# Testing signals — axios/axios

> Canonical page: https://codevetter.com/unpack/axios/testing-signals

# Testing signals — axios/axios

Scanned commit 56a5f1acdc41965f464eb59bec6cc828113ba546 (2026-09-16). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Vitest is the only runner for source tests, split into three projects; unit tests run in node, browser tests run under Playwright against chromium/firefox/webkit. Coverage of security behavior is unusually deep — `tests/unit/prototypePollution.test.js` is 1619 lines and `tests/unit/adapters/http.test.js` is 7252 lines, together ~39% of the 22.8k unit-test lines. Beyond the source tree there are four packed-tarball suites (CJS/ESM smoke via mocha/vitest, Bun via `bun test`, Deno via `deno task`) plus two TypeScript declaration suites pinned to different TS versions. The gaps are mostly at the edges: no coverage numbers or coverage gate is configured, the reproducibility workflow is explicitly non-blocking, and `sandbox/`, `examples/`, and `gulpfile.js` have no tests at all.
- Vitest defines three projects — `unit` (node env, `tests/unit/**/*.test.js`, no setup files), `browser` (chromium, headed), and `browser-headless` (chromium+firefox+webkit) — the latter two both using `tests/setup/browser.setup.js`. — [vitest.config.js#L5-L45](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/vitest.config.js#L5-L45)
- Unit tests are organised by module under `tests/unit/{adapters,cancel,core,helpers,utils}` plus 15 top-level files; `tests/unit/core/` mirrors `lib/core/` almost 1:1 (Axios, AxiosError, buildFullPath, dispatchRequest, InterceptorManager, mergeConfig, settle, transformData). — [tests/unit/core/Axios.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/core/Axios.test.js) [tests/unit/core/mergeConfig.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/core/mergeConfig.test.js) [tests/unit/helpers/resolveConfig.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/helpers/resolveConfig.test.js)
- `tests/unit/prototypePollution.test.js` (1619 lines) is a dedicated security suite that imports `utils`, `mergeConfig`, `defaults`, `AxiosError`, `AxiosHeaders`, `resolveConfig`, and the public `index.js`, uses `node:vm` for cross-realm cases, and cleans up ~25 `Object.prototype` keys in `afterEach`. — [tests/unit/prototypePollution.test.js#L1-L40](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/prototypePollution.test.js#L1-L40)
- `tests/setup/server.js` is the shared HTTP(S)/HTTP2 fixture: it generates a self-signed cert once with `selfsigned`, tracks live servers in a `Set` for cleanup, defaults to port 0 (OS-assigned) to avoid TIME_WAIT races in CI, and supports buffering, throttling (`stream-throttle`), and `formidable` parsing. — [tests/setup/server.js#L1-L60](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/setup/server.js#L1-L60)
- Browser suite (21 files) covers adapter selection, basic auth, both cancellation APIs, cookies, fetch cache and fetch response errors, formdata, headers, interceptors, same-origin detection, progress, settle, transforms, and XSRF. — [tests/browser/xsrf.browser.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/browser/xsrf.browser.test.js) [tests/browser/fetchCache.browser.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/browser/fetchCache.browser.test.js) [tests/browser/isURLSameOrigin.browser.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/browser/isURLSameOrigin.browser.test.js)
- Smoke suites test the *packed tarball*, not the source: CI runs `npm pack`, uploads the tgz as an artifact, and each downstream job installs it with `npm install --no-save ../../../artifacts/axios-*.tgz` before running that runtime's suite. — [.github/workflows/run-ci.yml#L62-L108](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/run-ci.yml#L62-L108) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md)
- Runtime matrix is explicit: CJS smoke/module on Node 12/14/16/18, ESM smoke/module on Node 20/22/24/26, plus one Bun job and one Deno job — the Node-12 floor matches the `@babel/preset-env` target used for `dist/node/axios.cjs`. — [.github/workflows/run-ci.yml#L62-L200](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/run-ci.yml#L62-L200) [rollup.config.js#L136-L142](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/rollup.config.js#L136-L142)
- CJS and ESM smoke suites are kept in lockstep — both have the same 16 test names (auth, basic, cancel, error, fetch, files, formData, headers, http2, import, instance, interceptors, progress, rateLimit, timeout, urlencode) with `.cjs`/`.js` extensions. — [tests/smoke/cjs/tests/http2.smoke.test.cjs](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/smoke/cjs/tests/http2.smoke.test.cjs) [tests/smoke/esm/tests/http2.smoke.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/smoke/esm/tests/http2.smoke.test.js)
- Bun and Deno smoke coverage is deliberately narrower — Deno tests only cancel/error/fetch/headers/import, Bun adds formData/http/interceptors/progress/timeout — so runtime-specific regressions outside those areas would not be caught. — [tests/smoke/deno/tests/import.smoke.test.ts](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/smoke/deno/tests/import.smoke.test.ts) [tests/smoke/bun/tests/http.smoke.test.ts](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/smoke/bun/tests/http.smoke.test.ts)
- Type declarations are exercised by two separate workspaces: `tests/module/cjs` (`ts-require.module.test.cjs`, `ts-require-default.module.test.cjs`, `typings.module.test.cjs`) and `tests/module/esm` (`ts.module.test.js`, `typings.module.test.js`), each with its own lockfile and, per AGENTS.md, pinned to TypeScript 4.9 vs 5.x. — [tests/module/cjs/package.json](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/module/cjs/package.json) [tests/module/esm/package.json](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/module/esm/package.json) [AGENTS.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/AGENTS.md)
- Lint scope is source-only (`eslint lib/**/*.js`); tests, `gulpfile.js`, `rollup.config.js`, and `scripts/` are not linted, and `lib/adapters/http.js` / `lib/adapters/xhr.js` get environment-specific globals blocks rather than the shared browser+node block. — [package.json#L113-L114](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L113-L114) [eslint.config.js#L28-L64](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/eslint.config.js#L28-L64)
- There is no coverage provider, threshold, or reporter configured in `vitest.config.js`, and no coverage step in `run-ci.yml` — so coverage is unmeasured and ungated despite the large suite. — [vitest.config.js#L1-L46](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/vitest.config.js#L1-L46) [.github/workflows/run-ci.yml#L14-L60](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/run-ci.yml#L14-L60)
- The build-reproducibility check is a two-pass build-and-diff that is explicitly `continue-on-error: true` with a comment saying to remove that line once the build is byte-identical — so bundle nondeterminism is observed but not enforced. — [.github/workflows/verify-build-reproducibility.yml#L18-L26](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/verify-build-reproducibility.yml#L18-L26)
- `tests/unit/helpers/shouldBypassProxy.test.js` is 567 lines against a 505-line implementation, indicating the CIDR/`NO_PROXY` matching logic added in this cycle is one of the most heavily specified helpers. — [tests/unit/helpers/shouldBypassProxy.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/helpers/shouldBypassProxy.test.js) [lib/helpers/shouldBypassProxy.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/shouldBypassProxy.js) [PRE_RELEASE_CHANGELOG.md#L7](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/PRE_RELEASE_CHANGELOG.md#L7)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)