# Pre-Release Changelog

## Unreleased

## Features

- **Proxy bypass CIDR ranges:** Added IPv4 and IPv6 CIDR matching to `NO_PROXY`/`no_proxy`, including bracketed IPv6 and IPv4-mapped IPv6 normalization, while malformed ranges fail closed. A `/0` entry bypasses the proxy for its entire address family.
- **HTTP status code names:** Added the RFC 9110 names `HttpStatusCode.ContentTooLarge` for 413 and `HttpStatusCode.UnprocessableContent` for 422 across the runtime API and ESM/CommonJS declarations. The existing `PayloadTooLarge` and `UnprocessableEntity` names remain as deprecated aliases, and numeric reverse lookups retain their existing v1.x names for compatibility. (**#11082**, closes **#11066**)

## Bug Fixes

- **Method-specific headers:** Added default header buckets for all supported methods and removed those structural buckets during request preparation, so `OPTIONS`, `PURGE`, `LINK`, `UNLINK`, and `QUERY` defaults apply only to matching requests instead of leaking as literal headers. (**#11096**)
- **Node HTTP adapter option errors:** Invalid custom DNS lookup addresses and invalid or unsupported `httpVersion` values, including non-coercible JavaScript types, now reject with `AxiosError` and `ERR_BAD_OPTION_VALUE` while preserving the request config for diagnostics. (**#11096**)
- **Runtime configuration hardening:** Prevented values inherited only from shared prototypes, including another JavaScript realm's `Object.prototype` even when its `constructor` is altered, from becoming request behavior after config merging or interceptor replacement. Methods, headers, adapters, transports, FormData hooks, serializer options, and Fetch `Request` options are protected. Already-safe writable merged configs retain their identity through dispatch, while frozen, sealed, accessor-based, otherwise restricted, or unsafe-key-bearing replacements become writable filtered snapshots. Interceptor replacements with non-terminal application-defined prototypes remain supported as normalized null-prototype snapshots, terminal null-prototype ancestors are treated as shared boundaries to fail closed, and own `__proto__`, `constructor`, and `prototype` keys remain excluded from materialized configs.
- **Fetch adapter consistency:** Custom fetch implementations now receive the fully resolved `Request` plus a safe second `fetchOptions` argument that preserves custom own fields without overriding Axios-managed request fields. The authoritative method, headers, body, signal, duplex, and credentials are available on the `Request` and omitted from the second argument. `maxRedirects: 0` selects manual redirect handling when supported; Node exposes the unfollowed 3xx response, while browsers may expose an opaque redirect with status 0 and inaccessible headers. The no-`Request` fallback receives the same safe resolved options.
- **HTTP/2 adapter consistency:** Custom DNS lookup functions now apply to HTTP/2 connections and can reuse pooled sessions safely. Explicit Axios proxy objects fail with `ERR_NOT_SUPPORT`, while process-environment and HTTP/1-agent `proxyEnv` settings are ignored because `http2.connect()` cannot apply them; `proxy: false` continues to force a direct connection. Failed sessions are removed without leaking an unhandled session error.
- **Data URI validation:** Rejected media types containing extra slash separators and avoided excessive backtracking for long malformed media types.
- **Node HTTP adapter - keep-alive memory retention:** Reused a module-scoped socket error listener so pooled keep-alive sockets no longer retain the adapter context, response body, and buffers from the request that first used each socket. Socket errors continue to destroy only the currently active request. (**#11091**)
- **XHR Adapter - final download progress delivery:** `onDownloadProgress` now always receives a final delivery when a completed XHR download reaches its successful `loadend` handler. The callback runs while that event is still dispatching, so listeners reading incremental data from `event.currentTarget` observe the complete response. Previously the final delivery happened only when a throttled progress event was still pending, and it replayed an event whose dispatch had already finished — `event.currentTarget` was `null` — so text-streaming consumers could lose every chunk after the first in browsers whose progress cadence kept deliveries inside the throttle window. A final callback that cancels the request stops settlement processing cleanly, while a throwing callback does not leave the request pending. Upload progress and flushes triggered by stream errors, abort reasons, or failed XHR downloads retain their prior pending-event behavior. (closes **#6796**)
- **XHR Adapter - navigation-canceled requests:** A response that reaches `loadend` with status 0 is now rejected as an `ECONNABORTED` error instead of resolving as a success with an empty body. Firefox 152 stopped firing `error` and `abort` for requests canceled by a document navigation, leaving `loadend` as the only handler that runs, so those requests were settling as successful responses. Rejecting with `ECONNABORTED` matches what `onabort` raised on Firefox 151, so the outcome an application sees is unchanged by that update. Reads over `file:`, which some environments report as status 0 on success, still resolve, whether the scheme appears on the request URL, is inherited from a `file:` page origin by a relative request URL, or appears only on `responseURL`. Because no response was received, the rejection is not suppressed by `validateStatus`, matching how `onerror` and `onabort` already behave. (**#11094**, closes **#11093**)
- **Request error stacks:** Preserved original request failures when custom `Error` stack instrumentation returns non-string data or throws during optional stack decoration. (**#11109**, closes **#11108**)
- **Interceptor storage:** Removed trailing interceptor tombstones after ejection so repeated register-then-eject cycles no longer grow the handlers array, while preserving its public array shape, interceptor iteration behavior, and interceptor ID identity across registrations. (**#11070**)

## Documentation

- **Global search:** Added localized, private, in-browser full-text search for the active documentation language, with fuzzy and prefix matching.
