Skip to content

deps: Update dependency http-proxy-middleware to v3 [SECURITY] (stable/operate-8.5) #31149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Apr 16, 2025
Merged

deps: Update dependency http-proxy-middleware to v3 [SECURITY] (stable/operate-8.5) #31149

merged 1 commit into from
Apr 16, 2025

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 16, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
http-proxy-middleware 2.0.9 -> 3.0.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

Release Notes

chimurai/http-proxy-middleware (http-proxy-middleware)

v3.0.4

Compare Source

  • fix(fixRequestBody): handle invalid request (#​1092)
  • fix(fixRequestBody): prevent multiple .write() calls (#​1089)
  • fix(websocket): handle errors in handleUpgrade (#​823)
  • ci(package): patch http-proxy (#​1084)
  • fix(fixRequestBody): support multipart/form-data (#​896)
  • feat(types): export Plugin type (#​1071)

v3.0.3

Compare Source

  • fix(pathFilter): handle errors

v3.0.2

Compare Source

  • refactor(dependency): replace is-plain-obj with is-plain-object (#​1031)
  • chore(package): upgrade to eslint v9 (#​1032)
  • fix(logger-plugin): handle undefined protocol and hostname (#​1036)

v3.0.1

Compare Source

  • fix(type): fix RequestHandler return type (#​980)
  • refactor(errors): improve pathFilter error message (#​987)
  • fix(logger-plugin): fix missing target port (#​989)
  • ci(package): npm package provenance (#​991)
  • fix(logger-plugin): log target port when router option is used (#​1001)
  • refactor: fix circular dependencies (#​1010)
  • fix(fix-request-body): support '+json' content-type suffix (#​1015)

v3.0.0

Compare Source

This release contains some breaking changes.

Please read the V3 discussion https://redirect.github.com/chimurai/http-proxy-middleware/discussions/768
or follow the MIGRATION.md guide.

  • feat(typescript): type improvements (#​882)
  • chore(deps): update micromatch to 4.0.5
  • chore(package): bump devDependencies
  • feat(legacyCreateProxyMiddleware): show migration tips (#​756)
  • feat(legacyCreateProxyMiddleware): adapter with v2 behavior (#​754)
  • docs(proxy events): fix new syntax (#​753)
  • feat(debug): improve troubleshooting (#​752)
  • test(path-rewriter): improve coverage (#​751)
  • feat(ejectPlugins): skip registering default plugins (#​750)
  • refactor: logging [BREAKING CHANGE] (#​749)
  • refactor(handlers): refactor to plugins [BREAKING CHANGE] (#​745)
  • feat(plugins): add support for plugins (#​732)
  • docs: fix v3 documentation
  • fix: server mounting [BREAKING CHANGE] (#​731)
  • test(fixRequestBody): fix broken test
  • refactor: use node http base types [BREAKING CHANGE] (#​730) (special thanks: @​cdaringe & @​devanshj)
  • feat(option): refactor context to pathFilter option [BREAKING CHANGE] (#​722)
  • feat: remove shorthand usage [BREAKING CHANGE] (#​716)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added area/security Marks an issue as security related automerge labels Apr 16, 2025
@renovate renovate bot enabled auto-merge April 16, 2025 16:00
@github-actions github-actions bot added the component/operate Related to the Operate component/team label Apr 16, 2025
@renovate renovate bot merged commit ecc795b into stable/operate-8.5 Apr 16, 2025
17 checks passed
@renovate renovate bot deleted the renovate/stable/operate-8.5-fe-npm-http-proxy-middleware-vulnerability branch April 16, 2025 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees
No one assigned
Labels
area/security Marks an issue as security related automerge component/operate Related to the Operate component/team
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants