fix(deps): update dependency http-proxy-middleware to v3 (main) by mend-for-github-com[bot] · Pull Request #32 · opentok/simple_reverse_proxy

mend-for-github-com · 2026-08-31T06:22:13Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
http-proxy-middleware	`^0.20.0` → `^3.0.0`

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability	Reachability
High	7.3	CVE-2023-26159	Reachable
Medium	6.5	CVE-2024-28849	Reachable
Medium	5.3	CVE-2024-4067	Reachable
Medium	5.3	CVE-2026-40895
Medium	5.3	CVE-2026-55602
Medium	4.0	CVE-2025-32996	Reachable
Medium	4.0	CVE-2025-32997	Reachable

Release Notes

chimurai/http-proxy-middleware (http-proxy-middleware)

`v3.0.6`

Compare Source

What's Changed

fix(types): fix Logger type by @chimurai in #1104
fix(fixRequestBody): support text/plain by @knudtty in #1103
chore(examples): bump deps by @chimurai in #1105
build(prettier): improve prettier setup by @chimurai in #1108
chore(deps): fix punycode node deprecation warning by @chimurai in #1109
chore(examples): bump deps by @chimurai in #1110
build(codespaces): add devcontainer.json by @chimurai in #1112
chore(package): bump dev dependencies by @chimurai in #1116
ci(github-action): ci.yml add node v24 by @chimurai in #1117
chore(package): bump dev dependencies by @chimurai in #1118
chore(package): upgrade to jest v30 by @chimurai in #1122
chore(examples): upgrade deps by @chimurai in #1124
chore(package): update dev deps by @chimurai in #1125
test(websocket): fix ws import by @chimurai in #1126
chore(refactor): use node: protocol imports by @chimurai in #1127
ci(node24): pin node24 due to TLS issue with mockttp by @chimurai in #1137
docs(recipes/pathRewrite.md): fix comment by @DEBargha2004 in #1135
chore(package): bump dev deps by @chimurai in #1138
chore(deps): update actions/checkout action to v5 by @chimurai in #1140
fix(error-response-plugin): sanitize input by @chimurai in #1141
chore(package.json): update dev deps by @chimurai in #1143
chore: add context7.json by @chimurai in #1144
build(eslint): update eslint.config.mjs by @chimurai in #1145
ci(github workflow): harden github workflows by @chimurai in #1146
chore(package): bump dev deps by @chimurai in #1147
ci(ci.yml): unpin node 24 by @chimurai in #1148
docs(recipes): fix servers.md http.createServer example by @hacklschorsch in #1150
ci: publish with oidc by @chimurai in #1152
chore(package.json): bump dev deps by @chimurai in #1153
chore(package.json): bump dev deps by @chimurai in #1155
chore(package.json): bump dev deps by @chimurai in #1158
test(types.spec.ts): add type check when req or res are 'any' by @chimurai in #1161
chore(package.json): bump deps by @chimurai in #1164
chore(package.json): eslint v10 by @chimurai in #1165
chore(package.json): bump dev deps by @chimurai in #1166
chore(package.json): bump dev-deps by @chimurai in #1171
docs(examples): fix websocket example by @chimurai in #1170
build(vscode): use workspace version of TypeScript by @chimurai in #1173
fix(router): harden proxy-table matching by @chimurai in #1254
chore(package.json): v3.0.6 by @chimurai in #1256

New Contributors

@knudtty made their first contribution in #1103
@DEBargha2004 made their first contribution in #1135
@hacklschorsch made their first contribution in #1150

Full Changelog: chimurai/http-proxy-middleware@v3.0.5...v3.0.6

`v3.0.5`

Compare Source

fix(fixRequestBody): check readableLength (#1096)

`v3.0.4`

Compare Source

fix(fixRequestBody): handle invalid request (#1092)
fix(fixRequestBody): prevent multiple .write() calls (#1089)
fix(websocket): handle errors in handleUpgrade (#823)
ci(package): patch http-proxy (#1084)
fix(fixRequestBody): support multipart/form-data (#896)
feat(types): export Plugin type (#1071)

