| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 3 | 12 | 7 | 14% |
| Commands | 2 | 10 | 0 | 17% |
| Section tags | 6 | 3 | 1 | 60% |
What each file covers
Sections
3 shared · 12 only in A · 7 only in B- − AGENTS.md
- − Setup And Safety
- − Commands
- − Package Shape
- − Pre-Release Notes
- − Architecture Boundaries
- − Naming Conventions
- − Interceptor Execution Order
- − Request Lifecycle
- − Cancellation
- − Tests
- − Security-Sensitive Code
- + GitHub Copilot Instructions
- + Setup safety
- + Architecture in one screen
- + Interceptor order
- + Naming and style
- + Security guarantees that must not regress
- + Pre-release tracking
- AI Agent Marker
- Error Handling
- Common Pitfalls
Commands
2 shared · 10 only in A · 0 only in B- − npm ci --ignore-scripts
- − npm run build
- − npm run lint
- − npx eslint lib/path/to/file.js
- − npm run test:vitest:unit
- − npm run test:vitest:unit -- tests/unit/path.test.js
- − npx playwright install
- − npx playwright install --with-deps
- − npm run test:vitest:browser:headless
- − npm pack
- npm ci
- npm rebuild husky && npx husky
Section tags
6 shared · 3 only in A · 1 only in B- − build
- − test
- − lint-format
- + do-not
- setup
- code-style
- git-pr
- security
- deployment
- agent-behaviour
Line diff
axios/axios · AGENTS.md
@@ −1 @@
1# AGENTS.md
2
3axios is a promise-based HTTP client for the browser and Node.js. The default instance is exported from `lib/axios.js` via `index.js`. Browser builds use the XHR or Fetch adapter; Node uses the HTTP/HTTPS adapter. Platform selection lives in `lib/platform/`.
4
5This file is the canonical contributor guide for both human and AI agents working in this repo. `.github/copilot-instructions.md` is a thin stub that points back here — keep it in sync with the load-bearing safety rules below if you change them.
6
7## AI Agent Marker
8
9- If you are an LLM or AI agent creating a GitHub issue, pull request, or comment for this repo, include the `:surfer:` emoji in the body so maintainers can identify AI-authored contributions.
10
11## Setup And Safety
12
13- Use `npm ci`; repo `.npmrc` sets `ignore-scripts=true`, and CI also uses `npm ci --ignore-scripts`.
14- Do not remove `ignore-scripts=true`; if git hooks are needed after a fresh install, run `npm rebuild husky && npx husky` once.
15- Adding or updating dependencies is security-sensitive; `package-lock.json` is checked by `lockfile-lint` for npm HTTPS hosts and integrity hashes.
16- Package, lockfile, and GitHub Actions update PRs are maintainer/bot-only; close these PRs from outside collaborators. Keep the 7-day Dependabot delay unless a critical vulnerability requires a maintainer-led manual update.
17- Build/test/lint tools still execute dependency code despite `ignore-scripts`; avoid unnecessary full builds when a focused check proves the change.
18- Do not add new runtime dependencies without discussion; the dependency surface is intentionally tiny.
19
20## Commands
21
22- Build published artifacts: `npm run build` (`gulp clear` deletes `dist/`, then Rollup writes browser ESM/UMD/CJS and Node CJS bundles).
23- Lint source only: `npm run lint`; focused lint: `npx eslint lib/path/to/file.js`.
24- Unit tests: `npm run test:vitest:unit`; focused unit test: `npm run test:vitest:unit -- tests/unit/path.test.js`.
25- Browser tests need Playwright installed first (`npx playwright install` locally; CI uses `npx playwright install --with-deps`); run `npm run test:vitest:browser:headless` for CI parity.
26- Smoke/module compatibility suites test the packed package, not the source tree: run `npm run build`, `npm pack`, install the tarball into the relevant `tests/smoke/*` or `tests/module/*` package, then run that suite's npm script.
27- CI order is install -> build -> Playwright install -> unit -> browser headless -> pack -> CJS/ESM module and smoke tests -> Bun/Deno smoke tests.
28
29## Package Shape
30
31- Source is ESM (`type: module`); public ESM entry is `index.js`, which re-exports the default instance from `lib/axios.js`.
32- Do not edit `dist/` by hand; it is ignored and generated from `lib/` by Rollup.
33- Runtime package exports are split by environment: browser/react-native map Node HTTP/platform files to browser/null replacements, while Node CJS ships as `dist/node/axios.cjs`.
34- Keep public runtime exports, `index.d.ts` (ESM types), and `index.d.cts` (CJS `export = axios` types) in sync for API changes.
35- `lib/env/data.js` is version-generated by `gulp version`; do not edit it for normal feature work.
36
37## Pre-Release Notes
38
39- Add user-visible unreleased changes to `PRE_RELEASE_CHANGELOG.md`, not `CHANGELOG.md`. `CHANGELOG.md` is release-owned and should only be updated as part of preparing an actual release.
40- Track deferred README, docs site, examples, migration guide, and translated docs updates in `PRE_RELEASE_DOCS.md`. Use enough context for release preparation; do not store brittle diffs or line-number-only notes.
41- Do not update `README.md` or the docs site for unreleased runtime/API changes unless the task is explicitly release preparation. During feature/fix work, record what docs need to say in `PRE_RELEASE_DOCS.md` so it can be applied during release work.
42
43## Architecture Boundaries
44
45- `lib/core/` is axios domain logic: request dispatch, config merge, interceptors, headers, errors. Key classes: `Axios` (request dispatch + interceptor chains), `AxiosError` (standardized error codes), `AxiosHeaders` (case-insensitive header normalization), `InterceptorManager` (sync/async interceptor registration).
46- `lib/adapters/` performs I/O; default adapter preference is `['xhr', 'http', 'fetch']`, with capability selection in `lib/adapters/adapters.js`. Detect by capability, not environment name.
47- `lib/platform/` selects Node by default; browser builds rely on package/rollup aliasing to `lib/platform/browser`.
48- `lib/helpers/` should stay generic and reusable outside axios; do not put axios-specific request lifecycle logic there.
49- New `lib/**/*.js` files should match existing source style: ESM imports with explicit `.js` extensions, `'use strict';` where current library files use it, and `AxiosError` for axios-originated failures.
50
51## Naming Conventions
52
53- Classes: PascalCase (`Axios`, `AxiosError`, `InterceptorManager`).
54- Functions: camelCase (`buildURL`, `mergeConfig`, `dispatchRequest`).
55- Error codes: UPPER_SNAKE_CASE constants on `AxiosError` (`ERR_NETWORK`, `ETIMEDOUT`).
56- Internal class slots: `Symbol`-keyed (e.g. `const $internals = Symbol('internals')` in `lib/core/AxiosHeaders.js`) rather than underscore-prefixed properties.
57
58## Error Handling
59
60- Throw `AxiosError` for axios-originated failures; never raw `Error`. Pass `(message, code, config, request, response)` so consumers can introspect.
61- Wrap third-party errors with `AxiosError.from(error, code, config, request, response)`.
62- Canonical code list lives in `lib/core/AxiosError.js`; current codes include `ERR_BAD_OPTION_VALUE`, `ERR_BAD_OPTION`, `ECONNABORTED`, `ETIMEDOUT`, `ECONNREFUSED`, `ERR_NETWORK`, `ERR_FR_TOO_MANY_REDIRECTS`, `ERR_DEPRECATED`, `ERR_BAD_RESPONSE`, `ERR_BAD_REQUEST`, `ERR_CANCELED`, `ERR_NOT_SUPPORT`, `ERR_INVALID_URL`, `ERR_FORM_DATA_DEPTH_EXCEEDED`.
63- Validate config options through the `validator` helper; do not invent ad-hoc validation paths.
64
65## Interceptor Execution Order
66
67- Request interceptors run **last-registered-first** (LIFO).
68- Response interceptors run **first-registered-first** (FIFO).
69- Both support `synchronous: true` (avoids Promise wrapping when no async handler is in the chain) and `runWhen: (config) => boolean` for conditional execution.
70- Order matters for both behavior and tests; document it when adding new built-in interceptors.
71
72## Request Lifecycle
73
741. User calls `axios()` or a method alias.
752. Merge instance defaults with request config via `mergeConfig`.
763. Run request interceptors (LIFO).
774. Select adapter via `lib/adapters/adapters.js` capability check.
785. Apply `transformRequest` functions.
796. Adapter performs the HTTP request.
807. Apply `transformResponse` functions.
818. Run response interceptors (FIFO).
829. Resolve promise with `AxiosResponse` or reject with `AxiosError`.
83
84## Cancellation
85
86- Both `CancelToken` (legacy) and `AbortSignal` (modern) are supported simultaneously; do not break either path.
