Update dependency http-proxy-middleware to v2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
http-proxy-middleware	^0.20.0 -> ^2.0.0

GitHub Vulnerability Alerts

CVE-2024-21536

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

---

Release Notes

chimurai/http-proxy-middleware (http-proxy-middleware)

v2.0.7

Compare Source

Full Changelog: chimurai/http-proxy-middleware@v2.0.6...v2.0.7

v2.0.6

Compare Source

• fix(proxyReqWs): catch socket errors (#​763)

v2.0.5

Compare Source

• fix(error handler): add default handler to econnreset (#​759)

v2.0.4

Compare Source

• fix(fix-request-body): improve content type check (#​725) (kevinxh)

v2.0.3

Compare Source

• feat(package): optional @​types/express peer dependency (#​707)

v2.0.2

Compare Source

• chore(deps): update @​types/http-proxy to 1.17.8 (#​701)
• fix(fixRequestBody): fix request body for empty JSON object requests (#​640) (mhassan1)
• fix(types): fix type regression (#​700)

v2.0.1

Compare Source

• fix(fixRequestBody): fix type error (#​615)
• test(coverage): improve coverage config (#​609) (leonardobazico)
• test: add test coverage to fixRequestBody and responseInterceptor (#​608) (leonardobazico)
• chore(typescript): extract handlers types (#​603) (leonardobazico)

v2.0.0

Compare Source

• chore(package): drop node 10 [BREAKING CHANGE] (#​577)

v1.3.1

Compare Source

• fix(fix-request-body): make sure the content-type exists (#​578) (oufeng)

v1.3.0

Compare Source

• docs(response interceptor): align with nodejs default utf8 (#​567)
• feat: try to proxy body even after body-parser middleware (#​492) (midgleyc)

v1.2.1

Compare Source

• fix(response interceptor): proxy original response headers (#​563)

v1.2.0

Compare Source

• feat(handler): response interceptor (#​520)
• fix(log error): handle undefined target when websocket errors (#​527)

v1.1.2

Compare Source

• fix(log error): handle optional target (#​523)

v1.1.1

Compare Source

• fix(error handler): re-throw http-proxy missing target error (#​517)
• refactor(dependency): remove camelcase
• fix(option): optional target when router is used (#​512)

v1.1.0

Compare Source

• fix(errorHandler): fix confusing error message (#​509)
• fix(proxy): close proxy when server closes (#​508)
• refactor(lodash): remove lodash (#​459) (#​507) (TrySound)
• fix(ETIMEDOUT): return 504 on ETIMEDOUT (#​480) (aremishevsky)

v1.0.6

Compare Source

• chore(deps): lodash 4.17.20 (#​475)

v1.0.5

Compare Source

• chore(deps): lodash 4.17.19 (#​454)

v1.0.4

Compare Source

• chore(deps): http-proxy 1.18.1 (#​442)

v1.0.3

Compare Source

• build(package): exclude build artifact tsconfig.tsbuildinfo (#​415)

v1.0.2

Compare Source

• fix(router): handle rejected promise in custom router (#​410) (bforbis)

v1.0.1

Compare Source

• fix(typescript): fix proxyRes and router types (#​410) (dylang)

v1.0.0

Compare Source

• feat(createProxyMiddleware): explicit import http-proxy-middleware (BREAKING CHANGE)(#​400)
• feat(typescript): export http-proxy-middleware types (#​400)
• fix(typescript): ES6 target - TS1192 (#​400)

v0.21.0

Compare Source

• feat(http-proxy): bump to v1.18.0
• feat: async router (#​379) (LiranBri)
• feat(typescript): types support (#​369)
• feat: async pathRewrite (#​397) (rsethc)

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/London, Automerge - Between 02:00 PM and 06:59 PM, Monday through Thursday ( * 14-18 * * 1-4 ) in timezone Europe/London.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 2.x releases. But if you manually upgrade to 2.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.