build(deps): bump axios, @strapi/admin and @strapi/strapi

[dependabot]

Bumps axios to 1.18.1 and updates ancestor dependencies axios, @strapi/admin and @strapi/strapi. These dependencies need to be updated together.

Updates axios from 1.16.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​drori12 (#10984)
• @​eyupcanakman (#10899)
• @​Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

• Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
• Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

• HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

• Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

... (truncated)

Commits

• a209bfb chore(release): prepare release 1.18.1 (#11027)
• fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
• 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
• a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
• cf1306a docs: add Deno to install instructions (#11023)
• b32880a fix: incorrect use of error (#11021)
• 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
• 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
• 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
• e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
• Additional commits viewable in compare view

Updates @strapi/admin from 5.46.1 to 5.50.2

Release notes

Sourced from @​strapi/admin's releases.

v5.50.2

5.50.2 (2026-07-15)

🚀 New feature

• admin: make admin auth cookie name configurable (#26931)
• i18n: complete Korean (ko) translation (#26941)

🔥 Bug fix

• admin: prevent deprecated CJS Vite Node API warning on startup (#26947)
• admin: pre-commit fails when staging files ignored by ESLint (#26958)
• admin: show plan label instead of edition in dashboard (#26891)
• admin: restore runtime default for context helper (#26809)
• ci: reduce false positives in issue template checker (#26955)
• ci: use npm install in issue template checker workflow (#26974)
• content-manager: clear stale Blocks editor selection on external value change (#26959)
• core: backward compat - reject 'status' attribute when draftAndPublish is enabled (#26890)
• core: validate license registry responses with zod (#26935)
• core: preserve duplicate form relation edits when cloning (#26961)
• data-transfer: bump ws to 8.21.0 to fix CVE-2026-48779 (#26898)
• database: include status sort expression in SELECT when using DISTINCT (#26751)
• database: lint script does not run type check (#26819)
• email: only warn about sendmail provider in development (#26893)
• openapi: add bearerAuth and bracket pagination query params (#26948)
• strapi: auto-exclude pre-built plugin UI libs from Vite optimizeDeps (#26944)
• strapi: fix develop blank admin from optimizeDeps auto-exclude (#27014)
• upgrade: prompt to pin ranged @strapi/* dependencies before upgrading (#26929)
• upload: load remote asset thumbnails with crossOrigin to prevent CORS preview failures (#26581, #26901)
• utils: align remaining convert-query-params errors with ValidationError (#26908)

⚙️ Chore

• ai-tooling: sync skills when cursor sets up a new worktree (#26954)
• data-transfer: clarify --exclude files CLI messaging (#26914)
• deps: patch/minor dependency bumps (#26823)
• deps: bump @​xhmikosr/decompress from 10.2.0 to 10.2.1 (#26928)
• deps: bump sharp from 0.33.5 to 0.34.5 (#26993)
• deps: bump @​internationalized/date from 3.5.4 to 3.12.1 (#26994)
• deps: bump design-system and icons to v2.2.3 (#27002)
• eslint: enforce zero warnings in package lint scripts (#26922)
• husky: run git hooks through yarn exec (#27006)
• tooling: remove unused find-up after lint-staged 16 (#26792)
• types: drop CommonJS tsconfig overrides, build JS via rollup (#26934)
• typescript: scope tsconfig types per workspace (#26699)
• typescript-utils: migrate to typescript (#26811)
• typescript-utils: bump internal deps to 5.50.1 (#26946)

⚠️ Changes to be aware of

... (truncated)

Commits

• 324fa96 release: 5.50.2
• 93a9cd6 fix(strapi): fix develop blank admin from optimizeDeps auto-exclude (#27014)
• 8f49cf9 chore(deps): bump design-system and icons to v2.2.3 (#27002)
• f764c39 fix(upload): load remote asset thumbnails with crossOrigin to prevent CORS pr...
• ebb1c26 chore(deps): bump @​internationalized/date from 3.5.4 to 3.12.1 (#26994)
• c93c36a fix(admin): restore runtime default for context helper (#26809)
• 33c93b2 fix(admin): show plan label instead of edition in dashboard (#26891)
• 8f0a568 chore(deps): patch/minor dependency bumps (#26823)
• c242dbd chore(typescript): scope tsconfig types per workspace (#26699)
• 2d4b67d fix(admin): prevent deprecated CJS Vite Node API warning on startup (#26947)
• Additional commits viewable in compare view