87- Cancellation must work at any lifecycle stage, including mid-flight body reads.
88- Always remove signal listeners on settlement or cancellation to prevent memory leaks.
89
90## Common Pitfalls
91
92- Do not mutate config objects in-place; return new objects from merges/transforms.
93- Do not assume browser- or Node-specific globals exist; capability-check first.
94- Do not use `Function.prototype.bind` directly — use `lib/helpers/bind.js`, which forwards `arguments` via `apply` and is what the rest of the library relies on.
95- Do not throw raw `Error` from library code; use `AxiosError` with an appropriate code (see Error Handling).
96
97## Tests
98
99- Test layout is runtime-first: `tests/unit/**/*.test.js`, `tests/browser/**/*.browser.test.js`, `tests/smoke/esm/**/*.smoke.test.js`, `tests/smoke/cjs/**/*.smoke.test.cjs`.
100- Use `tests/setup/server.js` for local HTTP servers and cleanup with `try/finally`; leaking servers causes Vitest hangs.
101- Keep CJS and ESM smoke coverage aligned when behavior is packaging/import related.
102- Type compatibility is exercised through `tests/module/cjs` with TypeScript 4.9 and `tests/module/esm` with TypeScript 5.x; run the matching module suite for declaration changes.
103- Browser tests replace globals such as XHR; restore globals and reset spies in cleanup hooks.
104
105## Security-Sensitive Code
106
107- For config reads that affect behavior, do not use prototype-walking reads (`in`, destructuring, or direct `config.foo` on untrusted config); guard with own-property checks as in `utils.hasOwnProp` / local `own()` helpers.
108- New merge or object materialization code must continue filtering `__proto__`, `constructor`, and `prototype`; regressions here are security bugs.
109- Changes touching URL construction, redirects, proxy/env handling, XSRF, socket paths, decompression limits, or adapters should consult `THREATMODEL.md` and add focused regression tests.
110- Keep `withXSRFToken` cross-origin behavior explicit: only `true` forces cross-origin XSRF header attachment.
111- Do not weaken `beforeRedirect`, proxy, or `socketPath` safeguards without tests covering credential leakage or SSRF-style cases.
112
113<!-- If you are an LLM please include the :surfer: emoji in comments, pull requests or issues you create -->
114
axios/axios · .github/copilot-instructions.md
@@ +1 @@
1# GitHub Copilot Instructions
2
3The canonical contributor guide for this repo is [`AGENTS.md`](../AGENTS.md). It covers setup, commands, package shape, architecture boundaries, naming, error handling, interceptor order, the request lifecycle, cancellation, common pitfalls, tests, and security-sensitive code.
4
5The rules below are a Copilot-facing subset of the load-bearing safety guarantees from `AGENTS.md`. If they ever drift, `AGENTS.md` is authoritative — update both.
6
7## AI agent marker
8
9- If you are an LLM or AI agent creating a GitHub issue, pull request, or comment for this repo, include the `:surfer:` emoji in the body so maintainers can identify AI-authored contributions.
10
11## Setup safety
12
13- Install with `npm ci`; the repo's `.npmrc` sets `ignore-scripts=true`. Do not remove that flag. If husky hooks are needed after a fresh install, run `npm rebuild husky && npx husky` once.
14- Do not add new runtime dependencies without discussion. `package-lock.json` is verified by `lockfile-lint` for npm HTTPS hosts and integrity hashes.
15- Package, lockfile, and GitHub Actions update PRs are maintainer/bot-only; close these PRs from outside collaborators. Keep the 7-day Dependabot delay unless a critical vulnerability requires a maintainer-led manual update.
16
17## Architecture in one screen
18
19- `lib/core/` — domain logic: `Axios`, `AxiosError`, `AxiosHeaders`, `InterceptorManager`, config merge, request dispatch.
20- `lib/adapters/` — I/O: `xhr.js`, `http.js`, `fetch.js`. Default preference `['xhr', 'http', 'fetch']`, picked by capability detection in `lib/adapters/adapters.js`. Never branch on environment name.
21- `lib/platform/` — Node by default; browser builds alias to `lib/platform/browser`.
22- `lib/helpers/` — generic, reusable utilities; no axios-specific lifecycle logic here.
23- Source is ESM (`type: module`) with explicit `.js` import extensions. `dist/` is generated by Rollup — never edit it by hand. Keep `index.d.ts` (ESM) and `index.d.cts` (CJS) in sync for any public API change.
