Repository navigation
fix: Bump proxy-addr from 2.0.7 to 2.0.8 - #3490
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title begins with the allowed fix: prefix and clearly describes the dependency upgrade. The subject starts with a capitalized letter. |
| Description check | |
The description explains the issue, dependency change, security impact, scope, breaking changes, and required code changes. It does not use the repository template headings or task checkboxes, but it … |
| Linked Issues check | |
Issue #3488 requires proxy-addr 2.0.8 and its CVE-2026-90711 fix. The whole-PR summary shows package-lock.json upgrades the locked proxy-addr version from 2.0.7 to 2.0.8. The 2.0.8 release conta… |
| Out of Scope Changes check | |
The PR changes only the proxy-addr lock entry in package-lock.json, including its registry URL, integrity hash, and funding metadata. These changes support the dependency upgrade. The summary show… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Security Check | |
No security vulnerability is introduced by this pull request. The authoritative diff changes only package-lock.json, upgrading the transitive proxy-addr package from 2.0.7 to 2.0.8 with an HTTPS r… |
| Engage In Review Feedback | |
No review feedback comments were supplied. The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, there was no feedback requiring discussion, … |
Full details: Description check
-
Explanation
The description explains the issue, dependency change, security impact, scope, breaking changes, and required code changes. It does not use the repository template headings or task checkboxes, but it contains the required information in equivalent sections.
Full details: Linked Issues check
-
Explanation
Issue
#3488requiresproxy-addr2.0.8 and its CVE-2026-90711 fix. The whole-PR summary showspackage-lock.jsonupgrades the lockedproxy-addrversion from 2.0.7 to 2.0.8. The 2.0.8 release contains the required trust-subnet fix. No API change is required.
Full details: Out of Scope Changes check
-
Explanation
The PR changes only the
proxy-addrlock entry inpackage-lock.json, including its registry URL, integrity hash, and funding metadata. These changes support the dependency upgrade. The summary shows no unrelated source, API, or behavioral changes.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: Security Check
-
Explanation
No security vulnerability is introduced by this pull request. The authoritative diff changes only
package-lock.json, upgrading the transitiveproxy-addrpackage from 2.0.7 to 2.0.8 with an HTTPS registry URL and integrity hash. Its dependencies and engine constraint remain unchanged. The added funding metadata does not affect runtime behavior. Express already declares a compatibleproxy-addrrange (^2.0.7).
Full details: Engage In Review Feedback
-
Explanation
No review feedback comments were supplied. The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, there was no feedback requiring discussion, implementation, or reviewer retraction.
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
# [9.3.0-alpha.12](9.3.0-alpha.11...9.3.0-alpha.12) (2026-10-17) ### Bug Fixes * Bump proxy-addr from 2.0.7 to 2.0.8 ([#3490](#3490)) ([e017c62](e017c62))
|
🎉 This change has been released in version 9.3.0-alpha.12 |
# [10.0.0](9.2.0...10.0.0) (2026-11-04) ### Bug Fixes * Add Cancel and Add buttons to the add-row modal ([#1995](#1995)) ([#3383](#3383)) ([2d1b739](2d1b739)) * Advertise localhost instead of 0.0.0.0 in the dashboard startup message ([#3410](#3410)) ([33ce7b8](33ce7b8)) * Bump body-parser from 2.2.2 to 2.3.0 ([#3465](#3465)) ([662899b](662899b)) * Bump body-parser from 2.3.0 to 2.4.0 ([#3508](#3508)) ([cb9caf8](cb9caf8)) * Bump brace-expansion from 1.1.13 to 1.1.21 ([#3454](#3454)) ([937fe17](937fe17)) * Bump glob from 10.4.5 to 10.5.0 and minimatch from 9.0.1 to 9.0.9 ([#3467](#3467)) ([f31ada5](f31ada5)) * Bump immutable from 5.1.5 to 5.1.9 ([#3457](#3457)) ([5097c04](5097c04)) * Bump markdown-it from 14.3.0 to 14.3.3 ([#3494](#3494)) ([12d7cc0](12d7cc0)) * Bump parse from 8.5.0 to 8.6.2 ([#3468](#3468)) ([8a4c12b](8a4c12b)) * Bump proxy-addr from 2.0.7 to 2.0.8 ([#3490](#3490)) ([e017c62](e017c62)) * Bump qs from 6.15.3 to 6.16.0 ([#3458](#3458)) ([04f5acb](04f5acb)) * Info panel data not loaded when opened over an existing selection ([#3384](#3384)) ([4879959](4879959)) * Prevent Config table crash when a parameter value is null ([#3424](#3424)) ([7150acf](7150acf)) * Remote access restrictions not enforced when running behind a reverse proxy ([#3436](#3436)) ([60cb379](60cb379)) * Security upgrade Docker image from Node.js 20 to 24 ([#3518](#3518)) ([9dc2c30](9dc2c30)) ### Features * Add support for Node.js 26 ([#3525](#3525)) ([bdc5d62](bdc5d62)) * React 19 + react-router 7 + GraphiQL 5 coordinated upgrade ([#3409](#3409)) ([c3e16c2](c3e16c2)) * Remove Node 20 support and increase minimum required Node 22 version to `22.13.0` ([#3527](#3527)) ([2ff9098](2ff9098)) ### BREAKING CHANGES * Removes support for Node 20 and increases the minimum required Node 22 version to `22.13.0`. ([2ff9098](2ff9098))
|
🎉 This change has been released in version 10.0.0 |
Closes #3488
Changes
::ffff:marker, and a native IPv6 address no longer matches an IPv4-mapped subnet (jshttp/proxy-addr@780911d)fundingmetadata; remaining changes are CI and tooling onlyBreaking Changes
None
Code Changes Required
None — the upgrade is a drop-in replacement.
proxy-addris a transitive production dependency viaexpress@5.2.1(^2.0.7), so onlypackage-lock.jsonchanges. The API used by Express (proxyaddr(),proxyaddr.all(),proxyaddr.compile()) is unchanged. Parse Dashboard enablestrust proxyas a boolean, which does not use the changed subnet matching.Summary by CodeRabbit