CodeVetter · Repo Unpack · Testing signals
axios/axios
Vitest is the only runner for source tests, split into three projects; unit tests run in node, browser tests run under Playwright against chromium/firefox/webkit. Coverage of security behavior is unusually deep — `tests/unit/prototypePollution.test.js` is 1619 lines and `tests/unit/adapters/http.test.js` is 7252 lines, together ~39% of the 22.8k unit-test lines. Beyond the source tree there are four packed-tarball suites (CJS/ESM smoke via mocha/vitest, Bun via `bun test`, Deno via `deno task`) plus two TypeScript declaration suites pinned to different TS versions. The gaps are mostly at the edges: no coverage numbers or coverage gate is configured, the reproducibility workflow is explicitly non-blocking, and `sandbox/`, `examples/`, and `gulpfile.js` have no tests at all.
- Vitest defines three projects — `unit` (node env, `tests/unit/**/*.test.js`, no setup files), `browser` (chromium, headed), and `browser-headless` (chromium+firefox+webkit) — the latter two both using `tests/setup/browser.setup.js`.
- Unit tests are organised by module under `tests/unit/{adapters,cancel,core,helpers,utils}` plus 15 top-level files; `tests/unit/core/` mirrors `lib/core/` almost 1:1 (Axios, AxiosError, buildFullPath, dispatchRequest, InterceptorManager, mergeConfig, settle, transformData).
- `tests/unit/prototypePollution.test.js` (1619 lines) is a dedicated security suite that imports `utils`, `mergeConfig`, `defaults`, `AxiosError`, `AxiosHeaders`, `resolveConfig`, and the public `index.js`, uses `node:vm` for cross-realm cases, and cleans up ~25 `Object.prototype` keys in `afterEach`.
- `tests/setup/server.js` is the shared HTTP(S)/HTTP2 fixture: it generates a self-signed cert once with `selfsigned`, tracks live servers in a `Set` for cleanup, defaults to port 0 (OS-assigned) to avoid TIME_WAIT races in CI, and supports buffering, throttling (`stream-throttle`), and `formidable` parsing.
- Browser suite (21 files) covers adapter selection, basic auth, both cancellation APIs, cookies, fetch cache and fetch response errors, formdata, headers, interceptors, same-origin detection, progress, settle, transforms, and XSRF.
- Smoke suites test the *packed tarball*, not the source: CI runs `npm pack`, uploads the tgz as an artifact, and each downstream job installs it with `npm install --no-save ../../../artifacts/axios-*.tgz` before running that runtime's suite.
- Runtime matrix is explicit: CJS smoke/module on Node 12/14/16/18, ESM smoke/module on Node 20/22/24/26, plus one Bun job and one Deno job — the Node-12 floor matches the `@babel/preset-env` target used for `dist/node/axios.cjs`.
- CJS and ESM smoke suites are kept in lockstep — both have the same 16 test names (auth, basic, cancel, error, fetch, files, formData, headers, http2, import, instance, interceptors, progress, rateLimit, timeout, urlencode) with `.cjs`/`.js` extensions.
- Bun and Deno smoke coverage is deliberately narrower — Deno tests only cancel/error/fetch/headers/import, Bun adds formData/http/interceptors/progress/timeout — so runtime-specific regressions outside those areas would not be caught.
- Type declarations are exercised by two separate workspaces: `tests/module/cjs` (`ts-require.module.test.cjs`, `ts-require-default.module.test.cjs`, `typings.module.test.cjs`) and `tests/module/esm` (`ts.module.test.js`, `typings.module.test.js`), each with its own lockfile and, per AGENTS.md, pinned to TypeScript 4.9 vs 5.x.
- Lint scope is source-only (`eslint lib/**/*.js`); tests, `gulpfile.js`, `rollup.config.js`, and `scripts/` are not linted, and `lib/adapters/http.js` / `lib/adapters/xhr.js` get environment-specific globals blocks rather than the shared browser+node block.
- There is no coverage provider, threshold, or reporter configured in `vitest.config.js`, and no coverage step in `run-ci.yml` — so coverage is unmeasured and ungated despite the large suite.
- The build-reproducibility check is a two-pass build-and-diff that is explicitly `continue-on-error: true` with a comment saying to remove that line once the build is byte-identical — so bundle nondeterminism is observed but not enforced.
- `tests/unit/helpers/shouldBypassProxy.test.js` is 567 lines against a 505-line implementation, indicating the CIDR/`NO_PROXY` matching logic added in this cycle is one of the most heavily specified helpers.