24
25## Error handling
26
27- Throw `AxiosError(message, code, config, request, response)` for axios-originated failures; never raw `Error`.
28- Wrap third-party errors with `AxiosError.from(error, code, config, request, response)`.
29- Use a code from `lib/core/AxiosError.js` (`ERR_NETWORK`, `ETIMEDOUT`, `ECONNABORTED`, `ERR_CANCELED`, `ERR_BAD_REQUEST`, `ERR_BAD_RESPONSE`, `ERR_FR_TOO_MANY_REDIRECTS`, `ERR_FORM_DATA_DEPTH_EXCEEDED`, `ERR_INVALID_URL`, `ERR_BAD_OPTION`, `ERR_BAD_OPTION_VALUE`, `ERR_NOT_SUPPORT`, `ERR_DEPRECATED`, `ECONNREFUSED`).
30
31## Interceptor order
32
33- Request interceptors run **LIFO** (last-registered-first); response interceptors run **FIFO**. Both support `synchronous: true` and `runWhen(config)`.
34
35## Naming and style
36
37- PascalCase classes (`Axios`, `AxiosHeaders`), camelCase functions (`buildURL`, `mergeConfig`), UPPER_SNAKE_CASE error codes.
38- Internal slots use `Symbol`-keyed properties (see `$internals` in `lib/core/AxiosHeaders.js`), not underscore-prefixed names.
39- Use `lib/helpers/bind.js`, not `Function.prototype.bind`, when binding library functions — the helper forwards `arguments` via `apply`.
40- `'use strict';` appears at the top of files that already use it; match the surrounding file rather than blanket-adding it.
41
42## Security guarantees that must not regress
43
44- For config reads on potentially untrusted input, use own-property checks (`utils.hasOwnProp` / local `own()` helpers); never `in`, destructuring, or direct `config.foo` access.
45- Any merge or object materialization must continue to filter `__proto__`, `constructor`, and `prototype`. Regressions here are security bugs.
46- Changes touching URL construction, redirects, proxy/env handling, XSRF, socket paths, decompression limits, or adapters require consulting `THREATMODEL.md` and adding focused regression tests.
47- `withXSRFToken === true` is the only thing that forces cross-origin XSRF header attachment — keep that behavior explicit.
48- Do not weaken `beforeRedirect`, proxy, or `socketPath` safeguards without tests covering credential leakage and SSRF-style cases.
49
50## Common pitfalls
51
52- Do not mutate config objects in place; return new ones from merges/transforms.
53- Do not assume browser- or Node-only globals exist; capability-check first.
54- Validate options through the existing `validator` helper rather than inventing ad-hoc validation paths.
55
56## Pre-release tracking
57
58- Add user-visible unreleased changes to `PRE_RELEASE_CHANGELOG.md`, not `CHANGELOG.md`.
59- Track deferred README, docs site, examples, migration guide, and translated docs updates in `PRE_RELEASE_DOCS.md`; do not update release docs for unreleased runtime/API changes unless explicitly doing release preparation.
60
@@ −1 +1 @@
1−# AGENTS.md
1+# GitHub Copilot Instructions
22
3−axios is a promise-based HTTP client for the browser and Node.js. The default instance is exported from `lib/axios.js` via `index.js`. Browser builds use the XHR or Fetch adapter; Node uses the HTTP/HTTPS adapter. Platform selection lives in `lib/platform/`.
3+The canonical contributor guide for this repo is [`AGENTS.md`](../AGENTS.md). It covers setup, commands, package shape, architecture boundaries, naming, error handling, interceptor order, the request lifecycle, cancellation, common pitfalls, tests, and security-sensitive code.
44
5−This file is the canonical contributor guide for both human and AI agents working in this repo. `.github/copilot-instructions.md` is a thin stub that points back here — keep it in sync with the load-bearing safety rules below if you change them.
5+The rules below are a Copilot-facing subset of the load-bearing safety guarantees from `AGENTS.md`. If they ever drift, `AGENTS.md` is authoritative — update both.
66
7−## AI Agent Marker
7+## AI agent marker
88
99 - If you are an LLM or AI agent creating a GitHub issue, pull request, or comment for this repo, include the `:surfer:` emoji in the body so maintainers can identify AI-authored contributions.
1010
11−## Setup And Safety
11+## Setup safety
1212
13−- Use `npm ci`; repo `.npmrc` sets `ignore-scripts=true`, and CI also uses `npm ci --ignore-scripts`.
