fix: normalize url/decode errors, support thenable dns lookup, and preserve shorthand config data - #11377

Summary

This PR addresses four targeted edge-case bugs and error contract inconsistencies across the Node HTTP adapter, DNS lookup callback wrapper, data URI decoding helper, and Axios instance request method shorthands:

1. Thenable custom DNS resolution in Node HTTP adapter: Custom DNS resolvers that return a Promise without being declared using the async keyword (e.g., arrow functions returning a Promise or thenables from resolver libraries) were treated as callback-style functions by callbackify because utils.isAsyncFn only matches [object AsyncFunction]. This caused requests with non-async Promise lookups to hang indefinitely until the connection timed out.
2. Standardized invalid URL rejections in Node HTTP adapter: In lib/adapters/http.js, new URL(fullPath, urlBase) was invoked outside a try...catch. Malformed URLs or relative paths without a base threw unhandled WHATWG native TypeErrors, violating Axios's contract that Axios-originated rejections must be instances of AxiosError.
3. Data URI percent-encoding error handling: In lib/helpers/fromDataURI.js, decodeURIComponent(body) was invoked without catching invalid percent-encoded sequences (e.g., %99), leaking a raw runtime URIError. This is now caught and normalized to AxiosError.ERR_INVALID_URL.
4. Preserving config.data in method shorthands: In Axios.prototype, post, put, patch, and query shorthands previously passed positional data directly into mergeConfig. If a caller passed undefined for the positional data argument while specifying payload in config.data, data: undefined clobbered config.data. These shorthands now fall back to config.data when the positional argument is undefined, matching the behavior of delete, get, head, and options.

Linked issue

N/A (Identified during codebase audit)

Changes

• lib/helpers/callbackify.js: Updated to wrap any function returning a thenable, safely invoke the callback at most once (onceCb), and route synchronous throws to the callback.
• lib/adapters/http.js: Wrapped new URL(fullPath, urlBase) in a try...catch block rejecting with AxiosError.from(err, AxiosError.ERR_INVALID_URL, config).
• lib/helpers/fromDataURI.js: Wrapped decodeURIComponent in a try...catch block throwing new AxiosError('Invalid URL', AxiosError.ERR_INVALID_URL).
• lib/core/Axios.js: Updated forEachMethodWithData to fall back to config.data using utils.hasOwnProp(config, 'data') when positional data === undefined.
• PRE_RELEASE_CHANGELOG.md: Added entries under ## Bug Fixes describing the changes.
• Added regression tests in tests/unit/helpers/callbackify.test.js, tests/unit/adapters/http.test.js, tests/unit/fromDataURI.test.js, and tests/unit/axios.test.js.

Validation

Commands executed locally (Node.js v24.15.0 on Windows):

• npm run lint: Passed with 0 errors / 0 warnings (eslint lib/**/*.js).
• npx eslint tests/unit/helpers/callbackify.test.js: Passed with 0 errors.
• npm run build: Successfully built ESM, UMD, and CJS distribution bundles (gulp clear && cross-env NODE_ENV=production rollup -c).
• npm run test:vitest:unit: All 75 test files and 1,711 unit tests passed with 0 failures (vitest run --project unit).

Inapplicable checks:

• test:vitest:browser:headless: Requires local Playwright browser binary installation (npx playwright install). Not run locally; CI runs browser headless tests. The changes are strictly isolated to Node DNS resolution, HTTP adapter URL validation, shared data URI percent-decoding, and Axios instance argument defaulting.
• Packaging / smoke suites: No changes to package shape, exports, or dependencies.

Compatibility and documentation

• Semver: Patch (bug fixes only). Fully backward-compatible.
• Affected environments: Node.js and universal helpers.
• Public API / Types: No public API or TypeScript declaration changes required.
• Pre-Release Notes: Entries added to PRE_RELEASE_CHANGELOG.md.

Checklist

• Scope, target branch, and linked issue/rationale checked
• PRE_RELEASE_CHANGELOG.md entry added or updated (or AGENTS.md's automated release-preparation exception explained)
• Regression tests and relevant negative/platform cases covered (or N/A with reason)
• Applicable local checks completed, with actual commands and results recorded above
• Deferred release docs and ESM/CJS types/tests updated where needed (or N/A with reason)
• Semver impact stated and intentional breaking changes explained
• Final diff reviewed for security, unrelated changes, generated artifacts, and test/debug leftovers
• Latest GitHub Actions status recorded separately from review/security bot results