[dependabot]

Bumps the minor-updates group with 78 updates in the / directory:

Package	From	To
tsdown	0.20.1	0.23.4
react-native	0.83.1	0.88.1
axios	1.20.0	1.21.0
@animo-id/expo-digital-credentials-api	0.4.0	0.6.0
@owf/mdoc	0.6.0	0.9.2
@biomejs/biome	2.5.12	2.6.4
@types/react	19.2.18	19.3.0
@babel/generator	7.29.8	7.29.12
@babel/helper-create-class-features-plugin	7.29.7	7.29.12
@babel/helper-create-regexp-features-plugin	7.29.7	7.29.10
@babel/helper-string-parser	7.29.7	7.29.11
@babel/helpers	7.29.7	7.29.10
@babel/parser	7.29.8	7.29.12
@babel/plugin-transform-block-scoping	7.29.7	7.29.12
@babel/plugin-transform-classes	7.29.7	7.29.11
@babel/plugin-transform-spread	7.29.8	7.29.11
@babel/plugin-transform-typescript	7.29.7	7.29.9
@babel/runtime	7.29.7	7.29.10
@babel/traverse	7.29.8	7.29.12
@babel/types	7.29.8	7.29.11
@biomejs/cli-darwin-arm64	2.5.12	2.6.4
@biomejs/cli-darwin-x64	2.5.12	2.6.4
@biomejs/cli-linux-arm64-musl	2.5.12	2.6.4
@biomejs/cli-linux-arm64	2.5.12	2.6.4
@biomejs/cli-linux-x64-musl	2.5.12	2.6.4
@biomejs/cli-linux-x64	2.5.12	2.6.4
@biomejs/cli-win32-arm64	2.5.12	2.6.4
@biomejs/cli-win32-x64	2.5.12	2.6.4
@expo/devcert	1.2.1	1.2.2
@expo/osascript	2.7.1	2.8.1
@expo/package-manager	1.13.1	1.14.2
@expo/xcpretty	4.4.5	4.4.7
@napi-rs/wasm-runtime	1.1.1	1.2.6
@nodable/entities	3.0.0	3.1.0
@quansync/fs	1.0.0	1.1.0
@react-native/community-cli-plugin	0.83.1	0.88.1
@react-native/debugger-shell	0.83.1	0.88.1
@react-native/gradle-plugin	0.83.1	0.88.1
@react-native/virtualized-lists	0.83.1	0.88.1
@sinclair/typebox	0.27.8	0.27.12
@tybys/wasm-util	0.10.1	0.10.4
acorn	8.18.0	8.19.0
baseline-browser-mapping	2.11.21	2.11.34
browserslist	4.28.9	4.29.5
bser	2.1.1	2.1.2
cac	6.7.14	7.0.0
caniuse-lite	1.0.30001810	1.0.30001820
compression	1.8.1	1.8.2
core-js-compat	3.50.0	3.51.0
dts-resolver	2.1.3	3.0.0
electron-to-chromium	1.5.424	1.5.468
empathic	2.0.0	2.1.0
es-object-atoms	1.1.1	1.1.2
exponential-backoff	3.1.2	3.1.3
fb-watchman	2.0.2	2.0.4
follow-redirects	1.16.0	1.16.2
get-tsconfig	4.13.0	5.0.0-beta.6
hermes-compiler	0.14.0	260318099.0.5
hookable	6.0.1	6.1.2
import-without-cache	0.2.5	0.4.1
is-core-module	2.16.2	2.17.0
joi	17.13.7	17.13.9
node-forge	1.4.0	1.4.2
node-releases	2.0.54	2.0.61
obug	2.1.1	3.0.0
regenerate-unicode-properties	10.2.2	10.3.0
regenerate	1.4.2	1.5.0
regexpu-core	6.4.0	6.5.3
regjsparser	0.13.2	0.13.4
resolve.exports	2.0.3	2.0.4
rolldown-plugin-dts	0.21.8	0.28.8
scheduler	0.27.0	0.28.0
source-map-js	1.2.1	1.2.2
strnum	2.4.2	2.5.1
tinyexec	1.0.2	1.3.1
tinyglobby	0.2.15	0.2.17
unconfig-core	7.4.2	7.5.0
update-browserslist-db	1.3.2	1.3.4

Updates tsdown from 0.20.1 to 0.23.4

Release notes

Sourced from tsdown's releases.