14−- Do not remove `ignore-scripts=true`; if git hooks are needed after a fresh install, run `npm rebuild husky && npx husky` once.
15−- Adding or updating dependencies is security-sensitive; `package-lock.json` is checked by `lockfile-lint` for npm HTTPS hosts and integrity hashes.
13+- Install with `npm ci`; the repo's `.npmrc` sets `ignore-scripts=true`. Do not remove that flag. If husky hooks are needed after a fresh install, run `npm rebuild husky && npx husky` once.
14+- Do not add new runtime dependencies without discussion. `package-lock.json` is verified by `lockfile-lint` for npm HTTPS hosts and integrity hashes.
1615 - Package, lockfile, and GitHub Actions update PRs are maintainer/bot-only; close these PRs from outside collaborators. Keep the 7-day Dependabot delay unless a critical vulnerability requires a maintainer-led manual update.
17−- Build/test/lint tools still execute dependency code despite `ignore-scripts`; avoid unnecessary full builds when a focused check proves the change.
18−- Do not add new runtime dependencies without discussion; the dependency surface is intentionally tiny.
1916
20−## Commands
17+## Architecture in one screen
2118
22−- Build published artifacts: `npm run build` (`gulp clear` deletes `dist/`, then Rollup writes browser ESM/UMD/CJS and Node CJS bundles).
23−- Lint source only: `npm run lint`; focused lint: `npx eslint lib/path/to/file.js`.
24−- Unit tests: `npm run test:vitest:unit`; focused unit test: `npm run test:vitest:unit -- tests/unit/path.test.js`.
25−- Browser tests need Playwright installed first (`npx playwright install` locally; CI uses `npx playwright install --with-deps`); run `npm run test:vitest:browser:headless` for CI parity.
26−- Smoke/module compatibility suites test the packed package, not the source tree: run `npm run build`, `npm pack`, install the tarball into the relevant `tests/smoke/*` or `tests/module/*` package, then run that suite's npm script.
27−- CI order is install -> build -> Playwright install -> unit -> browser headless -> pack -> CJS/ESM module and smoke tests -> Bun/Deno smoke tests.
19+- `lib/core/` — domain logic: `Axios`, `AxiosError`, `AxiosHeaders`, `InterceptorManager`, config merge, request dispatch.
20+- `lib/adapters/` — I/O: `xhr.js`, `http.js`, `fetch.js`. Default preference `['xhr', 'http', 'fetch']`, picked by capability detection in `lib/adapters/adapters.js`. Never branch on environment name.
21+- `lib/platform/` — Node by default; browser builds alias to `lib/platform/browser`.
22+- `lib/helpers/` — generic, reusable utilities; no axios-specific lifecycle logic here.
23+- Source is ESM (`type: module`) with explicit `.js` import extensions. `dist/` is generated by Rollup — never edit it by hand. Keep `index.d.ts` (ESM) and `index.d.cts` (CJS) in sync for any public API change.
2824
29−## Package Shape
25+## Error handling
3026
31−- Source is ESM (`type: module`); public ESM entry is `index.js`, which re-exports the default instance from `lib/axios.js`.
32−- Do not edit `dist/` by hand; it is ignored and generated from `lib/` by Rollup.
33−- Runtime package exports are split by environment: browser/react-native map Node HTTP/platform files to browser/null replacements, while Node CJS ships as `dist/node/axios.cjs`.
34−- Keep public runtime exports, `index.d.ts` (ESM types), and `index.d.cts` (CJS `export = axios` types) in sync for API changes.
35−- `lib/env/data.js` is version-generated by `gulp version`; do not edit it for normal feature work.
36−
37−## Pre-Release Notes
38−
39−- Add user-visible unreleased changes to `PRE_RELEASE_CHANGELOG.md`, not `CHANGELOG.md`. `CHANGELOG.md` is release-owned and should only be updated as part of preparing an actual release.
40−- Track deferred README, docs site, examples, migration guide, and translated docs updates in `PRE_RELEASE_DOCS.md`. Use enough context for release preparation; do not store brittle diffs or line-number-only notes.
41−- Do not update `README.md` or the docs site for unreleased runtime/API changes unless the task is explicitly release preparation. During feature/fix work, record what docs need to say in `PRE_RELEASE_DOCS.md` so it can be applied during release work.
