Skip to content

Conversation

@aaronbatey
Copy link

  • This is a bugfix
  • This is a feature
  • This is a code refactor
  • This is a test update
  • This is a docs update
  • This is a metadata update

For Bugs and Features; did you add new tests?

N/A, since this is a dependency upgrade

Motivation / Use-Case

There is a security vulnerability in this package and this PR addresses it.

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Breaking Changes

There shouldn't be any, this is a minor dependency upgrade.

@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Oct 30, 2024

CLA Signed


The committers listed above are authorized under a signed CLA.

@codecov
Copy link

codecov bot commented Oct 30, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.12%. Comparing base (af6bd68) to head (6c5f6c7).
Report is 95 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (af6bd68) and HEAD (6c5f6c7). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (af6bd68) HEAD (6c5f6c7)
36 35
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5346      +/-   ##
==========================================
- Coverage   90.29%   85.12%   -5.18%     
==========================================
  Files          15       16       +1     
  Lines        1577     1741     +164     
  Branches      601      651      +50     
==========================================
+ Hits         1424     1482      +58     
- Misses        140      233      +93     
- Partials       13       26      +13     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant