client-workspaces: Adding new BDD representation of endpoint ruleset (6b1e3602)
client-connectparticipant: Adding new BDD representation of endpoint ruleset (22db2a6a)
client-emr: Added support for Spark Connect interactive sessions on Amazon EMR on EC2 with new APIs - StartSession, GetSession, GetSessionEndpoint, ListSessions, and TerminateSession. Added sessionEnabled field in RunJobFlow and DescribeCluster to enable Spark Connect endpoints on EMR clusters. (ba570192)
client-s3files: Adding new BDD representation of endpoint ruleset (e538b485)
client-chime-sdk-voice: Adding new BDD representation of endpoint ruleset (1ff98336)
client-efs: Adding new BDD representation of endpoint ruleset (c7b29f33)
client-signer-data: Adding new BDD representation of endpoint ruleset (36e20555)
client-sagemaker: Adds the IncludedData parameter to DescribeModelCard and DescribeModelPackage. Set it to MetadataOnly to retrieve a model card without decrypt permission on the customer managed AWS KMS key (default AllData returns full content). Adds support for the MTRL Job resource in SageMaker Search. (215af86d)
client-ivs: adds UpdateAdConfiguration operation to AWS IVS low-latency APIs (8cda4ea1)
client-geo-maps: Adding new BDD representation of endpoint ruleset (58350842)
client-appflow: Adding new BDD representation of endpoint ruleset (63dd2cd0)
client-sustainability: Adding new BDD representation of endpoint ruleset (506f985f)
client-config-service: AWS Config now supports internal service-linked rules, allowing AWS service partners to deploy Config rules for customers and use the evaluation results to build enhanced features. (ba9173b9)
client-kendra: Adding new BDD representation of endpoint ruleset (51dfa7c3)
client-workdocs: Adding new BDD representation of endpoint ruleset (a88a31d0)
client-mwaa-serverless: Adding new BDD representation of endpoint ruleset (7cb91604)
client-mediapackage: Adding new BDD representation of endpoint ruleset (eaa31923)
client-opensearchserverless: Adding new BDD representation of endpoint ruleset (d08ce2ed)
client-uxc: Adding new BDD representation of endpoint ruleset (4d2a8026)
client-route53-recovery-readiness: Adding new BDD representation of endpoint ruleset (78b2555f)
client-glue: AWS Glue Interactive Sessions now supports Apache Spark Connect, enabling remote Spark execution over gRPC with minimal client-side dependencies. Adds GetSessionEndpoint and GetDashboardUrl APIs. Modifies CreateSession now accepts SPARK CONNECT session type. (41ebf943)
client-appintegrations: Adding new BDD representation of endpoint ruleset (3b257e66)
client-auditmanager: Adding new BDD representation of endpoint ruleset (b2fff655)
client-amplifybackend: Adding new BDD representation of endpoint ruleset (40fcadd6)
client-taxsettings: Adding new BDD representation of endpoint ruleset (dcc90bee)
client-cloudformation: Adding new BDD representation of endpoint ruleset (64f2514b)
client-wickr: AWS Wickr now allows network administrators to configure a maximum session duration for non-SSO users in security groups, and display customizable consent popups to users at login for terms of use or compliance acknowledgements. (ceb38f6b)
client-sagemaker-runtime-http2: Adding new BDD representation of endpoint ruleset (924b2e3a)
client-cost-explorer: Adding new BDD representation of endpoint ruleset (fb8ea9cb)
client-sns: Adding new BDD representation of endpoint ruleset (1cc60ac8)
client-mediapackage-vod: Adding new BDD representation of endpoint ruleset (f949a4c5)
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)
🚀 New Features
HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)
🐛 Bug Fixes
Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)
🔧 Maintenance & Chores
HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)
🚀 New Features
HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)
🐛 Bug Fixes
Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)
🔧 Maintenance & Chores
HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
#37289287c87 Thanks @turnipdabeets! - Add a configurable $is_server event property (default true) so PostHog can identify server-side events. Set isServer: false when using the SDK as a client/CLI so the device OS is attributed normally.
(2026-06-04)
#37289287c87 Thanks @turnipdabeets! - Add a configurable $is_server event property (default true) so PostHog can identify server-side events. Set isServer: false when using the SDK as a client/CLI so the device OS is attributed normally.