42−
43−## Architecture Boundaries
44−
45−- `lib/core/` is axios domain logic: request dispatch, config merge, interceptors, headers, errors. Key classes: `Axios` (request dispatch + interceptor chains), `AxiosError` (standardized error codes), `AxiosHeaders` (case-insensitive header normalization), `InterceptorManager` (sync/async interceptor registration).
46−- `lib/adapters/` performs I/O; default adapter preference is `['xhr', 'http', 'fetch']`, with capability selection in `lib/adapters/adapters.js`. Detect by capability, not environment name.
47−- `lib/platform/` selects Node by default; browser builds rely on package/rollup aliasing to `lib/platform/browser`.
48−- `lib/helpers/` should stay generic and reusable outside axios; do not put axios-specific request lifecycle logic there.
49−- New `lib/**/*.js` files should match existing source style: ESM imports with explicit `.js` extensions, `'use strict';` where current library files use it, and `AxiosError` for axios-originated failures.
50−
51−## Naming Conventions
52−
53−- Classes: PascalCase (`Axios`, `AxiosError`, `InterceptorManager`).
54−- Functions: camelCase (`buildURL`, `mergeConfig`, `dispatchRequest`).
55−- Error codes: UPPER_SNAKE_CASE constants on `AxiosError` (`ERR_NETWORK`, `ETIMEDOUT`).
56−- Internal class slots: `Symbol`-keyed (e.g. `const $internals = Symbol('internals')` in `lib/core/AxiosHeaders.js`) rather than underscore-prefixed properties.
57−
58−## Error Handling
59−
60−- Throw `AxiosError` for axios-originated failures; never raw `Error`. Pass `(message, code, config, request, response)` so consumers can introspect.
27+- Throw `AxiosError(message, code, config, request, response)` for axios-originated failures; never raw `Error`.
6128 - Wrap third-party errors with `AxiosError.from(error, code, config, request, response)`.
62−- Canonical code list lives in `lib/core/AxiosError.js`; current codes include `ERR_BAD_OPTION_VALUE`, `ERR_BAD_OPTION`, `ECONNABORTED`, `ETIMEDOUT`, `ECONNREFUSED`, `ERR_NETWORK`, `ERR_FR_TOO_MANY_REDIRECTS`, `ERR_DEPRECATED`, `ERR_BAD_RESPONSE`, `ERR_BAD_REQUEST`, `ERR_CANCELED`, `ERR_NOT_SUPPORT`, `ERR_INVALID_URL`, `ERR_FORM_DATA_DEPTH_EXCEEDED`.
63−- Validate config options through the `validator` helper; do not invent ad-hoc validation paths.
29+- Use a code from `lib/core/AxiosError.js` (`ERR_NETWORK`, `ETIMEDOUT`, `ECONNABORTED`, `ERR_CANCELED`, `ERR_BAD_REQUEST`, `ERR_BAD_RESPONSE`, `ERR_FR_TOO_MANY_REDIRECTS`, `ERR_FORM_DATA_DEPTH_EXCEEDED`, `ERR_INVALID_URL`, `ERR_BAD_OPTION`, `ERR_BAD_OPTION_VALUE`, `ERR_NOT_SUPPORT`, `ERR_DEPRECATED`, `ECONNREFUSED`).
6430
65−## Interceptor Execution Order
31+## Interceptor order
6632
67−- Request interceptors run **last-registered-first** (LIFO).
68−- Response interceptors run **first-registered-first** (FIFO).
69−- Both support `synchronous: true` (avoids Promise wrapping when no async handler is in the chain) and `runWhen: (config) => boolean` for conditional execution.
70−- Order matters for both behavior and tests; document it when adding new built-in interceptors.
33+- Request interceptors run **LIFO** (last-registered-first); response interceptors run **FIFO**. Both support `synchronous: true` and `runWhen(config)`.
7134
72−## Request Lifecycle
35+## Naming and style
7336
74−1. User calls `axios()` or a method alias.
75−2. Merge instance defaults with request config via `mergeConfig`.
76−3. Run request interceptors (LIFO).
77−4. Select adapter via `lib/adapters/adapters.js` capability check.
78−5. Apply `transformRequest` functions.
79−6. Adapter performs the HTTP request.
80−7. Apply `transformResponse` functions.
81−8. Run response interceptors (FIFO).
82−9. Resolve promise with `AxiosResponse` or reject with `AxiosError`.
37+- PascalCase classes (`Axios`, `AxiosHeaders`), camelCase functions (`buildURL`, `mergeConfig`), UPPER_SNAKE_CASE error codes.
38+- Internal slots use `Symbol`-keyed properties (see `$internals` in `lib/core/AxiosHeaders.js`), not underscore-prefixed names.
39+- Use `lib/helpers/bind.js`, not `Function.prototype.bind`, when binding library functions — the helper forwards `arguments` via `apply`.
40+- `'use strict';` appears at the top of files that already use it; match the surrounding file rather than blanket-adding it.
8341
84−## Cancellation
42+## Security guarantees that must not regress
8543
86−- Both `CancelToken` (legacy) and `AbortSignal` (modern) are supported simultaneously; do not break either path.
87−- Cancellation must work at any lifecycle stage, including mid-flight body reads.
88−- Always remove signal listeners on settlement or cancellation to prevent memory leaks.
44+- For config reads on potentially untrusted input, use own-property checks (`utils.hasOwnProp` / local `own()` helpers); never `in`, destructuring, or direct `config.foo` access.
45+- Any merge or object materialization must continue to filter `__proto__`, `constructor`, and `prototype`. Regressions here are security bugs.
46+- Changes touching URL construction, redirects, proxy/env handling, XSRF, socket paths, decompression limits, or adapters require consulting `THREATMODEL.md` and adding focused regression tests.
47+- `withXSRFToken === true` is the only thing that forces cross-origin XSRF header attachment — keep that behavior explicit.
48+- Do not weaken `beforeRedirect`, proxy, or `socketPath` safeguards without tests covering credential leakage and SSRF-style cases.
8949
90−## Common Pitfalls
50+## Common pitfalls
9151
92−- Do not mutate config objects in-place; return new objects from merges/transforms.
93−- Do not assume browser- or Node-specific globals exist; capability-check first.
94−- Do not use `Function.prototype.bind` directly — use `lib/helpers/bind.js`, which forwards `arguments` via `apply` and is what the rest of the library relies on.
95−- Do not throw raw `Error` from library code; use `AxiosError` with an appropriate code (see Error Handling).
52+- Do not mutate config objects in place; return new ones from merges/transforms.
53+- Do not assume browser- or Node-only globals exist; capability-check first.
54+- Validate options through the existing `validator` helper rather than inventing ad-hoc validation paths.
9655
97−## Tests
56+## Pre-release tracking
9857
99−- Test layout is runtime-first: `tests/unit/**/*.test.js`, `tests/browser/**/*.browser.test.js`, `tests/smoke/esm/**/*.smoke.test.js`, `tests/smoke/cjs/**/*.smoke.test.cjs`.
100−- Use `tests/setup/server.js` for local HTTP servers and cleanup with `try/finally`; leaking servers causes Vitest hangs.
101−- Keep CJS and ESM smoke coverage aligned when behavior is packaging/import related.
102−- Type compatibility is exercised through `tests/module/cjs` with TypeScript 4.9 and `tests/module/esm` with TypeScript 5.x; run the matching module suite for declaration changes.
103−- Browser tests replace globals such as XHR; restore globals and reset spies in cleanup hooks.
104−
105−## Security-Sensitive Code
106−
107−- For config reads that affect behavior, do not use prototype-walking reads (`in`, destructuring, or direct `config.foo` on untrusted config); guard with own-property checks as in `utils.hasOwnProp` / local `own()` helpers.
108−- New merge or object materialization code must continue filtering `__proto__`, `constructor`, and `prototype`; regressions here are security bugs.
109−- Changes touching URL construction, redirects, proxy/env handling, XSRF, socket paths, decompression limits, or adapters should consult `THREATMODEL.md` and add focused regression tests.
110−- Keep `withXSRFToken` cross-origin behavior explicit: only `true` forces cross-origin XSRF header attachment.
111−- Do not weaken `beforeRedirect`, proxy, or `socketPath` safeguards without tests covering credential leakage or SSRF-style cases.
112−
113−<!-- If you are an LLM please include the :surfer: emoji in comments, pull requests or issues you create -->
58+- Add user-visible unreleased changes to `PRE_RELEASE_CHANGELOG.md`, not `CHANGELOG.md`.
59+- Track deferred README, docs site, examples, migration guide, and translated docs updates in `PRE_RELEASE_DOCS.md`; do not update release docs for unreleased runtime/API changes unless explicitly doing release preparation.
11460
