diff --git a/dist/index.js b/dist/index.js index dd0ad9e..124c262 100644 --- a/dist/index.js +++ b/dist/index.js @@ -15870,7 +15870,7 @@ function requireFollowRedirects () { return followRedirects.exports; } -/*! Axios v1.18.0 Copyright (c) 2026 Matt Zabriskie and contributors */ +/*! Axios v1.18.1 Copyright (c) 2026 Matt Zabriskie and contributors */ var axios_1; var hasRequiredAxios; @@ -17231,7 +17231,19 @@ function requireAxios () { class AxiosError extends Error { static from(error, code, config, request, response, customProps) { const axiosError = new AxiosError(error.message, code || error.code, config, request, response); - axiosError.cause = error; + // Match native `Error` `cause` semantics: non-enumerable. The wrapped + // error often carries circular internals (sockets, requests, agents), so + // an enumerable `cause` makes structured loggers (pino/winston) and any + // own-property walk throw "Converting circular structure to JSON". + // Regression from #6982; see #7205. `__proto__: null` mirrors the + // `message` descriptor below (prototype-pollution-safe descriptor). + Object.defineProperty(axiosError, 'cause', { + __proto__: null, + value: error, + writable: true, + enumerable: false, + configurable: true + }); axiosError.name = error.name; // Preserve status from the original error if not already set from response @@ -17444,7 +17456,13 @@ function requireAxios () { throw new AxiosError('Blob is not supported. Use a Buffer instead.'); } if (utils$1.isArrayBuffer(value) || utils$1.isTypedArray(value)) { - return useBlob && typeof Blob === 'function' ? new Blob([value]) : Buffer.from(value); + if (useBlob && typeof _Blob === 'function') { + return new _Blob([value]); + } + if (typeof Buffer !== 'undefined') { + return Buffer.from(value); + } + throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT); } return value; } @@ -17576,9 +17594,7 @@ function requireAxios () { this._pairs.push([name, value]); }; prototype.toString = function toString(encoder) { - const _encode = encoder ? function (value) { - return encoder.call(this, value, encode$1); - } : encode$1; + const _encode = encoder ? value => encoder.call(this, value, encode$1) : encode$1; return this._pairs.map(function each(pair) { return _encode(pair[0]) + '=' + _encode(pair[1]); }, '').join('&'); @@ -17609,6 +17625,7 @@ function requireAxios () { if (!params) { return url; } + url = url || ''; const _options = utils$1.isFunction(options) ? { serialize: options } : options; @@ -18241,7 +18258,7 @@ function requireAxios () { return process.env[key.toLowerCase()] || process.env[key.toUpperCase()] || ''; } - const VERSION = "1.18.0"; + const VERSION = "1.18.1"; function parseProtocol(url) { const match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url); @@ -18281,13 +18298,13 @@ function requireAxios () { // RFC 2397 section 3: default mediatype is text/plain;charset=US-ASCII // Bare `data:,` leaves mime undefined; Blob normalises that to "" per spec. - let mime; + let mime = ''; if (type) { mime = params ? type + params : type; } else if (params) { mime = 'text/plain' + params; } - const buffer = Buffer.from(decodeURIComponent(body), encoding); + const buffer = encoding === 'base64' ? Buffer.from(body, 'base64') : Buffer.from(decodeURIComponent(body), encoding); if (asBlob) { if (!_Blob) { throw new AxiosError('Blob is not supported', AxiosError.ERR_NOT_SUPPORT); @@ -19042,6 +19059,36 @@ function requireAxios () { // so unbounded growth is not a concern in practice. const tunnelingAgentCache = new Map(); const tunnelingAgentCacheUser = new WeakMap(); + // Minimum minor versions where Node's HTTP Agent supports native proxyEnv + // handling. Checking the selected agent below also covers startup modes such + // as NODE_OPTIONS=--use-env-proxy and --no-use-env-proxy precedence. + const NODE_NATIVE_ENV_PROXY_SUPPORT = { + 22: 21, + 24: 5 + }; + function isNodeNativeEnvProxySupported(nodeVersion = process.versions && process.versions.node) { + if (!nodeVersion) { + return false; + } + const [major, minor] = nodeVersion.split('.').map(part => Number(part)); + if (!Number.isInteger(major) || !Number.isInteger(minor)) { + return false; + } + if (major > 24) { + return true; + } + return NODE_NATIVE_ENV_PROXY_SUPPORT[major] != null && minor >= NODE_NATIVE_ENV_PROXY_SUPPORT[major]; + } + function isNodeEnvProxyEnabled(agent, nodeVersion = process.versions && process.versions.node) { + if (!isNodeNativeEnvProxySupported(nodeVersion)) { + return false; + } + const agentOptions = agent && agent.options; + return Boolean(agentOptions && utils$1.hasOwnProp(agentOptions, 'proxyEnv') && agentOptions.proxyEnv != null); + } + function getProxyEnvAgent(options, configHttpAgent, configHttpsAgent) { + return isHttps.test(options.protocol) ? configHttpsAgent || https$1.globalAgent : configHttpAgent || http$1.globalAgent; + } function getTunnelingAgent(agentOptions, userHttpsAgent) { const key = agentOptions.protocol + '//' + agentOptions.hostname + ':' + (agentOptions.port || '') + '#' + (agentOptions.auth || ''); const cache = userHttpsAgent ? tunnelingAgentCacheUser.get(userHttpsAgent) || tunnelingAgentCacheUser.set(userHttpsAgent, new Map()).get(userHttpsAgent) : tunnelingAgentCache; @@ -19149,9 +19196,10 @@ function requireAxios () { * * @returns {http.ClientRequestArgs} */ - function setProxy(options, configProxy, location, isRedirect, configHttpsAgent) { + function setProxy(options, configProxy, location, isRedirect, configHttpsAgent, configHttpAgent) { let proxy = configProxy; - if (!proxy && proxy !== false) { + const proxyEnvAgent = getProxyEnvAgent(options, configHttpAgent, configHttpsAgent); + if (!proxy && proxy !== false && !isNodeEnvProxyEnabled(proxyEnvAgent)) { const proxyUrl = getProxyForUrl(location); if (proxyUrl) { if (!shouldBypassProxy(location)) { @@ -19286,7 +19334,7 @@ function requireAxios () { options.beforeRedirects.proxy = function beforeRedirect(redirectOptions) { // Configure proxy for redirected request, passing the original config proxy to apply // the exact same logic as if the redirected request was performed by axios directly. - setProxy(redirectOptions, configProxy, redirectOptions.href, true, configHttpsAgent); + setProxy(redirectOptions, configProxy, redirectOptions.href, true, configHttpsAgent, configHttpAgent); }; } const isHttpAdapterSupported = typeof process !== 'undefined' && utils$1.kindOf(process) === 'process'; @@ -19382,10 +19430,12 @@ function requireAxios () { let httpVersion = own('httpVersion'); if (httpVersion === undefined) httpVersion = 1; let http2Options = own('http2Options'); - const responseType = own('responseType'); - const responseEncoding = own('responseEncoding'); const httpAgent = own('httpAgent'); const httpsAgent = own('httpsAgent'); + const configProxy = own('proxy'); + const responseType = own('responseType'); + const responseEncoding = own('responseEncoding'); + const socketPath = own('socketPath'); const method = own('method').toUpperCase(); const maxRedirects = own('maxRedirects'); const maxBodyLength = own('maxBodyLength'); @@ -19479,7 +19529,12 @@ function requireAxios () { // Parse url const fullPath = buildFullPath(own('baseURL'), own('url'), own('allowAbsoluteUrls'), config); - const parsed = new URL(fullPath, platform.hasBrowserEnv ? platform.origin : undefined); + // Unix-socket requests (own socketPath) commonly pass a path-only url + // like '/foo'; supply a synthetic base so new URL() can still parse it. + // Use the own-property value (not config.socketPath) so a polluted + // prototype cannot influence URL base selection. + const urlBase = socketPath ? 'http://localhost' : platform.hasBrowserEnv ? platform.origin : undefined; + const parsed = new URL(fullPath, urlBase); const protocol = parsed.protocol || supportedProtocols[0]; if (protocol === 'data:') { // Apply the same semantics as HTTP: only enforce if a finite, non-negative cap is set. @@ -19616,11 +19671,10 @@ function requireAxios () { try { path$1$1 = buildURL(parsed.pathname + parsed.search, own('params'), own('paramsSerializer')).replace(/^\?