)
• 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
• a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
• 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
• 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
• 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
• Additional commits viewable in compare view

Updates docx from 9.7.0 to 9.7.1

Release notes

Sourced from docx's releases.

9.7.1

What's Changed

• build(deps): bump nanoid from 5.1.7 to 5.1.11 by @​dependabot[bot] in dolanmiu/docx#3436
• build(deps-dev): bump inquirer from 13.3.2 to 13.4.3 by @​dependabot[bot] in dolanmiu/docx#3437
• build(deps-dev): bump prettier from 3.8.1 to 3.8.3 by @​dependabot[bot] in dolanmiu/docx#3438
• build(deps-dev): bump jiti from 2.6.1 to 2.7.0 by @​dependabot[bot] in dolanmiu/docx#3439
• build(deps-dev): bump tsx from 4.21.0 to 4.22.3 by @​dependabot[bot] in dolanmiu/docx#3440
• build(deps-dev): bump eslint-plugin-jsdoc from 62.8.0 to 63.0.0 by @​dependabot[bot] in dolanmiu/docx#3441
• build(deps-dev): bump cspell from 9.7.0 to 10.0.0 by @​dependabot[bot] in dolanmiu/docx#3442
• build(deps): bump the npm_and_yarn group across 1 directory with 3 updates by @​dependabot[bot] in dolanmiu/docx#3435
• build(deps-dev): bump eslint-plugin-functional from 9.0.4 to 9.0.5 by @​dependabot[bot] in dolanmiu/docx#3445
• build(deps): bump @​types/node from 25.5.0 to 25.9.1 by @​dependabot[bot] in dolanmiu/docx#3446
• build(deps-dev): bump pre-commit from 1.2.2 to 2.0.0 by @​dependabot[bot] in dolanmiu/docx#3447
• build(deps-dev): bump eslint-plugin-unicorn from 63.0.0 to 64.0.0 by @​dependabot[bot] in dolanmiu/docx#3448
• build(deps-dev): bump jsdom from 29.0.1 to 29.1.1 by @​dependabot[bot] in dolanmiu/docx#3449
• build(deps-dev): bump inquirer from 13.4.3 to 14.0.0 by @​dependabot[bot] in dolanmiu/docx#3451
• build(deps-dev): bump typedoc from 0.28.18 to 0.28.19 by @​dependabot[bot] in dolanmiu/docx#3452
• build(deps-dev): bump @...

  Description has been truncated