`v3.0.3`

Compare Source

fix(pathFilter): handle errors

`v3.0.2`

Compare Source

refactor(dependency): replace is-plain-obj with is-plain-object (#1031)
chore(package): upgrade to eslint v9 (#1032)
fix(logger-plugin): handle undefined protocol and hostname (#1036)

`v3.0.1`

Compare Source

fix(type): fix RequestHandler return type (#980)
refactor(errors): improve pathFilter error message (#987)
fix(logger-plugin): fix missing target port (#989)
ci(package): npm package provenance (#991)
fix(logger-plugin): log target port when router option is used (#1001)
refactor: fix circular dependencies (#1010)
fix(fix-request-body): support '+json' content-type suffix (#1015)

`v3.0.0`

Compare Source

This release contains some breaking changes.

Please read the V3 discussion https://redirect.github.com/chimurai/http-proxy-middleware/discussions/768
or follow the MIGRATION_V3.md guide.

feat(typescript): type improvements (#882)
chore(deps): update micromatch to 4.0.5
chore(package): bump devDependencies
feat(legacyCreateProxyMiddleware): show migration tips (#756)
feat(legacyCreateProxyMiddleware): adapter with v2 behavior (#754)
docs(proxy events): fix new syntax (#753)
feat(debug): improve troubleshooting (#752)
test(path-rewriter): improve coverage (#751)
feat(ejectPlugins): skip registering default plugins (#750)
refactor: logging [BREAKING CHANGE] (#749)
refactor(handlers): refactor to plugins [BREAKING CHANGE] (#745)
feat(plugins): add support for plugins (#732)
docs: fix v3 documentation
fix: server mounting [BREAKING CHANGE] (#731)
test(fixRequestBody): fix broken test
refactor: use node http base types [BREAKING CHANGE] (#730) (special thanks: @cdaringe & @devanshj)
feat(option): refactor context to pathFilter option [BREAKING CHANGE] (#722)
feat: remove shorthand usage [BREAKING CHANGE] (#716)

`v2.0.10`

Compare Source

What's Changed

fix: harden proxy-table matching to prevent routing bypass by @G-Rath in #1268
ci(github-actions): update publish.yml by @chimurai in #1270
chore(package.json): v2.0.10 by @chimurai in #1271

New Contributors

@G-Rath made their first contribution in #1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10

`v2.0.9`

Compare Source

What's Changed

fix(fixRequestBody): check readableLength by @chimurai in #1097
chore(package): v2.0.9 by @chimurai in #1099

Full Changelog: chimurai/http-proxy-middleware@v2.0.8...v2.0.9

`v2.0.8`

Compare Source

What's Changed

fix(fixRequestBody): prevent multiple .write() calls by @chimurai in #1090
fix(fixRequestBody): handle invalid request by @chimurai in #1091
chore(package): v2.0.8 by @chimurai in #1094

Full Changelog: chimurai/http-proxy-middleware@v2.0.7...v2.0.8

`v2.0.7`

Compare Source

Full Changelog: chimurai/http-proxy-middleware@v2.0.6...v2.0.7

`v2.0.6`

Compare Source

fix(proxyReqWs): catch socket errors (#763)

`v2.0.5`

Compare Source

fix(error handler): add default handler to econnreset (#759)

`v2.0.4`

Compare Source

fix(fix-request-body): improve content type check (#725) (kevinxh)

`v2.0.3`

Compare Source

feat(package): optional @types/express peer dependency (#707)

`v2.0.2`

Compare Source

chore(deps): update @types/http-proxy to 1.17.8 (#701)
fix(fixRequestBody): fix request body for empty JSON object requests (#640) (mhassan1)
fix(types): fix type regression (#700)

`v2.0.1`

Compare Source

fix(fixRequestBody): fix type error (#615)
test(coverage): improve coverage config (#609) (leonardobazico)
test: add test coverage to fixRequestBody and responseInterceptor (#608) (leonardobazico)
chore(typescript): extract handlers types (#603) (leonardobazico)