Updates @strapi/strapi from 5.46.1 to 5.50.2

Release notes

Sourced from @​strapi/strapi's releases.

v5.50.2

5.50.2 (2026-07-15)

🚀 New feature

• admin: make admin auth cookie name configurable (#26931)
• i18n: complete Korean (ko) translation (#26941)

🔥 Bug fix

• admin: prevent deprecated CJS Vite Node API warning on startup (#26947)
• admin: pre-commit fails when staging files ignored by ESLint (#26958)
• admin: show plan label instead of edition in dashboard (#26891)
• admin: restore runtime default for context helper (#26809)
• ci: reduce false positives in issue template checker (#26955)
• ci: use npm install in issue template checker workflow (#26974)
• content-manager: clear stale Blocks editor selection on external value change (#26959)
• core: backward compat - reject 'status' attribute when draftAndPublish is enabled (#26890)
• core: validate license registry responses with zod (#26935)
• core: preserve duplicate form relation edits when cloning (#26961)
• data-transfer: bump ws to 8.21.0 to fix CVE-2026-48779 (#26898)
• database: include status sort expression in SELECT when using DISTINCT (#26751)
• database: lint script does not run type check (#26819)
• email: only warn about sendmail provider in development (#26893)
• openapi: add bearerAuth and bracket pagination query params (#26948)
• strapi: auto-exclude pre-built plugin UI libs from Vite optimizeDeps (#26944)
• strapi: fix develop blank admin from optimizeDeps auto-exclude (#27014)
• upgrade: prompt to pin ranged @strapi/* dependencies before upgrading (#26929)
• upload: load remote asset thumbnails with crossOrigin to prevent CORS preview failures (#26581, #26901)
• utils: align remaining convert-query-params errors with ValidationError (#26908)

⚙️ Chore

• ai-tooling: sync skills when cursor sets up a new worktree (#26954)
• data-transfer: clarify --exclude files CLI messaging (#26914)
• deps: patch/minor dependency bumps (#26823)
• deps: bump @​xhmikosr/decompress from 10.2.0 to 10.2.1 (#26928)
• deps: bump sharp from 0.33.5 to 0.34.5 (#26993)
• deps: bump @​internationalized/date from 3.5.4 to 3.12.1 (#26994)
• deps: bump design-system and icons to v2.2.3 (#27002)
• eslint: enforce zero warnings in package lint scripts (#26922)
• husky: run git hooks through yarn exec (#27006)
• tooling: remove unused find-up after lint-staged 16 (#26792)
• types: drop CommonJS tsconfig overrides, build JS via rollup (#26934)
• typescript: scope tsconfig types per workspace (#26699)
• typescript-utils: migrate to typescript (#26811)
• typescript-utils: bump internal deps to 5.50.1 (#26946)

⚠️ Changes to be aware of

... (truncated)

Commits

• 324fa96 release: 5.50.2
• 93a9cd6 fix(strapi): fix develop blank admin from optimizeDeps auto-exclude (#27014)
• ed11cc8 fix(strapi): auto-exclude pre-built plugin UI libs from Vite optimizeDeps (#2...
• 8f0a568 chore(deps): patch/minor dependency bumps (#26823)
• c242dbd chore(typescript): scope tsconfig types per workspace (#26699)
• 2d4b67d fix(admin): prevent deprecated CJS Vite Node API warning on startup (#26947)
• b32ebed chore(data-transfer): clarify --exclude files CLI messaging (#26914)
• 9e6c1f3 Merge pull request #26940 from strapi/main
• e2c7129 release: 5.50.1
• 8c9f496 feat(admin): make admin auth cookie name configurable (#26931)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.