Version 2.0.0 of the Node.js proxy package introduces several key changes compared to the older 1.0.2 release, potentially impacting developers considering an upgrade. The core functionality of providing an HTTP proxy remains consistent, as both versions share the same fundamental purpose, emulating Squid-like proxy behavior. However, significant updates are present in the underlying dependencies and development tools.
In terms of dependencies, version 2.0.0 updates args to ^5.0.3 and debug to ^4.3.4, alongside basic-auth-parser at 0.0.2-1, while the older version has args at 5.0.1, debug at ^4.1.1 and a slightly older basic-auth-parser at 0.0.2. The new version embraces modern development practices, evident in its upgrade to TypeScript. Reflecting this, the devDependencies field is drastically different: version 2.0.0 uses jest, and ts-jest for testing, and a suite of @types definitions to enhance the TypeScript development experience. The older 1.0.2 version relies on tools like mocha for testing and eslint for linting, alongside numerous related plugins, which might indicate a switch in development philosophy in v2.0.0 - Typescript first. Version 2.0.0 also includes an async-listen dev dependency, which version 1.0.2 did not, suggesting possible internal changes.
Developers will find the newer version potentially easier to contribute to, given the improved type safety and modern testing framework. The updated dependency versions ensure compatibility with recent Node.js environments and address potential security vulnerabilities. The repository URL has been updated to point to a specific directory packages/proxy within the proxy-agents repository, enabling more targeted contributions or issue reporting. The increased fileCount (15 vs 8) and unpackedSize (51008 vs 29112 ) of version 2.0.0 suggests potentially more features or increased complexity.
All the vulnerabilities related to the version 2.0.0 of the package
proxy denial of service vulnerability
A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception.
