Http-proxy-middleware, a popular Node.js package easing the creation of proxy servers for Connect, Express, and BrowserSync, saw a release of version 2.0.6 shortly after version 2.0.5. Both versions share the same core functionality and dependencies like is-glob, http-proxy, micromatch, is-plain-obj, and @types/http-proxy for their primary operations. Similarly, their development dependencies for testing, linting, and building, including tools like jest, eslint, typescript, and various type definitions, remain consistent.
The key changes between versions 2.0.5 and 2.0.6 probably lie in subtle bug fixes, performance enhancements, or minor feature tweaks, although these are not explicitly detailed in the metadata but is a normal practice when publishing stable versions. Inspecting the commit history between these releases on the GitHub repository is advisable for a complete understanding of the specific updates.
For developers, http-proxy-middleware simplifies adding proxy functionality within their web applications, routing requests to different backend servers. Its "one-liner" nature makes it easy to integrate, especially for local development, API mocking, or handling cross-origin requests. The consistent dependency structure between versions 2.0.5 and 2.0.6 means updating should be seamless if you're already using the library. Always review changelogs or release notes when upgrading to identify any potential compatibility issues or newly introduced features. The consistent peerDependencies '@types/express', ensures smooth integration with Express-based projects.
All the vulnerabilities related to the version 2.0.6 of the package
Denial of service in http-proxy-middleware
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
http-proxy-middleware can call writeBody twice because "else if" is not used
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