v0.23.4

   🚀 Features

• cjs: Warn when platform is ignored for the CJS format  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1111 (58003)
• config: Support multiple env files  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1110 (5d558)

   🐞 Bug Fixes

• attw: Apply profiles to file-based problems  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1108 (a853d)
• config: Ignore empty env file paths and scope env deps per watcher  -  by @​sxzzbot (17bd0)
• css: Inline ?inline CSS imported from dependencies  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1109 (75a78)

   🏎 Performance

• Use tinyps in hooks  -  by @​43081j in rolldown/tsdown#1112 (f925e)

    View changes on GitHub

v0.23.3

   🐞 Bug Fixes

• Downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1107 (0344c)

    View changes on GitHub

v0.23.2

   🚀 Features

• Add JSON schema for config  -  by @​Sandbye and @​sxzz in rolldown/tsdown#1074 (2410e)

   🐞 Bug Fixes

• css: Respect Lightning CSS modules options  -  by @​sxzz in rolldown/tsdown#1103 (490ec)

    View changes on GitHub

v0.23.1

   🐞 Bug Fixes

• Preserve false tsconfig option  -  by @​Masutayunikon in rolldown/tsdown#1065 (407f8)
• entry: Honor custom root for object entry  -  by @​giaBaoJS in rolldown/tsdown#1072 (17452)
• pkg: Pack tarball inside npm publish --dry-run  -  by @​giaBaoJS in rolldown/tsdown#1076 (83f0c)

    View changes on GitHub

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

... (truncated)

Commits

• 83b6fb5 chore: release v0.23.4
• 8e22a34 chore: upgrade deps, hoist regex patterns
• f925e52 perf: use tinyps in hooks (#1112)
• 17bd0fc fix(config): ignore empty env file paths and scope env deps per watcher
• 5800398 feat(cjs): warn when platform is ignored for the CJS format (#1111)
• 5d55836 feat(config): support multiple env files (#1110)
• 75a78ce fix(css): inline ?inline CSS imported from dependencies (#1109)
• a853d19 fix(attw): apply profiles to file-based problems (#1108)
• 53638e8 chore: release v0.23.3
• 0344c4f fix: downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support ...
• Additional commits viewable in compare view

Updates react-native from 0.83.1 to 0.88.1

Release notes

Sourced from react-native's releases.

0.88.1

Added

• JSI: Forward createValueFromJsonUtf8 in RuntimeDecorator (b5eec4e4f3 by @​mrousavy)
• JSI: Run the With hooks around WithRuntimeDecorator::createArrayBuffer (82def6ea4c by @​mrousavy)
• JSI: Forward String::length in RuntimeDecorator and WithRuntimeDecorator (be567d270c by @​mrousavy)
• Yoga: Fix flex shrink explosion when the shrink total is a positive float residual (24a3be5f99 by @​intergalacticspacehighway)

iOS specific

• SwiftPM: the build stops with a clear error when precompiled plugin frameworks and the Xcode project disagree, and the error says what to run. (a920e5db46 by @​chrfalch)

Changed

• JSI: Use createError in JSError and forward it in RuntimeDecorator (0cca3a1f77 by @​mrousavy)

iOS specific

• Build: Compile React Native's C/C++/Objective-C code with -O2 instead of -Os in Release, and Yoga and glog with -O2 in all builds, to match Android (60c817e925 by @​chrfalch)
• SwiftPM: spm add and spm update write React Native's build settings to ReactNativeSPM/ReactNativeSPM.xcconfig and its build scripts to ReactNativeSPM/Scripts/, so a version bump no longer changes project.pbxproj. A configuration that uses its own xcconfig must now #include the generated file, and a target setting that hides React Native's value must add $(inherited). spm prints the exact fix in both cases. (cd89e98949 by @​chrfalch)
• Text: Text without a background color no longer draws a transparent background (0bd33261d1 by @​hryhoriiK97)

Fixed

• LogBox: Fix bottom notification appearance/touch targets on iPhone Duo (88a8bd23e8 by @​huntie)
• Yoga: Keep the measured pixel size of text nodes when rounding to the pixel grid (fd5392494f by @​intergalacticspacehighway)

