An older Rails app had axios 0.19.2 in its front end, and a security advisory meant it had to move. I went to 0.29.0 first, then to 1.8.2 two days later.

The first step broke a test. Requests that used to work arrived at the server with no body, and they were all written the same way:

await api.post('/items', null, { data: body });

That passes null as the request body and tucks the real body into the config. With 0.19 the body still went out. With 0.29 the explicit null wins, and the request goes out empty. The fix is to put the body where axios expects it:

await api.post('/items', body);

My first guess was a change in the default Content-Type, and that was wrong. axios still sets a JSON content type for plain objects.

The second step, to 1.8.2, failed during asset precompile:

axios/lib/helpers/trackStream.js: unknown Statement of type "ForOfStatement"

axios 1.x ships modern syntax, including for await loops. The app’s older Babel config lists the regenerator plugin by hand, and that’s the most likely thing choking on it. Letting @babel/preset-env handle the transforms, updating Babel, or excluding axios from babel-loader are the usual ways out.

1.8.2 was the patched version at the time. Later advisories mean the current 1.x is the one to use now.