(2026-06-04)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/3217
Author: @dependabot[bot]
Created: 6/4/2026
Status: 🔄 Open
Base:
main← Head:dependabot/npm_and_yarn/prod-minor-updates-74ef6bedb8📝 Commits (1)
ca1bf73Bump the prod-minor-updates group across 1 directory with 6 updates📊 Changes
2 files changed (+301 additions, -403 deletions)
View changed files
📝
package-lock.json(+295 -397)📝
package.json(+6 -6)📄 Description
Bumps the prod-minor-updates group with 6 updates in the / directory:
3.1056.03.1062.05.100.145.101.01.16.11.17.04.1.14.2.05.35.65.36.27.76.17.77.0Updates
@aws-sdk/client-s3from 3.1056.0 to 3.1062.0Release notes
Sourced from @aws-sdk/client-s3's releases.
... (truncated)
Changelog
Sourced from @aws-sdk/client-s3's changelog.
Commits
f5235bbPublish v3.1062.0291ad36chore(scripts): include generated packages when validating declared imports 1...71df2ccPublish v3.1061.01216094chore(middleware-sdk-s3): consolidate S3 internal packages (#8026)8aeb92dPublish v3.1060.075bb4fcPublish v3.1059.06b082a6chore(codegen): sync for adaptive retry fix, EAI_AGAIN transient error (#8067)d7602d4Publish v3.1058.0e836d5cPublish v3.1057.0e55a387chore(codegen): sync for smithy 1.71.0 and snapshot-testing fix (#8053)Updates
@tanstack/react-queryfrom 5.100.14 to 5.101.0Release notes
Sourced from @tanstack/react-query's releases.
Changelog
Sourced from @tanstack/react-query's changelog.
Commits
f3d8d2aci: Version Packages (#10774)532bb29fix(tests): disable local coverage instrumentation (#10776)Updates
axiosfrom 1.16.1 to 1.17.0Release notes
Sourced from axios's releases.
Changelog
Sourced from axios's changelog.
Commits
4306df2chore: add fun 88 sponsorship931cc8fchore(release): prepare release 1.17.0 (#10983)38ba1b3fix(fetch): support basic auth from URL (#10896)32e2515fix: replace ternary side effect in script (#10931)030e722chore(deps): bump axios from 1.15.2 to 1.16.1 in /docs (#10960)ec63164chore: remove openspec (#10958)3dec28ffix(http): preserve TLS options for proxy tunnels (#10957)a2390a5fix: correct isCancel type to narrow to CanceledError<T> (#10952)fa01b92chore(deps-dev): bump tmp from 0.2.5 to 0.2.7 in /docs (#10954)2d2314afix: AxiosHeaderstoJSON()return types (#10956)Updates
js-yamlfrom 4.1.1 to 4.2.0Changelog
Sourced from js-yaml's changelog.
Commits
Updates
posthog-nodefrom 5.35.6 to 5.36.2Release notes
Sourced from posthog-node's releases.
... (truncated)
Changelog
Sourced from posthog-node's changelog.
... (truncated)
Commits
a8fd228chore: update versions and lockfile [version bump]287ad9fchore: update versions and lockfile [version bump]dc1e193chore: update versions and lockfile [version bump]9287c87feat: emit $is_server property on captured events (#3728)b539fcbchore: update versions and lockfile [version bump]79de441chore: update versions and lockfile [version bump]4a8caccchore: add Sentry attribution comments (#3738)d385e2achore: clarify error tracking comments (#3735)808862dchore: update versions and lockfile [version bump]f052bd7chore: update versions and lockfile [version bump]Updates
react-hook-formfrom 7.76.1 to 7.77.0Release notes
Sourced from react-hook-form's releases.
Changelog
Sourced from react-hook-form's changelog.
Commits
5b207417.77.0f1a02d3🧪 add regression coverage for createFormControl + useController remount defau...ba88c3d📚 docs: fix JSDoc for UseFormWatch (#13486)54198d9🥡 feat: addresetDefaultValuesAPI (#13427)fe8276e📚 docs: fix duplicate "de" in es-ES README image alt text (#13481)6aa81f9🐚 hardenget()against prototype-path traversal (__proto__/ `constructor...645478b🐞 fix FieldArray errors overriding nested fields (#13476)889c752🧪 add regression coverage for dynamic nested names with useController and wat...581321c🐞 fix inconsistent reset({}) behavior requiring double-call to take effect (#...f8eb2d7🌭 upgrade deps (#13470)🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.