Android specific

• Text: Fix text measured with the wrong width when fontVariationSettings are re-applied to a reused Paint (96518a8fb9 by @​jkadamczyk)
• Text: Skip empty and fully hidden text decoration ranges (dbd5b3b770 by @​Abbondanzo)
• Text: Fix crash drawing text decoration (underline/strikethrough) when a nested Text's span extends past a numberOfLines-truncated layout (ca8504b1ca by @​lazerg)

iOS specific

• Image: Image no longer shows the image of a previous source after its native view is recycled (53bf98bf40 by @​mattijsf)
• SafeArea: Fix views with a filter having their content offset by the safe area insets (fea820fa9b by @​intergalacticspacehighway)
• StatusBar: StatusBar style and visibility work on iOS 27 for apps built with the iOS 27 SDK when UIViewControllerBasedStatusBarAppearance is YES. Custom root view controllers must return the RCTStatusBarAppearance values. (bd08dafc98 by @​alanjhughes)
• SwiftPM: a project set up with skipped codegen no longer fails package resolution on ReactAppHeaders (e3aa9a1e19 by @​chrfalch)
• SwiftPM: the build-time sync now runs again when a watched path that did not exist at the last sync appears. (c89f4120ac by @​chrfalch)
• SwiftPM: keep line breaks in the scheme pre-action script so that the "Sync SPM Autolinking" pre-action runs. Run npx react-native spm update once to rewrite an existing scheme. (b8df948fd4 by @​chrfalch)

---

Hermes V1 dSYMS:

• Debug
• Release

ReactNativeDependencies dSYMs:

• Debug
• Release

... (truncated)

Changelog

Sourced from react-native's changelog.

v0.88.1

Added

• JSI: Forward createValueFromJsonUtf8 in RuntimeDecorator (b5eec4e4f3 by @​mrousavy)
• JSI: Run the With hooks around WithRuntimeDecorator::createArrayBuffer (82def6ea4c by @​mrousavy)
• JSI: Forward String::length in RuntimeDecorator and WithRuntimeDecorator (be567d270c by @​mrousavy)
• Yoga: Fix flex shrink explosion when the shrink total is a positive float residual (24a3be5f99 by @​intergalacticspacehighway)

iOS specific

• SwiftPM: the build stops with a clear error when precompiled plugin frameworks and the Xcode project disagree, and the error says what to run. (a920e5db46 by @​chrfalch)

Changed

• JSI: Use createError in JSError and forward it in RuntimeDecorator (0cca3a1f77 by @​mrousavy)

iOS specific

• Build: Compile React Native's C/C++/Objective-C code with -O2 instead of -Os in Release, and Yoga and glog with -O2 in all builds, to match Android (60c817e925 by @​chrfalch)
• SwiftPM: spm add and spm update write React Native's build settings to ReactNativeSPM/ReactNativeSPM.xcconfig and its build scripts to ReactNativeSPM/Scripts/, so a version bump no longer changes project.pbxproj. A configuration that uses its own xcconfig must now #include the generated file, and a target setting that hides React Native's value must add $(inherited). spm prints the exact fix in both cases. (cd89e98949 by @​chrfalch)
• Text: Text without a background color no longer draws a transparent background (0bd33261d1 by @​hryhoriiK97)

Fixed

• LogBox: Fix bottom notification appearance/touch targets on iPhone Duo (88a8bd23e8 by @​huntie)
• Yoga: Keep the measured pixel size of text nodes when rounding to the pixel grid (fd5392494f by @​intergalacticspacehighway)

Android specific

• Text: Fix text measured with the wrong width when fontVariationSettings are re-applied to a reused Paint (96518a8fb9 by @​jkadamczyk)
• Text: Skip empty and fully hidden text decoration ranges (dbd5b3b770 by @​Abbondanzo)
• Text: Fix crash drawing text decoration (underline/strikethrough) when a nested Text's span extends past a numberOfLines-truncated layout (ca8504b1ca by @​lazerg)

iOS specific

• Image: Image no longer shows the image of a previous source after its native view is recycled (53bf98bf40 by @​mattijsf)
• SafeArea: Fix views with a filter having their content offset by the safe area insets (fea820fa9b by @​intergalacticspacehighway)
• StatusBar: StatusBar style and visibility work on iOS 27 for apps built with the iOS 27 SDK when UIViewControllerBasedStatusBarAppearance is YES. Custom root view controllers must return the RCTStatusBarAppearance values. (bd08dafc98 by @​alanjhughes)
• SwiftPM: a project set up with skipped codegen no longer fails package resolution on ReactAppHeaders (e3aa9a1e19 by @​chrfalch)
• SwiftPM: the build-time sync now runs again when a watched path that did not exist at the last sync appears. (c89f4120ac by @​chrfalch)
• SwiftPM: keep line breaks in the scheme pre-action script so that the "Sync SPM Autolinking" pre-action runs. Run npx react-native spm update once to rewrite an existing scheme. (b8df948fd4 by @​chrfalch)

