Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	1.17.0 → 1.18.0
form-data	4.0.5 → 4.0.6
tape	5.9.0 → 5.10.1

---

Release Notes

axios/axios (axios)

v1.18.0

Compare Source

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#​10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#​11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#​10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#​10984, #​10988, #​10992, #​10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#​10989, #​10996, #​10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#​11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​drori12 (#​10984)
• @​eyupcanakman (#​10899)
• @​Adi-Beker (#​10995)

Full Changelog

form-data/form-data (form-data)

v4.0.6

Compare Source

tape-testing/tape (tape)

v5.10.1

Compare Source

Commits

• [Fix] types: export Test and the callback types from the tape namespace 7ebe323

v5.10.0

Compare Source

Fixed

• [New] opts.timeout: add ignoreSyncTimeout to optionally fail blocking tests that exceed the timeout #623

Commits

• [New] add types 3bd17c3
• [Tests] use string encoding with concat-stream and exec d8d42b6
• [Dev Deps] update eslint 4447d26
• [actions] update workflows 1d79ea3
• [eslint] fix array bracket spacing 011fa27
• [Refactor] minor cleanups 39470e7
• [Tests] avoid relying on implicit toStrings ceca8d5
• [Refactor] avoid needing a call-bound push 0f12b31
• [actions] split out node 10-20, and 20+ 7b291f5
• [Refactor] use es-object-atoms 6b20c90
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore cf20e24
• [Deps] update call-bind, hasown, resolve, string.prototype.trim ffce2c3
• [Deps] update call-bound, has-dynamic-import, is-regex, object.assign f7630c3
• [Deps] update array.prototype.every, call-bind, string.prototype.trim 3d0107a
• [Refactor] use call-bound directly 658126c
• [patch] remove never-published helper file c28f3c7
• [Deps] update for-each, object-inspect be106fd
• [Deps] update @ljharb/now 2d757f0
• [Tests] actually invoke Math.random 85ddba3
• [Deps] update call-bound ec3faf9
• [Deps] update for-each 861c17c
• [Deps] update @ljharb/through f7d074e
• [Dev Deps] update es-value-fixtures 5c133bb
• [Dev Deps] update array.prototype.flatmap 33a1036
• [Deps] update is-regex d7c9ad3
• [Deps] update object-inspect ed50350
• [Dev Deps] update es-value-fixtures 4bcfc8b

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.