Http-proxy-middleware has released version 3.0.1, a minor update from the previous stable 3.0.0, packed with improvements relevant to developers utilizing this popular Node.js proxy middleware. The core description remains consistent: a "one-liner node.js proxy middleware for connect, express, next.js and more," highlighting its versatility.
Key differences reside primarily in the updated dependencies and development dependencies. Notably, "debug" has been bumped from version 4.3.4 to 4.3.6 and "@types/http-proxy" moves from 1.17.10 to 1.17.15 within dependencies. This indicates fixes and potential new features incorporated into these critical utilities. Within devDependencies, Typescript goes from 5.4.3 to 5.5.4, Husky goes from 9.0.11 to 9.1.5, furthermore, several development dependencies have received updates, including @typescript-eslint/parser and @typescript-eslint/eslint-plugin moving from 7.4.0 to 7.16.0 respectively; alongside more minor patches to other development dependencies.
The updated devDependencies reflect a commitment to modern tooling, code quality, and developer experience. Specifically, improved linting, static analysis, and testing capabilities brought by the more recent versions of packages like @typescript-eslint/* and eslint likely contribute to a more robust and maintainable codebase. The bump in husky version suggests improved git hook management, optimizing the development workflow. The release date and fileCount/unpackedSize metrics within the dist data also offer insights. The release date is much more recent, and fileCount has increased from 57 to 61: hinting at new additions to the package, despite relatively similar unpackedSize metrics.
For developers, upgrading to 3.0.1 ensures you are leveraging the latest bug fixes, dependency updates, and improvements concerning supported technologies.
All the vulnerabilities related to the version 3.0.1 of the package
Denial of service in http-proxy-middleware
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.
http-proxy-middleware can call writeBody twice because "else if" is not used
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.