v0.88.0

Added

• C++: Add <React/FeatureFlags.h> umbrella header as the public entry point for react/featureflags (f970054a8a by @​j-piasecki)
• C++: Add <React/RendererBridging.h> umbrella header as the public entry point for react/renderer/bridging (5b680c5f9f by @​j-piasecki)
• C++: Add <React/Timing.h> umbrella header as the public entry point for react/timing (70f172d29f by @​j-piasecki)
• C++: Added missing mutex include in HostTarget.h (3f8f5c216a by @​etodanik)
• EventTarget: Enable the imperative EventTarget API (addEventListener, removeEventListener, dispatchEvent) on native view refs in canary (8480b86820 by @​rubennorte)

... (truncated)

Commits

• c30b7f8 Release 0.88.1
• 8aea8d9 Fix StatusBar style and visibility on iOS 27 (#58926)
• 9d01a6a Bump Hermes to 260318099.0.5
• c904aa4 fix(iOS) - Prevent SwiftUI based filter from insetting content by the safe ...
• 1a53113 Run the API tests on the sandbox (#59238)
• 39276e6 Fix: JSI Value::toString() should check the result type (#59146)
• 4292cc3 Forward createValueFromJsonUtf8 in RuntimeDecorator (#58960)
• 06e8e08 Use createError in JSError and forward it in RuntimeDecorator (#58961)
• 80b869c Run the With hooks around WithRuntimeDecorator::createArrayBuffer (#58935)
• 3b0e395 Forward String::length in RuntimeDecorator and WithRuntimeDecorator (#58936)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-native since your current version.

Updates axios from 1.20.0 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

• Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

• Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
• UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

• Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
• Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
• Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
• URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
• Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
• Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
• Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
• XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
• HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
• TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

• Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
• Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
• Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
• Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
• Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
• Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
• Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
• Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

• @​lazerg (#11194)
• @​QIU-Guanzong (#11228)
• @​Iams4kura (#11125)
• @​vjymisal0 (#11179)
• @​jarrensj (#11238)
• @​LineGu (#11132)
• @​luantaraschi (#11134)
• @​Cyberhet (#11284)
• @​nyxst4ck (#11138)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

• Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

• Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
• UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

• Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
• Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
• Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
• URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
• Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
• Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
• Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
• XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
• HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
• TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

• Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
• Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
• Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
• Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
• Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
• Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
• Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
• Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

• @​lazerg (#11194)
• @​QIU-Guanzong (#11228)
• @​Iams4kura (#11125)
• @​vjymisal0 (#11179)
• @​jarrensj (#11238)
• @​LineGu (#11132)
• @​luantaraschi (#11134)
• @​Cyberhet (#11284)
• @​nyxst4ck (#11138)

... (truncated)

Commits

• aa54a5e docs: remove cancelled sponsors from README (#11369)
• e6b79d9 chore(release): prepare release 1.21.0 (#11346)
• fceeb10 chore(deps-dev): bump the development_dependencies...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: pnpm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 174835c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ajile-in]

Rebased onto main (860fb38) and regenerated pnpm-lock.yaml, so the conflict is resolved.

Applied: axios 1.21.0, react-native 0.88.1 (dev), @types/react 19.3.0, and tsdown 0.23.4.

Compatibility changes required by tsdown 0.23:

• Build scripts use --config-loader unrun (unconfig was removed).
• Dropped the removed inlineOnly option and scoped external to bare package imports so internal modules are still emitted.

Held back deliberately (they need separate upgrade work, not just a lockfile rebase):

• @animo-id/expo-digital-credentials-api 0.6.0 — exports and types were renamed (DigitalCredentialsApiMatcher, DigitalCredentialsRequest, sendResponse, sendErrorResponse no longer exist); the SDK needs a migration to the new API.
• @owf/mdoc 0.9.x — Credo 0.7.4 depends on @owf/mdoc 0.8.x, and 0.9 duplicates the type identity (IssuerSigned), breaking presentation code. Hold until Credo supports it.
• @biomejs/biome 2.6.4 — the new formatter rewrites 14 docs/config files, including release notes and changelogs. Better as a separate formatting-only PR to avoid conflicts with the pending release PR.

Local validation: pnpm install --frozen-lockfile, pnpm types:check, pnpm build, pnpm test (core 3, digilocker 17, openid4vc 25), and pnpm style:check all pass.

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.