# Contributor handoff — axios/axios

> Canonical page: https://codevetter.com/unpack/axios/agent-handoff

# Contributor handoff — axios/axios

Scanned commit 56a5f1acdc41965f464eb59bec6cc828113ba546 (2026-09-16). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Read `AGENTS.md` first — it is the canonical contributor contract and encodes rules that are not derivable from the code (pre-release changelog/docs staging, `ignore-scripts` safety, dependency policy, error-handling conventions). Then read `lib/core/Axios.js`, `lib/core/dispatchRequest.js`, `lib/core/mergeConfig.js`, and whichever adapter you're touching. The cheapest verification loop is `npm run test:vitest:unit -- tests/unit/<file>.test.js` plus `npx eslint lib/<file>.js`; a full build is only needed for packaging/type changes. The two traps that catch most newcomers are (1) editing `README.md`/`CHANGELOG.md` instead of `PRE_RELEASE_DOCS.md`/`PRE_RELEASE_CHANGELOG.md`, and (2) using ordinary property reads on config where the file uses `own()`/`getSafeProp`, which silently reopens a prototype-pollution hole with no test failure unless you add one.
- Read-first order: `AGENTS.md` (canonical rules, mirrored by the `.github/copilot-instructions.md` stub and `CLAUDE.md`'s one-line `@AGENTS.md` include) → `lib/axios.js` → `lib/core/Axios.js` → `lib/core/dispatchRequest.js` → `lib/core/mergeConfig.js` → the target adapter. — [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md) [CLAUDE.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/CLAUDE.md) [lib/axios.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/axios.js) [lib/core/dispatchRequest.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/dispatchRequest.js)
- Unreleased user-visible changes go in `PRE_RELEASE_CHANGELOG.md` under `## Unreleased`, and deferred README/docs-site/migration-guide work goes in `PRE_RELEASE_DOCS.md`; `CHANGELOG.md` (141KB) is release-owned and must not be touched during feature work. — [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md) [PRE_RELEASE_CHANGELOG.md#L1-L12](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/PRE_RELEASE_CHANGELOG.md#L1-L12) [PRE_RELEASE_DOCS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/PRE_RELEASE_DOCS.md)
- Install safety: `.npmrc` sets `ignore-scripts=true` and CI uses `npm ci --ignore-scripts`; if husky hooks are needed after a fresh install, run `npm rebuild husky && npx husky` once rather than removing the setting. — [.npmrc](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.npmrc) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md) [.github/workflows/run-ci.yml#L30-L32](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/run-ci.yml#L30-L32)
- Focused verification commands: `npm run test:vitest:unit -- tests/unit/path.test.js` for one unit file, `npx eslint lib/path/to/file.js` for one source file, `npm run test:vitest:browser:headless` for CI-parity browser runs (requires `npx playwright install` first). — [package.json#L103-L114](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L103-L114) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md) [vitest.config.js#L18-L45](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/vitest.config.js#L18-L45)
- Never hand-edit `dist/` (generated by Rollup and wiped by `gulp clear`) or `lib/env/data.js` (generated by `gulp version` from package.json) — both are regenerated by the build. — [gulpfile.js#L14-L17](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/gulpfile.js#L14-L17) [gulpfile.js#L62-L82](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/gulpfile.js#L62-L82) [package.json#L100-L101](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L100-L101)
- Any API change must be mirrored in three places: the runtime export list in `lib/axios.js`/`index.js`, `index.d.ts` (ESM types), and `index.d.cts` (CJS `export =` types) — and then exercised by `tests/module/esm` (TS 5.x) and `tests/module/cjs` (TS 4.9). — [index.js#L20-L43](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/index.js#L20-L43) [index.d.ts#L391-L487](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/index.d.ts#L391-L487) [index.d.cts](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/index.d.cts) [tests/module/esm/tests/typings.module.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/module/esm/tests/typings.module.test.js)
- Convention trap: config reads that affect behavior must use own-property guards. `lib/adapters/http.js` defines a local `own = (key) => utils.getSafeProp(config, key)` and routes ~20 reads through it; `resolveConfig` and `lib/defaults/index.js` each define their own `own()` helper for the same reason. — [lib/adapters/http.js#L566-L590](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L566-L590) [lib/helpers/resolveConfig.js#L28-L30](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/resolveConfig.js#L28-L30) [lib/defaults/index.js#L12](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/index.js#L12)
- Convention trap: do not use `Function.prototype.bind` directly — the library relies on `lib/helpers/bind.js`, which forwards `arguments` via `apply`, and `createInstance` depends on that behavior for the callable-instance trick. — [lib/helpers/bind.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/bind.js) [lib/axios.js#L31](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/axios.js#L31) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md)
- Convention trap: never throw raw `Error` from library code — throw `AxiosError(message, code, config, request, response)` or wrap with `AxiosError.from(...)` using a code from the list at the bottom of `lib/core/AxiosError.js`. — [lib/core/AxiosError.js#L76-L168](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/AxiosError.js#L76-L168) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md)
- Test-hygiene trap: HTTP fixtures come from `tests/setup/server.js` and must be cleaned up in `try/finally`; leaking a server hangs Vitest. Browser tests replace globals such as XHR and must restore them in cleanup hooks. — [tests/setup/server.js#L14-L20](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/setup/server.js#L14-L20) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md) [tests/setup/browser.setup.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/setup/browser.setup.js)
- Changes touching URL building, redirects, proxy/env handling, XSRF, socket paths, decompression limits, or adapters require consulting `THREATMODEL.md` (94KB, sections: scope/methodology, runtime threat model, supply-chain threat model) and adding a focused regression test. — [THREATMODEL.md#L1-L24](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/THREATMODEL.md#L1-L24) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md) [tests/unit/prototypePollution.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/prototypePollution.test.js)
- Style boundary for new `lib/**/*.js` files: ESM imports with explicit `.js` extensions, `'use strict';` where neighboring files have it, `Symbol`-keyed internal slots (e.g. `const $internals = Symbol('internals')` in `AxiosHeaders` and `InterceptorManager`) rather than underscore-prefixed properties. — [lib/core/InterceptorManager.js#L1-L5](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/InterceptorManager.js#L1-L5) [lib/core/AxiosHeaders.js#L1-L18](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/AxiosHeaders.js#L1-L18) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md)
- Dependency changes are effectively out of scope for routine work: runtime deps are four packages and must not grow without discussion, and package/lockfile/Actions update PRs are maintainer/bot-only with a 7-day Dependabot delay enforced by policy plus `lockfile-lint.yml`. — [package.json#L149-L154](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L149-L154) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md) [.github/workflows/lockfile-lint.yml#L1-L40](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/lockfile-lint.yml#L1-L40)
- Commit hygiene is enforced: husky runs a `commit-msg` hook, commitlint uses `@commitlint/config-conventional` with `header-max-length` raised to 130, and lint-staged runs Prettier over `*.{js,cjs,mjs,ts,json,md,yml,yaml}`. — [.husky/commit-msg](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.husky/commit-msg) [package.json#L189-L205](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L189-L205) [.prettierrc](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.prettierrc)
- Default branch is `v1.x` (not `main`): CI triggers on PRs, `lockfile-lint`/`zizmor`/`verify-build-reproducibility` also run on pushes to `v1.x`, and the publish workflow fires on `v1.*.*` tags. — [.github/workflows/lockfile-lint.yml#L10-L14](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/lockfile-lint.yml#L10-L14) [.github/workflows/publish.yml#L3-L6](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/publish.yml#L3-L6) [.github/workflows/zizmor.yml#L3-L6](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/zizmor.yml#L3-L6)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)