/, ''); } catch (err) { - const customErr = new Error(err.message); - customErr.config = config; - customErr.url = own('url'); - customErr.exists = true; - return reject(customErr); + return reject(AxiosError.from(err, AxiosError.ERR_BAD_REQUEST, config, null, null, { + url: own('url'), + exists: true + })); } headers.set('Accept-Encoding', utils$1.hasOwnProp(transitional, 'advertiseZstdAcceptEncoding') && transitional.advertiseZstdAcceptEncoding === true ? ACCEPT_ENCODING_WITH_ZSTD : ACCEPT_ENCODING, false); @@ -19644,7 +19698,6 @@ function requireAxios () { // cacheable-lookup integration hotfix !utils$1.isUndefined(lookup) && (options.lookup = lookup); - const socketPath = own('socketPath'); if (socketPath) { if (typeof socketPath !== 'string') { return reject(new AxiosError('socketPath must be a string', AxiosError.ERR_BAD_OPTION_VALUE, config)); @@ -19662,7 +19715,7 @@ function requireAxios () { } else { options.hostname = parsed.hostname.startsWith('[') ? parsed.hostname.slice(1, -1) : parsed.hostname; options.port = parsed.port; - setProxy(options, own('proxy'), protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path, false, httpsAgent); + setProxy(options, configProxy, protocol + '//' + parsed.hostname + (parsed.port ? ':' + parsed.port : '') + options.path, false, httpsAgent, httpAgent); } let transport; let isNativeTransport = false; @@ -19737,10 +19790,13 @@ function requireAxios () { transport = isHttpsRequest ? httpsFollow : httpFollow; } } + + // Set an explicit maxBodyLength option for transports that inspect it. + // When maxBodyLength is -1 (default/unlimited), use Infinity so + // follow-redirects does not fall back to its own 10MB default. if (maxBodyLength > -1) { options.maxBodyLength = maxBodyLength; } else { - // follow-redirects does not skip comparison, so it should always succeed for axios -1 unlimited options.maxBodyLength = Infinity; } @@ -19916,7 +19972,11 @@ function requireAxios () { const boundSockets = new Set(); req.on('socket', function handleRequestSocket(socket) { // default interval of sending ack packet is 1 minute - socket.setKeepAlive(true, 1000 * 60); + // proxy agents (e.g. agent-base) may return a generic Duplex stream + // that doesn't have setKeepAlive, so guard before calling + if (typeof socket.setKeepAlive === 'function') { + socket.setKeepAlive(true, 1000 * 60); + } // Install a single 'error' listener per socket (not per request) to avoid // accumulating listeners on pooled keep-alive sockets that get reassigned @@ -20061,7 +20121,11 @@ function requireAxios () { const cookie = cookies[i].replace(/^\s+/, ''); const eq = cookie.indexOf('='); if (eq !== -1 && cookie.slice(0, eq) === name) { - return decodeURIComponent(cookie.slice(eq + 1)); + try { + return decodeURIComponent(cookie.slice(eq + 1)); + } catch (e) { + return cookie.slice(eq + 1); + } } } return null; @@ -20094,6 +20158,7 @@ function requireAxios () { */ function mergeConfig(config1, config2) { // eslint-disable-next-line no-param-reassign + config1 = config1 || {}; config2 = config2 || {}; // Use a null-prototype object so that downstream reads such as `config.auth` @@ -20230,7 +20295,7 @@ function requireAxios () { headers.set(formHeaders); return; } - Object.entries(formHeaders).forEach(([key, val]) => { + Object.entries(formHeaders || {}).forEach(([key, val]) => { if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) { headers.set(key, val); } @@ -20268,7 +20333,11 @@ function requireAxios () { if (auth) { const username = utils$1.getSafeProp(auth, 'username') || ''; const password = utils$1.getSafeProp(auth, 'password') || ''; - headers.set('Authorization', 'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : ''))); + try { + headers.set('Authorization', 'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : ''))); + } catch (e) { + throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config); + } } if (utils$1.isFormData(data)) { if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv || utils$1.isReactNative(data)) { @@ -20469,6 +20538,7 @@ function requireAxios () { const protocol = parseProtocol(_config.url); if (protocol && !platform.protocols.includes(protocol)) { reject(new AxiosError('Unsupported protocol ' + protocol + ':', AxiosError.ERR_BAD_REQUEST, config)); + done(); return; } @@ -20507,7 +20577,9 @@ function requireAxios () { }); signals = null; }; - signals.forEach(signal => signal.addEventListener('abort', onabort)); + signals.forEach(signal => signal.addEventListener('abort', onabort, { + once: true + })); const { signal } = controller; @@ -20957,7 +21029,17 @@ function requireAxios () { const canceledError = composedSignal.reason; canceledError.config = config; request && (canceledError.request = request); - err !== canceledError && (canceledError.cause = err); + if (err !== canceledError) { + // Non-enumerable to match native Error `cause` semantics so loggers + // don't recurse into circular fetch internals (see #7205). + Object.defineProperty(canceledError, 'cause', { + __proto__: null, + value: err, + writable: true, + enumerable: false, + configurable: true + }); + } throw canceledError; } @@ -20978,9 +21060,17 @@ function requireAxios () { throw err; } if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) { - throw Object.assign(new AxiosError('Network Error', AxiosError.ERR_NETWORK, config, request, err && err.response), { - cause: err.cause || err + const networkError = new AxiosError('Network Error', AxiosError.ERR_NETWORK, config, request, err && err.response); + // Non-enumerable to match native Error `cause` semantics so loggers + // don't recurse into circular fetch internals (see #7205). + Object.defineProperty(networkError, 'cause', { + __proto__: null, + value: err.cause || err, + writable: true, + enumerable: false, + configurable: true }); + throw networkError; } throw AxiosError.from(err, err && err.code, config, request, err && err.response); } @@ -21099,7 +21189,7 @@ function requireAxios () { if (!adapter) { const reasons = Object.entries(rejectedReasons).map(([id, state]) => `adapter ${id} ` + (state === false ? 'is not supported by the environment' : 'is not available in the build')); let s = length ? reasons.length > 1 ? 'since :\n' + reasons.map(renderReason).join('\n') : ' ' + renderReason(reasons[0]) : 'as no adapter specified'; - throw new AxiosError(`There is no suitable adapter to dispatch the request ` + s, 'ERR_NOT_SUPPORT'); + throw new AxiosError(`There is no suitable adapter to dispatch the request ` + s, AxiosError.ERR_NOT_SUPPORT); } return adapter; } @@ -21242,7 +21332,7 @@ function requireAxios () { */ function assertOptions(options, schema, allowUnknown) { - if (typeof options !== 'object') { + if (typeof options !== 'object' || options === null) { throw new AxiosError('options must be an object', AxiosError.ERR_BAD_OPTION_VALUE); } const keys = Object.keys(options); diff --git a/package-lock.json b/package-lock.json index a4886dc..84118eb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "dependencies": { "@actions/core": "^3.0.1", "@actions/github": "^9.1.1", - "axios": "^1.18.0" + "axios": "^1.18.1" }, "devDependencies": { "@babel/core": "^7.29.6", @@ -4437,9 +4437,9 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.18.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.0.tgz", - "integrity": "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==", + "version": "1.18.1", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz", + "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", diff --git a/package.json b/package.json index bbc02d4..9a941c6 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,7 @@ "dependencies": { "@actions/core": "^3.0.1", "@actions/github": "^9.1.1", - "axios": "^1.18.0" + "axios": "^1.18.1" }, "devDependencies": { "@babel/core": "^7.29.6",