`v2.0.0`

Compare Source

chore(package): drop node 10 [BREAKING CHANGE] (#577)

`v1.3.1`

Compare Source

fix(fix-request-body): make sure the content-type exists (#578) (oufeng)

`v1.3.0`

Compare Source

docs(response interceptor): align with nodejs default utf8 (#567)
feat: try to proxy body even after body-parser middleware (#492) (midgleyc)

`v1.2.1`

Compare Source

fix(response interceptor): proxy original response headers (#563)

`v1.2.0`

Compare Source

feat(handler): response interceptor (#520)
fix(log error): handle undefined target when websocket errors (#527)

`v1.1.2`

Compare Source

fix(log error): handle optional target (#523)

`v1.1.1`

Compare Source

fix(error handler): re-throw http-proxy missing target error (#517)
refactor(dependency): remove camelcase
fix(option): optional target when router is used (#512)

`v1.1.0`

Compare Source

fix(errorHandler): fix confusing error message (#509)
fix(proxy): close proxy when server closes (#508)
refactor(lodash): remove lodash (#459) (#507) (TrySound)
fix(ETIMEDOUT): return 504 on ETIMEDOUT (#480) (aremishevsky)

`v1.0.6`

Compare Source

chore(deps): lodash 4.17.20 (#475)

`v1.0.5`

Compare Source

chore(deps): lodash 4.17.19 (#454)

`v1.0.4`

Compare Source

chore(deps): http-proxy 1.18.1 (#442)

`v1.0.3`

Compare Source

build(package): exclude build artifact tsconfig.tsbuildinfo (#415)

`v1.0.2`

Compare Source

fix(router): handle rejected promise in custom router (#410) (bforbis)

`v1.0.1`

Compare Source

fix(typescript): fix proxyRes and router types (#410) (dylang)

`v1.0.0`

Compare Source

feat(createProxyMiddleware): explicit import http-proxy-middleware (BREAKING CHANGE)(#400)
feat(typescript): export http-proxy-middleware types (#400)
fix(typescript): ES6 target - TS1192 (#400)

`v0.21.0`

Compare Source

feat(http-proxy): bump to v1.18.0
feat: async router (#379) (LiranBri)
feat(typescript): types support (#369)
feat: async pathRewrite (#397) (rsethc)

If you want to rebase/retry this PR, check this box

vonage-ai-assistant · 2026-08-31T06:23:30Z

AI Adoption Report

	Lines	%
AI-generated	64	100%
Human	0	0%
Total	64

💰 Cost Breakdown

Agent	Model	AI Lines	Input Tokens	Output Tokens	Cost	Source
Mend	automated	64	746	224	$0.0000	🤖 Bot (automated)

Total Estimated Cost: $0.0000

Data Sources:

📐 1 commits with estimated tokens (~3.5 tokens/line)

Bedrock pricing: eu-central-1 region

Per-commit breakdown (1 commits)

Commit	Message	Added	AI	Human	AI %
`74c7114`	fix(deps): update dependency http-proxy-middleware to v3	64	64	0	🤖 100% (Mend)

_{Powered by Git AI Standard v3.0.0 — authorship data from refs/notes/ai (supports sessions-v2 format)}

fix(deps): update dependency http-proxy-middleware to v3

74c7114

mend-for-github-com Bot added the security fix Security fix generated by Mend label Aug 31, 2026

vonage-ai-assistant Bot added the ai-generated Over 80% AI contribution label Aug 31, 2026

Navigation Menu

Uh oh!

fix(deps): update dependency http-proxy-middleware to v3 (main) - #32

fix(deps): update dependency http-proxy-middleware to v3 (main)#32
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/main-http-proxy-middleware-3.x

mend-for-github-com Bot commented Aug 31, 2026

Uh oh!

vonage-ai-assistant Bot commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

mend-for-github-com Bot commented Aug 31, 2026

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

Uh oh!

vonage-ai-assistant Bot commented Aug 31, 2026

AI Adoption Report

💰 Cost Breakdown

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants