Http-proxy-middleware, designed for seamless integration into Node.js environments using Connect, Express, and Browser-sync, offers a straightforward solution for proxying HTTP requests. Comparing versions 1.3.0 and 1.2.1 reveals subtle yet potentially impactful changes for developers. Both versions share core dependencies like is-glob, http-proxy, micromatch, is-plain-obj, and @types/http-proxy, ensuring consistent functionality in request matching and proxying. The development dependencies, crucial for testing and code quality, are also largely identical, encompassing tools such as Jest, ESLint, TypeScript, and Prettier.
The key difference lies in the release date and the distributed package. Version 1.3.0 was released on April 25, 2021, a day after version 1.2.1, which suggests bug fixes or minor enhancements. This is further supported by the slight increase in fileCount (32 vs. 30) and unpackedSize (76406 vs. 73995), indicating the inclusion of additional files or code modifications. For developers, this means version 1.3.0 might offer increased stability or improved performance due to these refinements. While specific changes aren't explicitly detailed, the updated release presents the more current and potentially optimized choice for new projects or upgrades, ensuring access to the latest improvements. Developers should particularly appreciate the robust testing setup, including Supertest and Mockttp, guaranteeing reliability in various scenarios.
All the vulnerabilities related to the version 1.3.0 of the package
Denial of service in http-proxy-middleware
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
http-proxy-middleware can call writeBody twice because "else if" is not used
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.